+1 for sops, I've used it across a dozen projects for keeping encrypted secrets directly in the repo. And for configuring infra with Terraform, the sops provide

+1 for sops, I've used it across a dozen projects for keeping encrypted secrets directly in the repo. And for configuring infra with Terraform, the sops provider [1] is extra convenient.* [1] https://github.com/carlpett/terraform-provider-sops https://github.com/carlpett/terraform-provider-sops * With the standard caveat that you should audit any software you're planning on giving access to your most valuable secrets.