From 22af30aa1b11340f2cd27226776eb4d7d3f3de48 Mon Sep 17 00:00:00 2001 From: Daniel Bauer Date: Sun, 9 Aug 2026 13:24:09 +0200 Subject: [PATCH] feat: add machineClass and ssh config --- .chezmoi.toml.tmpl | 7 +++++++ .chezmoiignore | 6 ++++++ CLAUDE.md | 3 ++- key.txt.age | 10 ++++++++++ private_dot_ssh/config.d/encrypted_home.age | 14 ++++++++++++++ private_dot_ssh/config.d/encrypted_web.age | 10 ++++++++++ private_dot_ssh/private_executable_config | 5 +++++ ...=> run_onchange_before_01_install-packages.sh | 2 +- run_onchange_before_02_decrypt_age_key.sh.tmpl | 16 ++++++++++++++++ ...ore_1_zsh.sh => run_onchange_before_11_zsh.sh | 0 10 files changed, 71 insertions(+), 2 deletions(-) create mode 100644 key.txt.age create mode 100644 private_dot_ssh/config.d/encrypted_home.age create mode 100644 private_dot_ssh/config.d/encrypted_web.age create mode 100644 private_dot_ssh/private_executable_config rename run_onchange_before_0_install-packages.sh => run_onchange_before_01_install-packages.sh (96%) create mode 100644 run_onchange_before_02_decrypt_age_key.sh.tmpl rename run_onchange_before_1_zsh.sh => run_onchange_before_11_zsh.sh (100%) diff --git a/.chezmoi.toml.tmpl b/.chezmoi.toml.tmpl index d4d3664..3d8798f 100644 --- a/.chezmoi.toml.tmpl +++ b/.chezmoi.toml.tmpl @@ -1,7 +1,14 @@ {{- $github_email := promptStringOnce . "github_email" "Github Email address" -}} +{{- $machineClass := promptChoiceOnce . "machineClass" "Machine class (private/server/public)" (list "private" "server" "public") -}} + +encryption = "age" +[age] + identity = "~/.config/chezmoi/key.txt" + recipient = "age1q8r0dfsjadzq8fy6453acvurhzt7ndptyur0xrkwfh76tx7fwyks3lxp42" [data] github_email = {{ $github_email | quote }} + machineClass = {{ $machineClass | quote }} [git] autoPush = true autoCommit = true diff --git a/.chezmoiignore b/.chezmoiignore index f3262ba..9350180 100644 --- a/.chezmoiignore +++ b/.chezmoiignore @@ -4,3 +4,9 @@ README.md .agents CLAUDE.md CLAUDE.local.md +key.txt.age + +{{- if ne .machineClass "private" }} +.ssh/config.d/home +.ssh/config.d/web +{{- end }} diff --git a/CLAUDE.md b/CLAUDE.md index a7e8068..63d9557 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -40,4 +40,5 @@ There is no build, lint, or test suite — this is a config repo. "Testing" a ch - **`dot_gitconfig.tmpl`** — templated on `.github_email`; wires up diff-so-fancy/difftastic as pagers and nbdime for Jupyter notebook diffing. `~/.gitconfig.local` (untracked) is included for machine-specific overrides. - **`private_dot_config/`** → installs to `~/.config/` with restrictive permissions (nvim, matplotlib styles, fontconfig). - **`bin/`** → installs to `~/bin/`; `executable_term-background` detects terminal light/dark background via OSC 11 for theme-matching in nvim etc. -- **`.chezmoiignore`** lists source-repo-only paths (`README.md`, `.claude`, `.codex`, `.agents`) that chezmoi should never install to `$HOME`. +- **`.chezmoiignore`** lists source-repo-only paths (`README.md`, `.claude`, `.codex`, `.agents`) that chezmoi should never install to `$HOME`, plus a `machineClass`-gated conditional excluding `.ssh/config.d/home` and `.ssh/config.d/web` on any machine that isn't `machineClass = "private"`. +- **Age encryption**: `key.txt.age` (repo root) is an age private key encrypted with a passphrase.