It's not a question of share everything or share nothing - with https://chezmoi.io you can choose exactly what you want to share:

* You can keep your entire dotfile repo secret by using any private git hosting, including your own git hosting or a private GitHub repo.

* You can keep individual files secret by using age or gpg encryption. If you repo is public, this only reveals the existence of the file, not its contents.

* You can keep individual parts of your dotfiles secrets, e.g. API keys, by encrypting them or storing them in your password manager. All popular password managers are supported.

Disclaimer: I'm the author of chezmoi.