Home

dotfiles

macOS configuration for a DevOps daily driver: zsh, Ghostty + tmux (or Rex), AeroSpace, SketchyBar, Neovim, VS Code, Kubernetes guardrails, secrets kept in Bitwarden, global git hooks and Claude Code. Everything lives in user-cube/dotfiles; this wiki is the guide to using it. The per-folder READMEs in the repo hold the reference tables (every shortcut, every plugin).

Start here

• New Mac: the devops-daily-driver Ansible playbook installs the tools and these dotfiles. See Installing and updating.
• Day to day: dotfiles-sync updates a machine from the repo, dotfiles-diff shows what it would change first.
• Something failed: Troubleshooting lists the messages you may see and what to do.

Pages

Page	What it covers
Installing and updating	the playbook, dotfiles-sync / dotfiles-diff, what install.sh does, per-machine files and their Bitwarden backup
Shell	zsh: ~/.zshrc.local, the shared functions, history, fzf, startup time
Terminal and desktop	Ghostty + tmux, Rex, AeroSpace, SketchyBar, borders
Kubernetes	kube-guard (asks before changing production), k9s and sofka read-only, the ⌘K popup, what "production" is per machine
Secrets	Bitwarden (bw, secret), SOPS age keys (sops-on), what keeps secrets out of git, history and Claude Code
Git	identities by remote, signing, defaults, the global hooks
Editors	Neovim, VS Code (ws, Hue), lazygit, yazi
Claude Code	the synced settings and the hook that blocks reads of private files
Development	how the repo is laid out, tested and changed: tests, CI, conventions, adding a tool
Troubleshooting	known errors and their fixes

Principles

• One source of truth. The repo is copied to the machine, never edited there: what is specific to one machine goes in files that are never committed (~/.zshrc.local and the others in Installing and updating).
• Secrets never touch the repo or the shell's environment. Bitwarden is the source; tools get a secret only for the command that needs it.
• Production is guarded. kubectl / helm ask before changing a production cluster; k9s and sofka open read-only there.
• Everything is tested. pytest, Go tests and shellcheck run in CI on macOS, including a full dotfiles-sync into an empty fake HOME.