run_before_decrypt-secret-key.sh.tmpl

#!/bin/sh
# chezmoi:template:left-delimiter="#{{" right-delimiter="}}"
set -eu

CHEZMOI_CONFIG_DIR="$(dirname "${CHEZMOI_CONFIG_FILE}")"

if [ ! -f "${CHEZMOI_CONFIG_DIR}/secret.key" ]; then
  mkdir -p "${CHEZMOI_CONFIG_DIR}"
  (
    umask 077
    chezmoi age decrypt --output "${CHEZMOI_CONFIG_DIR}/secret.key" --passphrase "${CHEZMOI_SOURCE_DIR}/secret.key.age"
  )
fi