`run_onchange_before_02_decrypt-age-key.sh.tmpl` decrypts it into `~/.config/chezmoi/key.txt`. diff --git a/key.txt.age b/key.txt.age new file mode 100644 index 0000000..d858083 --- /dev/null +++ b/key.txt.age @@ -0,0 +1,10 @@ +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNjcnlwdCBQZUNHSE1VaUUrcHNrZS9n +aEd3QTNRIDE4CmUxQkVTanJ1aUpEMFY5ZmVzWlA4dDRjUXB5MlRva01NRU94YTY1 +a2trVEEKLS0tIHI0RFJqVkNOVVVVV1ZkbEtIRGprMkNnRzFsaHJlQWI4clZGUE1p +V0hPUUEKyI/d5w+oADNHOhN5/JRBvlAhIdnja8VTnQwNGkowq7Pw4VhajpRGjkAO +3aEyc3WLaJIq16IyKGW6OmLP37mR7ZixL2xOm9i7jqbze8v4UxJWbtNA5pVvgMAA +fa1nneE/NSGdnBExNeSXp3mxnFEUgYVLMCEOMLe/be98xqSLXXxJ05o53RVqX7YF +uvUQrvcHDVE0fujTuwofKnXpKqk5BVvgciiaSb9yKR6mLrNkj8Hq1828WNq6Diec +qc/4CDSRMa8nVxYLKtVSLvKriD4nDGhSN5zPGYO5AqgOkIg= +-----END AGE ENCRYPTED FILE----- diff --git a/private_dot_ssh/config.d/encrypted_home.age b/private_dot_ssh/config.d/encrypted_home.age new file mode 100644 index 0000000..f6c8ff8 --- /dev/null +++ b/private_dot_ssh/config.d/encrypted_home.age @@ -0,0 +1,14 @@ +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTN1ppYjdMNHpZMWw1Qkll +MjBYSWtVRSttYWQ1czRJTU1hTHAyS0R1TjBjCnQ4WlMrdXljeHdiZ0g2VHFIeXhS +YWw3OHVJWk5JcGppZk1kekROWjdjbE0KLS0tIEltU0pqKzRFeWdVOUVnWHdDTnZW +cHIyY25wZ1EvL1Z1aVJYbFVlSHcrdnMKf9IUp+5PkkSnmmslWchqss3UJbLTkYOh +ACl/3NtI5ROgMyMqRucoVCeagTKVfkURWjMcUmCDQBMrwKMF96f7Xvm3xR0/cDbU +BBnvDC01ZhSXpjK5BzHloxhWSeGJPHMovj1kGsGNDk8mXoH1D0qnSU1StSoCQKvD +b8JREL3MtUr7YuGLmwOZCjilrAfL1y5YLV7NkDiuBJN1Mm+3pTtOUQt1qQcB4Chr +Pi/8HSqUtULrL5Kxa9XP1yYfdvRkLXEcOD9aNHp9VxH/emI7hKYjzYGdeGl6On6x +tBInuCFsORlhVVi9m7k66PEabv0Aw+7+CC0ezfPprRMZJEp8m6k8o+dimF+4JvnE +AedI6GwOBHnfrfjPp9p5MuNnXyFMav0/uf+xElb9Cw1RFPnP50FzbX9dHLtqgKf7 +asCEAlGfxg2ix9dnJz42f2dHI4ZPacfLpRAGKSCyBqQskmU3uNtKSOy7uwBkU6C+ +uFIkPyKgDlSlGap4KGTqLQzE9fSmuv98JQiN0Z4nss/e51t1DKXLULPy +-----END AGE ENCRYPTED FILE----- diff --git a/private_dot_ssh/config.d/encrypted_web.age b/private_dot_ssh/config.d/encrypted_web.age new file mode 100644 index 0000000..91615b2 --- /dev/null +++ b/private_dot_ssh/config.d/encrypted_web.age @@ -0,0 +1,10 @@ +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpL1FleXg3WDR3K3pkcEpB +QVdwQU1UV3h5Uitaamw3OTBaUXUreHFPbFJjCndZOUJ2ZlRyc0RGWFlXUGMzYkpY +VWtKMDhQVTJlQ2cxK1kwU0VITGowcGsKLS0tIDY0ZFFNZ3JMdElVcmNkeElZYVJE +bWE1bU92UEFGYmkzSmRZTmZQcEs3S0EKe2vkmr30RGDw33AvL3FlxojmUzx8eslB +GQgU0lVxAm73B5kAexV2bSCLMhXLhPGZrnID7ZiV7ZHJMKjHnoSM0vjOwL1EylAn +3YBytrGmKd1FWgdzY8F/yF+dSIBZ6+cxttPW4lW9IBGiZL4fFX1fxt2DNR3MSzj/ +OWwJ5yW1MkVYJOwfB9MflylsW4KDxkcVuBiUpGwuJ9HlkN2QKIso56YQWm5UH0L5 +fl7gKQMkgmPnBzQG1uv9RdllTOAQcw== +-----END AGE ENCRYPTED FILE----- diff --git a/private_dot_ssh/private_executable_config b/private_dot_ssh/private_executable_config new file mode 100644 index 0000000..f0ecc6b --- /dev/null +++ b/private_dot_ssh/private_executable_config @@ -0,0 +1,5 @@ +Include config.d/* + +Host *: + PermitLocalCommand yes + diff --git a/run_onchange_before_0_install-packages.sh b/run_onchange_before_01_install-packages.sh similarity index 96% rename from run_onchange_before_0_install-packages.sh rename to run_onchange_before_01_install-packages.sh index d3a1fb5..707ca4e 100644 --- a/run_onchange_before_0_install-packages.sh +++ b/run_onchange_before_01_install-packages.sh @@ -6,7 +6,7 @@ echo "Installing packages" echo "Updating sources..." sudo apt update -qq -for package in zsh xsel unzip git git-extras neovim git ripgrep pipx; do +for package in zsh xsel unzip git git-extras neovim git ripgrep pipx age; do if dpkg -s "$package" >/dev/null 2>&1; then echo $package is already installed. else diff --git a/run_onchange_before_02_decrypt_age_key.sh.tmpl b/run_onchange_before_02_decrypt_age_key.sh.tmpl new file mode 100644 index 0000000..26f4ec2 --- /dev/null +++ b/run_onchange_before_02_decrypt_age_key.sh.tmpl @@ -0,0 +1,16 @@ +#!/usr/bin/env bash + +set -euo pipefail + +{{- if ne .machineClass "private" }} +exit 0 +{{- end }} + +echo "Decrypting age key ..." +if [ ! -f "$HOME/.config/chezmoi/key.txt" ]; then + mkdir -p "$HOME/.config/chezmoi" + chezmoi age decrypt --output "$HOME/.config/chezmoi/key.txt" --passphrase "{{ .chezmoi.sourceDir }}/key.txt.age" + chmod 600 "$HOME/.config/chezmoi/key.txt" +fi + +echo "Done decrypting age key" diff --git a/run_onchange_before_1_zsh.sh b/run_onchange_before_11_zsh.sh similarity index 100% rename from run_onchange_before_1_zsh.sh rename to run_onchange_before_11_zsh.sh