Dotfiles

Public dotfiles managed with chezmoi. This repository has a single installation mode and does not rely on private overlays or profile data.

Quick Start

# One-liner (clones to ~/.dotfiles and installs):
sh -c "$(curl -fsLS https://raw.githubusercontent.com/rudironsoni/dotfiles/main/scripts/install_dotfiles.sh)"

For local development from this checkout:

./install.sh

# or chezmoi directly:
chezmoi -S home apply --dry-run
chezmoi -S home apply

Shell Aliases

alias xclaude="claude --allow-dangerously-skip-permissions"
alias xcodex="codex --dangerously-bypass-approvals-and-sandbox --sandbox danger-full-access"
alias xopencode="opencode --dangerously-skip-permissions"
alias hclaude="headroom wrap claude --allow-dangerously-skip-permissions"
alias hcodex="headroom wrap codex"
alias hopencode="headroom wrap opencode"

Environment Variables

Variable	Description
DOTFILES_DEBUG	Set true to enable debug output
DOTFILES_REPO_HOST	Custom Git host (default: https://github.com)
DOTFILES_USER	GitHub user dotfiles repo (default: rudironsoni)
DOTFILES_BRANCH	Branch to use (default: main)
DOTFILES_1PASSWORD_ENV_NAME	Override machine-scoped 1Password Environment cache name
DOTFILES_1PASSWORD_ENV_ID	Seed or override 1Password Environment ID
DOTFILES_1PASSWORD_ENV_ID_FILE	Override unmanaged local Environment ID file path
DOTFILES_1PASSWORD_ENV_FILE	Override unmanaged local Environment dotenv cache path
DOTFILES_1PASSWORD_ENV_AUTO_SYNC	Set to 0 to disable automatic Environment cache refresh
DOTFILES_1PASSWORD_ENV_SYNC_TTL	Minimum cache age in seconds before refreshing Environment cache
DOTFILES_1PASSWORD_SERVICE_ACCOUNT_TOKEN	Seed local 1Password Service Account token during bootstrap
DOTFILES_1PASSWORD_SERVICE_ACCOUNT_TOKEN_FILE	Override unmanaged local token file path
DOTFILES_1PASSWORD_SSH_PRIVATE_KEY_REF	1Password op:// ref for the SSH private key, including ?ssh-format=openssh
DOTFILES_1PASSWORD_SSH_PRIVATE_KEY_FILE	Override synced SSH private key path (default: ~/.ssh/id_ed25519_1password)
DOTFILES_SSH_AUTH_SOCK	Override managed local ssh-agent socket (default: ~/.ssh/agent.sock)

1Password Environment ID, dotenv cache, and Service Account token are stored only in unmanaged local files under ${XDG_CONFIG_HOME:-$HOME/.config}/1password/environments/ by default. Shell startup loads variables from the local cache only. Automatic refreshes are throttled, use the 1Password CLI cache, and keep the previous cache when 1Password is unavailable or rate-limited. Do not commit token files, cache files, private op:// references, or key material.

1Password SSH Key Sync

OpenSSH and Git use a local ssh-agent socket:

~/.ssh/agent.sock

Chezmoi syncs ~/.ssh/id_ed25519_1password from 1Password using a Service Account token and the local DOTFILES_1PASSWORD_SSH_PRIVATE_KEY_REF Environment value:

DOTFILES_1PASSWORD_SSH_PRIVATE_KEY_REF="op://vault/item/private key?ssh-format=openssh"

The private key ref remains unresolved in the dotenv cache so private key material is never exported as a shell variable. The key file is written with 0600, its public key is derived locally, and Git SSH signing uses ~/.ssh/id_ed25519_1password.pub. The legacy 1Password GUI SSH agent is not managed or used.

Public-Safe Contract

• No credentials are stored or referenced in this repo.
• Do not commit key material, item names, vault names, account names, private hosts, op:// references, or token environment exports.
• No profiles or private overlays are required.
• Private machine values belong in unmanaged local files such as ~/.gitconfig.local, ~/.zshrc.local, or unmanaged 1Password Environment files.

Supported Platforms

OS	Status	Notes
macOS	Supported	Homebrew packages and casks
Ubuntu/Debian	Supported	apt packages
Fedora/RHEL	Supported	dnf packages
Arch Linux	Supported	pacman packages
openSUSE	Supported	zypper packages
Windows	Supported	PowerShell and winget/scoop basics
WSL, Codespaces, Containers	Supported	Environment-aware ignores

Repository Structure

dotfiles/
├── .chezmoiroot
├── install.sh
├── home/
│   ├── .chezmoi.yaml.tmpl
│   ├── .chezmoidata.yaml
│   ├── .chezmoiexternal.yaml
│   ├── .chezmoiignore
│   ├── .chezmoihooks/
│   ├── .chezmoiscripts/
│   ├── .chezmoitemplates/
│   └── dot_zshrc.tmpl
├── scripts/
│   ├── install_dotfiles.sh
│   ├── test-dry-run.sh
│   ├── test-render.sh
│   └── test.sh
└── tests/
    ├── run-matrix.sh
    ├── test-chezmoi.sh
    └── validate-templates.sh

Packages

Packages are declared in home/.chezmoidata.yaml under one public package set. Platform installers in home/.chezmoiscripts/ read the lists directly.

Git Identity

On first run, chezmoi will interactively prompt for name and email. These are written to ~/.gitconfig. Shared config also includes ~/.gitconfig.local for machine-specific identity and private settings.

[user]
    name = Your Name
    email = you@example.com

Optional scoped Git identities can be set with local chezmoi data keys. personalGitName and personalGitEmail render ~/.gitconfig.local so repositories under ~/src/rudironsoni/** use ~/.config/git/identities/personal.gitconfig.

Testing

# Render into temporary home dry-run only
bash scripts/test-dry-run.sh

# Render and keep temporary home for inspection
bash scripts/test-render.sh

# Validate templates and public-safe checks
bash tests/validate-templates.sh

# Docker-based integration tests
bash scripts/test.sh --variant devcontainer --os ubuntu-24.04

# Docker matrix
./tests/run-matrix.sh

Notes

• home/.chezmoiexternal.yaml only fetches public third-party plugins.
• home/dot_zshrc.local.tmpl creates public-safe placeholder local customizations.
• Any private values should be added manually on each machine outside chezmoi management.