[msdz]

In addition to that, chezmoi templating can be used to fill in environment variables like secret keys, you just need to unlock rbw or whatever other password manager it is that you use. I have some that I export in my shell config, and this setup allows me to have the repo in a public place and not worry about who finds it.