Question: How to avoid chicken/egg problem with decryption

Hi guys, Perhaps someone could help me with this. I have repo Y which has sensitive secrets/config information, this is encrypted before being pushed to git. Next up is the server/process that needs to decrypt this information. How would I go about automating the decryption of these files securely? So far I'm storing the encryption/decryption key in another repo, but that feels wrong. Passphrases would require manual intervention (and if automating the problem remains). I suppose a hardware device attached the servers meant to decrypt the information is plausible, but I'm thinking about using the cloud. So, steps I have in mind: * automated server creation in aws * provisioning git pulls the repo with encrypted files * automatic decryption before reloading service. * ...if automated, I need to pull the key from somewhere in order to decrypt, what is the best way to do that?