Pure-JS method of importing settings into Meteor.js. This file is put in server/lib.

1_settings.js

environment = process.env.NODE_ENV || "development";

var settings = {
  development: {
    public: {},
    private: {}
  },
  staging: {
    public: {},
    private: {}
  },
  production: {
    public: {},
    private: {}
  }
};

if (!process.env.METEOR_SETTINGS) {
  console.log("=> No METEOR_SETTINGS passed in, using locally defined settings.");

  if (environment === "production") {
    Meteor.settings = settings.production;
  } else if (environment === "staging") {
    Meteor.settings = settings.staging;
  } else {
    Meteor.settings = settings.development;
  }

  // Push a subset of settings to the client.
  if (Meteor.settings && Meteor.settings.public) {
    __meteor_runtime_config__.PUBLIC_SETTINGS = Meteor.settings.public;
  }
}

Regardless of if the repo is private or public, you should never push things like private keys or passwords to other services. Assume everyone at GitHub can see them (they can).

You can create your production settings file locally, then scp it to your server initially, and add it to your .gitignore file.