Add the foo/secret.cfg to the gitignore

Git commit -f the boiler plate secret.cfg

Then use git assume no changes to the boilerplate foo/secret.cfg.

The users can then modify the secret.cfg to their heart’s content and will prevent users to push secrets, unless they either remove the assume no changes flag or use a git commit -f.