What causes "encryption not configured" in twpayne/chezmoi?

Add an encryption section to your chezmoi config (e.g. [gpg] or [age] with recipient/symmetric settings).

encryption not configured

Error message

encryption not configured

What it means

errEncryptionNotConfigured (internal/chezmoi/noencryption.go:5) is returned by every method of the NoEncryption placeholder type. It signals that an encryption operation (Decrypt, Encrypt, DecryptToFile, etc.) was attempted but no encryption backend (gpg, age) is configured.

Source

Thrown at internal/chezmoi/noencryption.go:5

package chezmoi

import "errors"

var errEncryptionNotConfigured = errors.New("encryption not configured")

// NoEncryption returns an error when any method is called.
type NoEncryption struct{}

// Decrypt implements Encryption.Decrypt.
func (NoEncryption) Decrypt([]byte) ([]byte, error) { return nil, errEncryptionNotConfigured }

// DecryptToFile implements Encryption.DecryptToFile.
func (NoEncryption) DecryptToFile(AbsPath, []byte) error { return errEncryptionNotConfigured }

// Encrypt implements Encryption.Encrypt.
func (NoEncryption) Encrypt([]byte) ([]byte, error) { return nil, errEncryptionNotConfigured }

// EncryptFile implements Encryption.EncryptFile.
func (NoEncryption) EncryptFile(AbsPath) ([]byte, error) { return nil, errEncryptionNotConfigured }

// EncryptedSuffix implements Encryption.EncryptedSuffix.
func (NoEncryption) EncryptedSuffix() string { return "" }

View on GitHub (pinned to f901167e46)

Solutions

Add an encryption section to your chezmoi config (e.g. [gpg] or [age] with recipient/symmetric settings).
Ensure the underlying tool (gpg or age) is installed and keys exist.
Remove or decrypt the encrypted_ files if encryption is not actually intended.

Example fix

// ~/.config/chezmoi/chezmoi.toml
// before: (no encryption block)
// after:
[encryption]
command = "age"
[age]
identity = "~/.config/age/key.txt"
recipient = "age1..."

Defensive patterns

Strategy: validation

Validate before calling

cfg, err := chezmoi.LoadConfig()
if err != nil || cfg.Encryption == nil || cfg.Encryption.Command == "" {
    // configure encryption before processing encrypted_ files
}

Try / catch

if err := apply(); err != nil {
    if errors.Is(err, errEncryptionNotConfigured) {
        // prompt user to configure gpg/age in chezmoi.toml
    }
    return err
}

Prevention

Set up the [encryption] block before adding encrypted_ files.
Run `chezmoi doctor` to confirm gpg/age is available.
Test `chezmoi apply` after config changes.

When it happens

Trigger: Chezmoi is constructed with NoEncryption and code calls Decrypt/Encrypt/DecryptToFile, e.g. processing encrypted_ prefixed source files without an encryption config.

Common situations: Encrypted files exist in the source state but no encryption = gpg/age block or keys are set in the config; running chezmoi in an environment missing GPG/age tooling; forgetting to run chezmoi init with encryption setup.

Related errors

AI-assisted analysis of twpayne/chezmoi@f901167e46 (2026-09-01). Data as JSON: /api/errors/9ebe732fceae6af5. Report an issue: GitHub.