Skip to content
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Type Name Latest commit message Commit time
Failed to load latest commit information.
pkg Packaged hiera-gpg-1.1.0.gem Oct 22, 2012


Please note that this project is now considered end-of-life and is no longer actively maintained. Hiera-eyaml provides a much nicer implementation of encrypted hiera data and should be used instead of hiera-gpg.

If anyone feels like they would like to continue with this project and maintain please contact


Hiera is a configuration data store with pluggable back ends, hiera-gpg is a backend for hiera that supports gpg coded YAML files


Hiera is often used by configuration management systems such as Puppet with all the configuration stored in a VCS. Often you want to store sensitive information such as database root passwords in the same place as the rest of your configuration so Puppet can read it. hiera-gpg allows you to place your YAML in a gpg encoded file which can be read by Hiera on the command line or via Puppet on any machine that has a valid secret key.


Here is a sample hiera.yaml file that will work with gpg

:backends: - gpg

:logger: console

:hierarchy: - %{env}
            - common

   :datadir: /etc/hiera/data

   # Optional, defaults to ~/.gnupg
   :key_dir: /etc/hiera/gpg

By default hiera-gpg will look for GPG keys in the users' home directory (~/.gnupg) - if you want to install your secret keys somewhere else, the :key_dir: setting will override the GNUPGHOME environment variable and cause GPG to look there instead. Note: in 0.x releases this setting is called "homedir"

GPG Back end

hiera-gpg 0.1.0+ shells out to the command line and assumes that /usr/bin/env gpg is in your path. As of 1.0 it uses the gpgme rubygem to do all the GPG related stuff. If for any reason you have problems with gpgme then you may want to downgrade to the latest 0.x release.

Further Reading


You can’t perform that action at this time.