Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time


Please note that this project is now considered end-of-life and is no longer actively maintained. Hiera-eyaml provides a much nicer implementation of encrypted hiera data and should be used instead of hiera-gpg.

If anyone feels like they would like to continue with this project and maintain please contact


Hiera is a configuration data store with pluggable back ends, hiera-gpg is a backend for hiera that supports gpg coded YAML files


Hiera is often used by configuration management systems such as Puppet with all the configuration stored in a VCS. Often you want to store sensitive information such as database root passwords in the same place as the rest of your configuration so Puppet can read it. hiera-gpg allows you to place your YAML in a gpg encoded file which can be read by Hiera on the command line or via Puppet on any machine that has a valid secret key.


Here is a sample hiera.yaml file that will work with gpg

:backends: - gpg

:logger: console

:hierarchy: - %{env}
            - common

   :datadir: /etc/hiera/data

   # Optional, defaults to ~/.gnupg
   :key_dir: /etc/hiera/gpg

By default hiera-gpg will look for GPG keys in the users' home directory (~/.gnupg) - if you want to install your secret keys somewhere else, the :key_dir: setting will override the GNUPGHOME environment variable and cause GPG to look there instead. Note: in 0.x releases this setting is called "homedir"

GPG Back end

hiera-gpg 0.1.0+ shells out to the command line and assumes that /usr/bin/env gpg is in your path. As of 1.0 it uses the gpgme rubygem to do all the GPG related stuff. If for any reason you have problems with gpgme then you may want to downgrade to the latest 0.x release.

Further Reading