Installing and updating

Installing and updating

A new Mac

The devops-daily-driver playbook installs the tools (Homebrew packages, apps, Go, krew plugins, the pinned zsh / tmux plugins) and these dotfiles:

1. it clones this repo to ~/dotfiles
2. syncs .config/ to ~/.config/, git_hooks/ to ~/git_hooks/, claude/ to ~/.claude/
3. copies the files .config/dotfiles/home-files lists to ~ (.zshrc, .p10k.zsh, the git configs), and seeds ~/.gitconfig-work when missing
4. runs .config/dotfiles/install.sh (below)

Then bring back the per-machine files from Bitwarden: local-restore other-mac (or the playbook's --tags local-restore).

Updating a machine: dotfiles-sync

dotfiles-sync
exec zsh          # load the new .zshrc

It does what the playbook's dotfiles tag does, without Ansible: pulls ~/dotfiles, syncs and copies the same files, runs install.sh, then reloads tmux, Rex, AeroSpace, SketchyBar and borders. Ghostty keybind changes need ⌘Q.

• Sync from the clone you edit: export DOTFILES_DIR=~/work/github/dotfiles in ~/.zshrc.local. It installs what that clone has, and warns when it is a branch other than main or has uncommitted changes.
• It updates itself: after the pull it continues with the pulled dotfiles.zsh, not the one your shell loaded at startup, so a renamed file can't break it. (Shells started before that change still need exec zsh once; see Troubleshooting.)

Seeing first what it would change: dotfiles-diff

dotfiles-diff      # files it would overwrite, add or remove
dotfiles-diff -p   # with their diffs: - is this machine, + what the sync brings

It compares with the upstream the sync would pull (fetched, never merged), or with HEAD when the clone is ahead. Nothing on the machine changes.

What install.sh does

The steps after the files are in place, the same for dotfiles-sync and the playbook (a new step goes there, in this repo only). It prints a line per change and nothing when all is up to date:

• builds the Go tools whose sources changed:
  • ~/git_hooks/go/commit-msg and ~/git_hooks/go/sops-guard: global git hooks (commits stop until sops-guard is built)
  • ~/.config/kube-guard: the Kubernetes guard (until it is built, every kubectl / helm command asks)
  • ~/.config/dotfiles/local-files: local-backup / local-restore
  • ~/.config/sketchybar/plugins/check: the bar's connectivity checks
  • ~/.claude/hooks/deny-sensitive-reads: Claude Code's hook (its Bash and Read are blocked until it is built)
• downloads the SketchyBar icon map for the installed font
• installs the Hue VS Code extension and the missing ones of .config/vscode/extensions.txt
• links VS Code's settings.json / keybindings.json into the clone (a setting changed in VS Code shows in git status) and lazygit's macOS config file
• copies the LaunchAgents (.config/dotfiles/launchd) to ~/Library/LaunchAgents; they run from the next login
• applies Rex's Settings (.config/rex/settings.json)
• removes the files the repo no longer installs (.config/dotfiles/obsolete: rsync never deletes)

Per-machine files

Never committed, kept on each machine:

File
~/.zshrc.local	machine-specific shell config: work tools, aliases, BW_USER, DOTFILES_DIR
~/.gitconfig-work	the work identity (the repo holds a placeholder)
~/.config/git/commit-msg.yaml	optional: per-repo default of the commit-msg hook
~/.config/kube-guard/prod-regex	optional: what production is on this machine (see Kubernetes)
~/.config/tmux/sessions.local	repos preloaded as tmux sessions (tmux-sessions after editing)
~/.config/sketchybar/aws_profiles, checks	the AWS profiles and connectivity checks shown in the bar
~/.config/nvim/lua/plugins_local/*.lua	nvim plugins only for this machine
~/workspaces/*.code-workspace	VS Code workspaces (ws)

Backup in Bitwarden

local-backup                 # this machine -> Bitwarden (replaces the previous copy)
local-restore                # Bitwarden -> this machine; existing files are kept
local-restore other-mac      # another machine's backup (a new Mac)
local-restore --force        # overwrite existing files

They go as one .tar.gz attached to the secure note Local files (<machine>), with ~/.kube/config, the Terraform tokens and the mcpServers of ~/.claude.json. It uses the bw wrapper's session (see Secrets).