I&#x27;ve been using ansible-vault to solve this problem in our infrastructure repository. A symmetric vault key is encrypted using gpg, and Ansible&#x27;s vault_password_file is set to to an executable shell script containing `gpg --batch --use-agent --descrypt vault_key.gpg`.<p>Very specific to Ansible, but works fine. It&#x27;s a shame only files containing variables (we&#x27;re using group_vars) can be encrypted, and not arbitrary files or templates.