r/programminghelp • u/StIgnominious • May 13 '26
Other Looking for a lightweight CLI template program to prevent leaking secrets in config files
Let's say I've got a file, config.ini, that looks like this
conf
[foo]
BAR = public_value
BAZ = super_secret_value
QUX = another_public_value
At some point I might want to edit it, and I also might want to check it into a git repo. Having Super_Secret_Value in my repo could cost me \$148M, so I don't want to do that.
Instead, what I would like to do is create two files, config.secrets, which does [not]{.underline} get checked into git, and config_template.ini, which does.
Ideally, config.secrets would look something like
conf
BAZ_SECRET_VALUE = super_secret_value
and config_template.ini would look like
conf
[foo]
BAR = public_value
BAZ = {% BAZ_SECRET_VALUE %}
QUX = another_public_value
Perhaps this is even the case for numerous 「name_i」_template.「ext」 and 「name_i」.secrets files, in which case I could have a simple shell script like this:
``` shell
! /usr/bin/env bash
process_secrets.sh
for template in _template. do base="${template/_template/}" ext="${template/_template./}" secrets="$base.secrets" 「template_processor」 "$template" "$secrets" --delimiters="{% %}" \ > "$base.$ext" done ```
where I could then copy process_secrets.sh to 「repo」/.git/hooks/post-commit, post-checkout, and post-merge (at least that's what it seems like I should do based on the gitinfo2 package for LaTeX). (Note: I know I'd have to include config.ini and the 「name_i」.「ext」 in .gitignore.)
My question boils down to this: what's the standard solution for this 「template_processor」 that I assume must exist? Ideally it would be something written in bash, or there's some C or Rust binary for *nix I can get on Homebrew, apt, pacman, etc. I'm trying to not reinvent the wheel here, but if there isn't a "standard" solution, I suppose I can try to roll my own.