kc's dotfiles

Personal dotfiles configuration for kamontat.

• Terminology
  • Target/Destination
  • Source
  • Local Repository
  • Remote Repository
  • Lite Setup
  • Full Setup
• Usage
  • Prerequisites
  • Getting Started
  • Actions
  • Update Target Directory
  • Uninstall Dotfiles
• Features
  • Zinit
    • Upgrade Zinit
    • Upgrade Plugins
  • LazyVim (Neovim)
    • Upgrade Plugins
  • Homebrew
    • Upgrade Packages
  • Mise
  • 1Password
  • Alfred
    • Setup
  • TablePlus
  • Okta Verify
  • Keybase
  • Docker
    • Verify Docker Image
      • Verify Docker Hub Image
      • Verify GitHub Container Registry Image
  • KDF Helper Scripts
• Known Gaps
  • macOS
• Contributing

Terminology

For additional terminology, see chezmoi reference.

Target/Destination

• Destination Directory: The directory being managed (typically ~).
• Target: Individual files, directories, or symlinks inside the destination directory.
• Target State: The computed desired state for your destination directory.

Source

• Source Directory: Where chezmoi stores source state (~/.local/share/chezmoi by default).
• Source State: The desired state definition (including templates and machine-specific data).

Local Repository

The Git repository on your local machine (usually your Source Directory), which contains your source state and configuration.

Remote Repository

An external Git repository (for example, GitHub) that you push local changes to and pull updates from. This is how you sync your dotfiles across multiple machines.

Lite Setup

Install only non-encrypted data based on data flags.

chezmoi init kc-workspace --apply --force --purge-binary --promptDefaults

Full Setup

Install all configured data based on data flags.

Requirement:

• $HOME/.config/chezmoi/key.txt (otherwise, setup scripts will prompt for the encryption password).

chezmoi init kc-workspace --apply --force --purge-binary \
  --promptDefaults --promptBool "Enable 1Password=true,Enable age=true"

Usage

Prerequisites

1. Sign in to the App Store.

Getting Started

1. Open the Terminal app.
2. Install Homebrew (macOS only).

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

3. Install prerequisite dependencies.

## macOS (you will see <path> from step 2 output)
eval "$("/<path>/brew" shellenv)"
brew install git

## Debian-based
apt install -y git curl

## Alpine-based
apk add -y git curl

4. Install chezmoi temporarily via direct download.

sh -c "$(curl -fsSL get.chezmoi.io)" -- -b "$HOME/.local/bin" -t "v2.70.5"

5. Initialize the chezmoi repository.

## Add --dry-run to check the expected result first
"$HOME/.local/bin/chezmoi" init kc-workspace \
  --apply --force --purge-binary --promptDefaults

6. Sign in to your account in the 1Password app.
7. Enable Developer mode in 1Password (learn more).
   • Enable Show 1Password Developer experience.
   • Enable Integrate with 1Password CLI.
   • Enable Integrate with other apps.
   • Enable Check for developer credentials on disk.
8. Open a new terminal window or tab. Zinit should start downloading dependencies.
9. Validate op status (optional).

## Validate account status
op whoami
# URL:        https://my.1password.com/
# Email:      <your-email>
# User ID:    <your-user-id>

10. Get the full-setup encryption password from 1Password (optional).

## Use app search bar
# 7qxsqxktd3qziyp2m2hzw7bpp4

## Use 1Password CLI
op read --account my "op://h75rks2xxgluyljikha4oforri/7qxsqxktd3qziyp2m2hzw7bpp4/password"

11. Run full setup.

## This prompts for the encryption password from step 10
kdf-setup-full.sh

12. Restart your computer at least once to apply all changes.

Actions

• https://www.chezmoi.io/user-guide/daily-operations/
• https://www.chezmoi.io/user-guide/command-overview/

Common actions you might perform with this repository:

Update Target Directory

chezmoi update --init --apply

Uninstall Dotfiles

chezmoi purge

Features

• Zsh configuration: here
  • Zinit as the Zsh plugin manager
• Git configuration: here
• Applications and packages (via Homebrew or apt)
  • Homebrew as package manager
  • Installed applications list: here
• Command-line tools (via mise)
  • Installed tools: here
• Working directory layout
  • Personal for personal projects
  • Works for work projects, organized by workplace
• Encrypted files via gpg
• Password manager via 1Password

Zinit

Installation method: chezmoi/external

Upgrade Zinit

zinit self-update

Upgrade Plugins

zinit update --all

LazyVim (Neovim)

Installation method: mise

Used to manage Neovim plugins and configuration.

Upgrade Plugins

nvim --headless -c '+Lazy! sync' +qa

Homebrew

Installation method: chezmoi/external

Upgrade Packages

--greedy also upgrades casks with :latest or :auto-upgrade.

brew upgrade --greedy

Mise

Main config:

• $HOME/.config/mise/config.toml

Additional configs:

• ~/Works/<name>/mise.toml for work-related config
• ~/Personal/mise.toml for personal-related config

1Password

Installation method: Homebrew (mise for CLI)

This is the core app that ties the configuration together. All secrets and private documents are stored in 1Password.

Alfred

Installation method: Homebrew

• License location: 1Password
• Preference location: iCloud

Setup

1. Enter your license (if any).
2. Enable the permissions requested by the app.
3. Go to Preferences > Advanced > Reveal in Finder.
4. Copy your existing configuration and replace the current one.

TablePlus

Installation method: Setapp

• Connections file: iCloud
• Connection passwords: 1Password

Okta Verify

Installation method: Homebrew

Important: You need your previous device to transfer an account. If your device was reset or sold, use the account recovery method.

Keybase

Installation method: Homebrew

Important: You need your previous device to transfer an account. If your device was reset or sold, use the account recovery method.

Docker

Dotfiles in Docker have a two-stage setup. By default, only Lite Setup is applied. To use full setup, run kdf-setup.sh in the Docker instance.

## Start an interactive shell session
docker run -it --rm kamontat/dotfiles:local

Verify Docker Image

All Docker images include attestations. You can verify integrity and provenance using the associated cryptographically signed attestations.

Verification output should include:

• Status: ✓ Verification succeeded!
• The repository where the image was created
• The workflow and Git reference used to create the image

Verify Docker Hub Image

# gh attestation verify oci://kamontat/dotfiles:latest --owner kc-workspace
$ gh attestation verify "oci://kamontat/dotfiles:<tag-name>" --owner kc-workspace

...
✓ Verification succeeded!
...

Verify GitHub Container Registry Image

## Add read:packages scope to read images from GHCR
## You may need to log in first: https://cli.github.com/manual/gh_auth_login
$ gh auth refresh --scopes "read:packages"

# gh auth token | docker login "ghcr.io" --username "kamontat" --password-stdin
$ gh auth token | docker login "ghcr.io" --username "<username>" --password-stdin

# gh attestation verify "oci://ghcr.io/kc-workspace/dotfiles:latest" --owner kc-workspace
$ gh attestation verify "oci://ghcr.io/kc-workspace/dotfiles:<tag-name>" --owner kc-workspace

...
✓ Verification succeeded!
...

KDF Helper Scripts

The repository provides helper scripts named kdf-*.sh that should be available to everyone. If you cannot run kdf-*.sh, check your ~/.local/bin directory.

Known Gaps

There are still a few things we cannot automate.

macOS

• Menu bar items: System Settings > Menu Bar > Menu Bar Controls

Contributing

Please refer to the CONTRIBUTING guide.