ShokiNNs dotfiles

I manage my dotfiles using dotdrop.

How to install

Script

Important

Copy ssh public/private key for age, to encrypt/decrypt files to ~/.age/phg-age-dotfiles and ~/.age/phg-age-dotfiles.pub Otherwise empty files will be created instead.

[[ ! $(command -v brew) ]] && /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" \
  ; eval "$(/opt/homebrew/bin/brew shellenv)" \
  && brew update \
  && git clone https://github.com/shokinn/.files ~/.files \
  && brew bundle install --file=~/.files/bootstrap/Brewfile \
  && sudo sh -c "echo \"/opt/homebrew/bin/zsh\" >> /etc/shells" \
  && chsh -s /opt/homebrew/bin/zsh \
  && uv tool install --allow-python-downloads --python 3.11 dotdrop \
  && echo "Enter profile name (leave empty for default): " \
  && read DOTDROP_PROFILE \
  && [[ -n ${DOTDROP_PROFILE} ]] && DOTDROP_PROFILE="-p${DOTDROP_PROFILE}" || DOTDROP_PROFILE="" \
  && ~/.local/bin/dotdrop ${DOTDROP_PROFILE} --cfg=~/.files/config.yaml install \
  && unset DOTDROP_PROFILE \
  && export HOMEBREW_CASK_OPTS="--appdir=${HOME}/Applications" \
  && brew bundle install --file=~/.files/config/brew/Brewfile \
  && mkdir -p ~/workspace/{privat,work} \
  && ${SHELL} -c ~/.files/bootstrap/.macos \
  && ${SHELL}

Manual

1. Install Homebrew
2. Install age, coreutils, fzf, libmagic, mas, uv and zsh via Homebrew.

   brew bundle install --file=~/.files/bootstrap/Brewfile

3. Install drotdrop via uv (uv tool install --allow-python-downloads --python 3.11 dotdrop).
4. Copy ssh public/private key for age, to encrypt/decrypt files to ~/.age/phg-age-dotfiles and ~/.age/phg-age-dotfiles.pub
5. Clone dotfiles, install dependencies for dotdrop and install dotfiles.

   git clone https://github.com/shokinn/.files ~/.files \
   && ~/.local/bin/dotdrop --cfg=~/.files/config.yaml install

6. Install my default set of tools:

   brew bundle install --file=~/.files/config/brew/Brewfile

Encrypted files

Initially import a dot file as encrypted file

dotdrop import --transw=_encrypt --transr=_decrypt <file>

Installs/updates will now be automatically decrypted/encrypted.

Decrypt a dotfile manually

age --decrypt -i ~/.age/phg-age-dotfiles -o <ouput paht for decrypted file> <path to encrypted file>

Encrypt a dotfile manually

cat <path to plain file> | age -a -R ~/.age/phg-age-dotfiles.pub > <path to encrypted file>

Edit an encrypted dotfile

1. Install age-edit

Manual command

Default editor:

age-edit -t /tmp/ -M -a ~/.age/phg-age-dotfiles <path to file to edit>

VS Code as editor:

age-edit -e "${HOME}/.local/bin/codew" -t /tmp/ -M -a ~/.age/phg-age-dotfiles <path to file to edit>

Aliases for file editing

• ade uses the default editor
• cade uses vs code for editing the file

Both aliases are configured via my .zshrc.

Deployment secrets

age-docker manages armored age secrets from a project-local .age-docker.toml. It searches upward for the nearest policy file, stopping at the Git root. A policy declares public keys, reusable groups, and the exact recipients for every encrypted file:

version = 1

[keys]
phg = "age1..."
server = "ssh-ed25519 AAAA..."

[groups]
users = ["phg"]
production = ["server"]

[secrets]
"secrets/prod.env.age" = ["users", "production"]

Recipients are never added implicitly. New ciphertext is verified by decrypting it with ~/.age/phg-age-dotfiles before the configured file is atomically replaced. Use repeatable --identity <path> options before the subcommand when rotating keys.

age-docker init
age-docker check
age-docker list
age-docker edit secrets/prod.env.age
age-docker encrypt prod.env secrets/prod.env.age
age-docker decrypt secrets/prod.env.age prod.env
age-docker rekey secrets/prod.env.age
age-docker rekey --all

Manage public keys without changing groups or file policies:

age-docker key add operator 'age1...'
age-docker key scan server server.example.com
age-docker key remove unused-server

key scan displays the retrieved SSH key and its SHA256 fingerprint before asking for confirmation. ssh-keyscan does not authenticate the result; compare the fingerprint through a trusted channel. Replacing an existing alias requires --replace, and non-interactive confirmation requires --yes.

Backup/Restore settings for macOS native user preferences

See here for a defaults documentation: https://macos-defaults.com/

App list

App	Domain
Alfred	com.runningwithcrayons.Alfred-Preferences
Ice	com.jordanbaird.Ice
Moom	com.manytricks.Moom

Backup settings

defaults export <domain> ~/.files/config/plist/<app>.plist

Restore settings

defaults import <domain>  ~/.files/config/plist/<app>.plist

Brew

Install age encrypted Brewfile

gh auth login
ssh-keygen -F github.com >/dev/null || ssh-keyscan -t rsa,ed25519 github.com >> ~/.ssh/known_hosts
age --decrypt -i ~/.age/phg-age-dotfiles -o - ~/.files/config/brew/vw.Brewfile.age | brew bundle install --file=-

Documentation

Maybe you should take a look to my documentation to understand how I use my dotfiles. My documentation is currently quite outdated and should not be considered for help.