Dotfiles 🚀

Automated, reproducible macOS development environment setup using Ansible, GNU Stow, Mise, and SOPS.

⚡️ Quick Start

One-Liner (Recommended)

/bin/bash -c "$(curl -fsSL https://git.smlit.de/samuel/dotfiles/raw/branch/main/bootstrap.sh)"

Adaptive / MDM-aware Bootstrap

For a "fresh" or MDM-managed Mac. Detects the environment and installs the tools permitted in that context — the userspace tier needs no sudo, no Homebrew, no git:

/bin/bash -c "$(curl -fsSL https://git.smlit.de/samuel/dotfiles/raw/branch/main/bootstrap-minimal.sh)"

Tier 0 — always (userspace):

• mise self-installs to ~/.local/bin and provides starship, eza, direnv, zoxide, bat, ripgrep, fzf, fd, atuin, zellij, jq as static binaries via the aqua backend (checksum-verified; lockfile
  • paranoid + cosign/slsa are enabled before install).
• oh-my-zsh + plugins, JetBrainsMono Nerd Font (~/Library/Fonts), and the same .zshrc/.zprofile as the full setup — guarded with command -v so they degrade gracefully when a tool is missing.
• git is optional: repo, oh-my-zsh and plugins are fetched via tarball when git is absent (no Xcode Command Line Tools needed).

GUI layer — environment-dependent (detects Jamf/MDM, brew/Workbrew, admin):

• unmanaged + brew → installs casks (Raycast, Ghostty, kitty).
• Jamf-managed + Workbrew → installs only casks on the MDM allow-list (edit MDM_ALLOWED in the script); everything else (Self-Service-only apps, or casks Workbrew refuses) is collected into a manual to-do report.
• locked (no brew) → GUI apps reported for manual install.

The tool manifest and MDM allow-list live in a clearly-marked block at the top of bootstrap-minimal.sh. Run ./bootstrap.sh (Ansible) for the full unmanaged environment incl. SOPS secrets and language runtimes.

Manual Setup

1. Clone the repository:

git clone https://git.smlit.de/samuel/dotfiles.git ~/development/dotfiles
cd ~/development/dotfiles

2. Ensure Age Key exists: Place your Age secret key at ~/.config/sops/age/keys.txt. This is required to decrypt secrets (Git identities, etc.).

3. Run Bootstrap:

./bootstrap.sh

• Installs Homebrew & Ansible (if missing).
• Installs Core Tools & Apps.
• Symlinks Dotfiles.
• Decrypts Secrets.

✋ Manual Steps

Due to macOS security restrictions (TCC/SIP), some things cannot be automated:

1. Full Disk Access: Grant "Full Disk Access" to your terminal (Ghostty/Kitty/WezTerm) in System Settings -> Privacy & Security.
2. WireGuard: Open the WireGuard app and import tunnels from ~/development/dotfiles/files/wireguard/.
3. Safari Extensions: Enable 1Password and AdGuard extensions in Safari Settings.

🏗 Architecture

• Orchestration: Ansible (Local Playbook).
• Package Management:
  • Homebrew: GUI Apps (Casks) & CLI Utilities (git, starship, atuin).
  • Mise: Runtimes (node, python, go) & Infra Tools (sops, age, direnv). pinned versions.
• Dotfile Management: GNU Stow.
  • Symlinks configurations from files/ to ~/.config/ or ~/.
• Secrets: SOPS + Age.
  • Encrypted files live in secrets/.
  • Decrypted on bootstrap to files/ (gitignored).

🛠 Features

Shell & Terminal

• Terminals: Configurations for Ghostty, Kitty, and WezTerm.
• Shell: Zsh with starship prompt, atuin history, zoxide navigation, and eza ls-replacement.

Git Setup

• Identity Management: Context-aware configs via [includeIf].
• Signing: SSH Signing configured via 1Password.
• Aliases: Pre-configured shortcuts (git s, git co, git lg).

🔐 Secrets Workflow

To update a secret:

1. Edit the plaintext file locally (e.g. files/git/.config/git/identity-work).
2. Run the update script to re-encrypt into secrets/:

   ./update_secrets.sh
   

3. Commit the changes in secrets/.

📂 Repository Structure

├── bootstrap.sh        # Entry point
├── playbook.yml        # Main Ansible Playbook
├── inventory           # Localhost definition
├── roles/
│   ├── core/           # Brew, Mise, MAS
│   ├── dotfiles/       # Stow, Secrets, Backups
│   └── term/           # (Deprecated/Merged)
├── files/              # Plaintext Configs (Stow Source)
└── secrets/            # Encrypted Secrets (SOPS Source)