Disable-Enable Encryption based on the profile chosen

[lnyousif]

Thank you for this amazing tool and your constant community support

I created a setup in my dotfiles that allow me to choose a profile first

• base setup (Run anytime I do chezmoi apply)
• devmachine setup (If I am initializing a development machine)
• kids setup (If I am setting up my kids machines).

I basically automate the process based on thechezmoi init answers at first time it runs.
I also ask few questions to see if I need to enable password manager of ssh key encrypted access by using what I call features.

Both features and setup rely on .chezmoiignore inclusion and exclusion to setup all this.

I explained the above because now I want to fake encryption and passphrase prompt (Initial setup, prior to enabling password manager optional)

How can I enable and disable encryption based on a prompt at the first initialization? I seem to always get a prompt with passphrase even when I don't need it. I probably can wrap the [age] part of .chezmoi.toml.tmpl, but is this the best approach?

[lnyousif]

bumping this up if there is any advice , the question is

How can I enable and disable encryption based on a prompt at the first initialization? I seem to always get a prompt with passphrase even when I don't need it. I probably can wrap the [age] part of .chezmoi.toml.tmpl, but is this the best approach?

Also any thoughts on storing the passphrase in env variables for encryption and also for the KeepassXC database ? any best practice ?

[halostatue]

I don't really have any advice or best practice suggestions on this, because the workflow that you're after doesn't feel like a best practice. You could possibly put some conditionals around calls to decrypt, but I honestly don't know whether it would be worth the effort or even work.

Beyond that, I don't use KeepassXC nor encrypted files. I don't think that it would be wise to use env vars for either, though, as any process can read environment variables.

[lnyousif]

Thanks for the reply , I totally understand that its not a perfect scenario, but what I am trying to do is to have an initial manual setup that inject those values to allow me to ensure I get everything ready when I run chezmoi first time on a new machine.

for the encrypt part the approach I outlined above works fine at least for my scenario , Actually Tom gave me a very good way to handle external setup based on encryption being setup before here #4438 (reply in thread)

Thanks a lot for your take

[Lockszmith-GH]

Check out my Bootstrap idea at #4415, this might come in handy for your situation.

[lnyousif]

Thank you, but the link you provided have no post by you ? am I missing something ?

[Lockszmith-GH]

Sorry about that, was led astray by github's search on a small mobile screen. I fixed the link now.