I want to reinforce what mnutt said. A separate, secured repository for your settings is a very good thing.

You may want to look into salt, chef or puppet, which let you separate out your configuration from your security credentials.