title: How can I save my secret keys and password securely in my version control system?
body: <p>I keep important settings like the hostnames and ports of development and production servers in my version control system. But I know that it's <em>bad practice</em> to keep <em>secrets</em> (like private keys and database passwords) in a VCS repository.</p>
  
  <p>But passwords--like any other setting--seem like they should be versioned. So what <em>is</em> the proper way to keep passwords version controlled?</p>
  
  <p>I imagine it would involve keeping the <em>secrets</em> in their own "secrets settings" file and having <em>that</em> file encrypted and version controlled. But what technologies? And how to do this properly? Is there a better way entirely to go about it?</p>
  
  <hr>
  
  <p>I ask the question generally, but in my specific instance I would like to store secret keys and passwords for a <em>Django/Python</em> site using <em>git</em> and <em>github</em>.</p>
  
  <p>Also, an <em>ideal</em> solution would do something magical when I push/pull with git--e.g., if the encrypted passwords file changes a script is run which asks for a password and decrypts it into place.</p>
  
  <p><hr>
  EDIT: For clarity, I <em>am</em> asking about where to store <em>production</em> secrets.</p>