dotfiles

Personal dotfiles for macOS and Illidari homelab Linux servers, managed with chezmoi.

What's included

Area	Files
Shell	zsh + antidote plugins, modular ~/.config/zsh/
Prompt	starship
History	atuin with self-hosted sync
Editor	neovim (lazy.nvim)
Terminal	ghostty (macOS only)
Keyboard	karabiner (macOS only)
Multiplexer	tmux
Git	.gitconfig with delta, global ignore

Quick start — macOS

# Install Homebrew packages
brew bundle --file=Brewfile

# Bootstrap chezmoi from this repo
chezmoi init --apply git@vcs.internal.illidari.eu:denise/dotfiles.git
# or from a local clone:
chezmoi init --apply file://$PWD

# Copy secrets template
cp ~/.config/zsh/secrets.local.zsh.example ~/.config/zsh/secrets.local.zsh
# Edit secrets.local.zsh — never commit it

# Open a new terminal
zsh -l

Quick start — Linux server

Homelab internal TLS uses a private CA. Pick one bootstrap method:

Option A — Public Forgejo over HTTPS (easiest for curl | bash)

Make denise/dotfiles public on Forgejo, then on the server:

curl -fsSL https://vcs.ablationsystems.com/denise/dotfiles/raw/branch/main/scripts/bootstrap-server.sh | bash

This uses SSH for chezmoi init by default; override with a public HTTPS repo URL:

curl -fsSL https://vcs.ablationsystems.com/denise/dotfiles/raw/branch/main/scripts/bootstrap-server.sh | \
  bash -s -- https://vcs.ablationsystems.com/denise/dotfiles.git

Option B — SSH clone (no TLS trust needed)

Requires your SSH key on Forgejo (vcs.ablationsystems.com:222):

git clone ssh://git@vcs.ablationsystems.com:222/denise/dotfiles.git /tmp/dotfiles
/tmp/dotfiles/scripts/bootstrap-server.sh

Option C — Internal HTTPS (install CA first)

Install the Illidari internal CA on the server, then:

sudo cp illidari-ca.crt /usr/local/share/ca-certificates/illidari-ca.crt
sudo update-ca-certificates

curl -fsSL https://vcs.internal.illidari.eu/denise/dotfiles/raw/branch/main/scripts/bootstrap-server.sh | \
  bash -s -- https://vcs.internal.illidari.eu/denise/dotfiles.git

Option D — Internal HTTPS one-off (curl -k)

Only if you trust the network and want a quick bootstrap without installing the CA:

curl -fsSLk https://vcs.internal.illidari.eu/denise/dotfiles/raw/branch/main/scripts/bootstrap-server.sh | \
  DOTFILES_INSECURE=1 bash -s -- https://vcs.internal.illidari.eu/denise/dotfiles.git

DOTFILES_INSECURE=1 sets GIT_SSL_NO_VERIFY for the chezmoi init step as well.

After bootstrap, open a new login shell: zsh -l

Secrets

API keys and tokens live in ~/.config/zsh/secrets.local.zsh (gitignored). Copy from secrets.local.zsh.example.

Rotate any tokens that were previously in a tracked or shared file.

For server infra secrets, use /etc/illidari/*.env (see illidari-deploy).

Atuin self-hosted sync

1. On homelab: sudo ./scripts/install-atuin-server.sh
2. Add DNS atuin.internal.illidari.eu → nginx TLS proxy
3. Register: atuin register -u denise -e denise@ablationsystems.com
4. Add ATUIN_KEY to secrets.local.zsh
5. atuin sync

Day-2 workflow

Task	Command
Edit a dotfile	chezmoi edit ~/.zshrc
Apply local changes	chezmoi apply
Pull upstream	chezmoi update
Add a new machine	chezmoi init --apply <repo-url>
See diff before apply	chezmoi diff

Per-host customization

• OS conditionals use is_mac / is_linux in .chezmoi.toml.tmpl
• Optional per-host zsh overrides: ~/.config/zsh/local.$HOST.zsh (not tracked)
• Chezmoi hostname data: add home/dendns/.chezmoi.toml.tmpl or use data/ directory

Forgejo setup

Create repo denise/dotfiles on vcs.internal.illidari.eu, then:

git remote add forgejo git@vcs.internal.illidari.eu:denise/dotfiles.git
git push -u forgejo main

Zsh plugin list

Managed in dot_config/zsh/zsh_plugins.txt:

• zsh-autosuggestions
• zsh-completions
• fzf-tab
• zsh-history-substring-search
• zsh-syntax-highlighting

Antidote clones plugins on first chezmoi apply via run_onchange_install-antidote.sh.