run_once_before_decrypt-private-key.sh.tmpl

#!/bin/sh

if [ ! -f "{{ .chezmoi.homeDir }}/.config/chezmoi/.key" ]; then
    mkdir -p ~/.config/chezmoi
    chezmoi age decrypt --passphrase --output ~/.config/chezmoi/.key {{ .chezmoi.sourceDir }}/.key.age
    chmod 600 ~/.config/chezmoi/key.txt
fi