SOPS can be part of the solution. It takes care of encrypting and decrypting config files.

https://github.com/getsops/sops