dotfiles

Senior-grade, reproducible macOS dev environment managed with chezmoi + sops/age.

For an AI-native fullstack stack: React/TypeScript · Go · Postgres · devbox + colima · Claude Code.

Principles

• One command rebuilds a machine from scratch.
• Zero secrets in git — everything sensitive is sops-encrypted or gh-helper-injected.
• Per-machine differences handled by templates, not forks.
• Tested — CI dry-runs chezmoi apply and gitleaks-scans every push.

Fresh machine

# 1. install + apply dotfiles (installs chezmoi, prompts for name/email/work-flag)
sh -c "$(curl -fsLS get.chezmoi.io)" -- init --apply <this-repo-url>

# 2. restore the age private key (from your password manager / backup) so secrets decrypt
mkdir -p ~/.config/sops/age
cp /path/to/backup/keys.txt ~/.config/sops/age/keys.txt && chmod 600 ~/.config/sops/age/keys.txt

# 3. re-apply now that secrets can decrypt
chezmoi apply

The run_onchange_* bootstrap script installs Homebrew + the Brewfile, oh-my-zsh, the devbox global profile, node (nvm), and tmux TPM.

Daily use

just diff              # preview changes before applying
just apply             # apply source -> $HOME
just edit ~/.zshrc     # edit a managed file
just add ~/.config/foo # capture a new dotfile
just secrets           # edit the encrypted secret store
just macos             # apply dev-friendly macOS system defaults (manual, needs sudo)
just freeze-packages   # re-snapshot Brewfile + devbox after installing something
just update            # git pull + apply

Secrets (sops + age)

• Encrypted store: secrets/env.enc.yaml (safe to commit — values are AES-encrypted).
• Private key: ~/.config/sops/age/keys.txt — never committed; back it up in your password manager.
• Policy: .sops.yaml. Templates read secrets at apply time, e.g. dot_npmrc.tmpl.

To enable the CI apply-dry-run, add the age private key as repo secret SOPS_AGE_KEY.

Layout

.chezmoi.toml.tmpl                     machine vars (prompted on init)
.sops.yaml  .gitignore  .chezmoiignore
dot_zshrc  dot_zshenv  dot_zprofile    shell
dot_aliases  dot_functions             modular shell config (sourced by .zshrc)
dot_gitconfig.tmpl                     git identity + sane defaults (templated, no tokens)
dot_global-gitignore                   global git excludes (core.excludesFile)
dot_npmrc.tmpl                         npm auth (from sops)
dot_config/                            starship, ghostty, yazi, htop, gh, herdr
dot_claude/                            Claude Code settings + rules (go/ts/common)
secrets/env.enc.yaml                   sops-encrypted secrets
packages/Brewfile  devbox.global.json  reproducible package sets
macos/set-defaults.sh                  dev-friendly macOS defaults (manual: just macos)
.chezmoiscripts/run_onchange_*         idempotent bootstrap
.github/workflows/ci.yml               gitleaks + apply dry-run
justfile                               task runner

Credits

Structure and the macOS-defaults approach are inspired by freekmurze/dotfiles, adapted from a PHP/Laravel workflow to this React/TS · Go · Postgres · chezmoi setup.

Security note

If a token ever lands in git history, revoke it immediately — history is permanent. The gitleaks pre-commit hook + CI job exist to make that near-impossible.

pre-commit install   # enable the local secret gate