dotfiles

Managed with chezmoi.

Prerequisites

• chezmoi installed
• pre-commit installed
• age key at one of:
  • Linux: ~/.config/sops/age/keys.txt
  • macOS: ~/Library/Application Support/sops/age/keys.txt

Usage

# Install pre-commit hooks (first-time only)
pre-commit install
pre-commit install --hook-type commit-msg

# Initialize chezmoi with this repo as source
make setup

# Preview a rendered apply without modifying $HOME
make

# Apply dotfiles to $HOME
make install

# Validate templates, linting, and secret decryption
make check

# Preview changes before applying
chezmoi diff --source=/path/to/this/repo

Target	Behavior
make / make build	Render an apply as a dry-run without modifying $HOME
make setup / make init	Securely install the age identity, then initialize chezmoi
make install	Apply dotfiles to $HOME
make check / make test	Run pre-commit hooks and verify age decryption

Platform handling

• macOS: Uses .zprofile, AeroSpace config; excludes .bashrc.d/ and i3
• Linux: Uses .bashrc.d/, i3 config; excludes .zprofile and AeroSpace

Secrets

Secrets are encrypted with age. The encrypted file encrypted_secrets.yaml.age is decrypted at apply time using the platform-specific key path configured in .chezmoi.toml.tmpl. make setup creates a missing identity atomically with owner-only permissions. Secret-rendering targets use chezmoi's private_ attribute. Shell tokens remain unexported and are injected only by the gh, ghorg, and opencode wrappers. Templates reference secrets via include "encrypted_secrets.yaml.age" | decrypt.

AWS profiles

• makeitwork — Make IT Work Cloud AWS access. Use this profile for SOPS AWS KMS operations after the KMS recipient is configured, for example AWS_PROFILE=makeitwork sops -e -i secrets.yaml.

Linting

Pre-commit hooks handle:

• Trailing whitespace and EOF fixes
• YAML validation
• Shellcheck for bash scripts
• Conventional Commits enforcement
• Chezmoi template validation
• Chezmoi doctor checks

CI

GitHub Actions runs the full pre-commit suite on Linux and macOS using an ephemeral age identity and non-production fixture secrets. CI actions, tools, and external archives are pinned to immutable versions or commits; external archive checksums are recorded in .chezmoiexternal.toml.tmpl.

Credits

Fonts

This repository includes the following third-party fonts:

• Fixedsys Excelsior (FSEX.ttf)

  • Source: https://github.com/kika/fixedsys
  • Original author: Darien Valentine
  • License: CC0 1.0 Universal (Public Domain Dedication)
  • Description: A TrueType bitmap font with programming ligatures, based on the classic Fixedsys typeface.

• The Ultimate Oldschool PC Font Pack (Px437_IBM_VGA_*.ttf)

  • Source: https://int10h.org/oldschool-pc-fonts/
  • Author: VileR
  • License: CC BY-SA 4.0
  • Description: Pixel-perfect reproductions of classic IBM VGA text mode fonts from DOS-era PCs.