I use git-crypt with VCSH for dotfiles and Ansible for provisioning, using Ansible's built-in encryption for some data. It works pretty well, but to make things

I use git-crypt with VCSH for dotfiles and Ansible for provisioning, using Ansible's built-in encryption for some data. It works pretty well, but to make things less annoying, I prompt for decrypt passwords up front and if typo it, you won't know until much later when bringing a machine up from scratch.