Dotfiles 🚀

Automated, reproducible macOS development environment setup using Ansible, GNU Stow, Mise, and SOPS.

⚡️ Quick Start

One-Liner (Recommended)

/bin/bash -c "$(curl -fsSL https://git.smlit.de/samuel/dotfiles/raw/branch/main/bootstrap.sh)"

Manual Setup

1. Clone the repository:

git clone https://git.smlit.de/samuel/dotfiles.git ~/development/dotfiles
cd ~/development/dotfiles

2. Ensure Age Key exists: Place your Age secret key at ~/.config/sops/age/keys.txt. This is required to decrypt secrets (Git identities, etc.).

3. Run Bootstrap:

./bootstrap.sh

• Installs Homebrew & Ansible (if missing).
• Installs Core Tools & Apps.
• Symlinks Dotfiles.
• Decrypts Secrets.

✋ Manual Steps

Due to macOS security restrictions (TCC/SIP), some things cannot be automated:

1. Full Disk Access: Grant "Full Disk Access" to your terminal (Ghostty/Kitty/WezTerm) in System Settings -> Privacy & Security.
2. WireGuard: Open the WireGuard app and import tunnels from ~/development/dotfiles/files/wireguard/.
3. Safari Extensions: Enable 1Password and AdGuard extensions in Safari Settings.

🏗 Architecture

• Orchestration: Ansible (Local Playbook).
• Package Management:
  • Homebrew: GUI Apps (Casks) & CLI Utilities (git, starship, atuin).
  • Mise: Runtimes (node, python, go) & Infra Tools (sops, age, direnv). pinned versions.
• Dotfile Management: GNU Stow.
  • Symlinks configurations from files/ to ~/.config/ or ~/.
• Secrets: SOPS + Age.
  • Encrypted files live in secrets/.
  • Decrypted on bootstrap to files/ (gitignored).

🛠 Features

Shell & Terminal

• Terminals: Configurations for Ghostty, Kitty, and WezTerm.
• Shell: Zsh with starship prompt, atuin history, zoxide navigation, and eza ls-replacement.

Git Setup

• Identity Management: Context-aware configs via [includeIf].
• Signing: SSH Signing configured via 1Password.
• Aliases: Pre-configured shortcuts (git s, git co, git lg).

🔐 Secrets Workflow

To update a secret:

1. Edit the plaintext file locally (e.g. files/git/.config/git/identity-work).
2. Run the update script to re-encrypt into secrets/:

   ./update_secrets.sh
   

3. Commit the changes in secrets/.

📂 Repository Structure

├── bootstrap.sh        # Entry point
├── playbook.yml        # Main Ansible Playbook
├── inventory           # Localhost definition
├── roles/
│   ├── core/           # Brew, Mise, MAS
│   ├── dotfiles/       # Stow, Secrets, Backups
│   └── term/           # (Deprecated/Merged)
├── files/              # Plaintext Configs (Stow Source)
└── secrets/            # Encrypted Secrets (SOPS Source)