🛠️ dotfiles

Personal dotfiles managed with a bare git repo pattern — files live directly in $HOME, no symlinks.

🚀 Bootstrap

From a URL (zero local clone required)

curl -fsSL https://raw.githubusercontent.com/diegoferigo/dotfiles/main/bootstrap | bash

This will:

1. Install pixi if not already present
2. Download .local/bin/dotfiles and run it via its pixi exec shebang
3. Clone the bare repo into ~/.dotfiles
4. Check out tracked dotfiles directly into $HOME (backing up any conflicts)
5. Install tools via pixi global (starship, bat, eza, fzf, fd, zoxide, difftastic, age)
6. Report encrypted dotfiles that can be applied separately

From a local clone

git clone https://github.com/diegoferigo/dotfiles.git
cd dotfiles
./bootstrap

⚙️ Managing dotfiles after bootstrap

The dotfiles command (checked out to ~/.local/bin/dotfiles) wraps git against the bare repo:

dotfiles git status
dotfiles git diff
dotfiles git add ~/.config/starship.toml
dotfiles git commit -m "update starship config"
dotfiles git log --oneline
dotfiles git push

🔄 Update

Pull the latest changes and re-apply dotfiles:

dotfiles --update

Public files are updated independently from encrypted files. Run dotfiles secrets status after an update and apply changes explicitly. Use dotfiles --update --with-secrets to update both in one interactive run.

🔒 Encrypted dotfiles

Encrypted sources are tracked under secrets/home/ and map directly below $HOME:

secrets/home/.ssh/config.d/rai.conf.age -> ~/.ssh/config.d/rai.conf

One shared age identity is protected by a high-entropy passphrase stored in a password manager. Its encrypted wrapper is distributed through the repository, so machines do not need separate private-key provisioning. Bootstrap and update leave secrets untouched unless explicitly requested.

dotfiles secrets init
dotfiles secrets encrypt ~/.ssh/config.d/rai.conf
dotfiles secrets status
dotfiles secrets apply
dotfiles --update --with-secrets
dotfiles secrets change-passphrase

See secrets/README.md for setup, authoring, deployment, conflict handling, recovery, and key rotation.

🗑️ Uninstall

Remove all checked-out dotfiles and restore any backed-up originals:

dotfiles --uninstall

Uninstall removes unchanged decrypted files and restores their original backups. The tracked encrypted identity follows the normal public-dotfile lifecycle. A legacy plaintext identity is never removed.

🏷️ Notes

• Compatible with GitHub Codespaces — the devcontainer can run ./bootstrap as postCreateCommand.
• Requires only pixi on the host; all Python dependencies are resolved on-the-fly via the shebang.
• DOTFILES_REPO, DOTFILES_DIR, BACKUP_DIR environment variables can override defaults.