KEVINNITRO DOTFILES

---

ToC

• 😎 Showcase
  • Terminal
  • Neovim
• 🧩 How it is organised
• ⚙️ Installation
  • 0. Prerequisites per platform
  • 1. SSH key
  • 2. age key
  • 3. GitHub API rate limits
  • 4. Slow network
  • 5. Install chezmoi and apply
  • 6. Commit signing
• Manually add/sync encrypted file to template
  • Then list it in .chezmoiignore.tmpl
• 📝 Other notes
• 💁 References
  • Wallpaper
  • Other dotfiles

---

😎 Showcase

Terminal

Linux	Windows

Neovim

Note

Neovim config https://github.com/uitdots/nvim

---

🧩 How it is organised

chezmoi init asks a few questions; the answers decide what gets installed and which files exist:

value	meaning
profile	the ONE identity this machine is — personal or a company id
osFamily	arch / ubuntu / fedora / windows / darwin — picks installer
isWsl	auto-detected
isGui	auto-detected; false on WSL, containers, headless
isLaptop	auto-detected; adds power management

Identities live in home/.chezmoidata/profiles.yml, one block per profile — see docs/new-company.md.

Packages live in home/.chezmoidata/pkgs/, split common / personal / work / laptop, each with cli (always) and gui (desktop only). Full repo map: AGENTS.md.

---

⚙️ Installation

0. Prerequisites per platform

Windows

[!IMPORTANT] Needs administrator privileges. Run from an elevated PowerShell and expect UAC prompts: run_once_before_0_config-windows.ps1.tmpl toggles Windows optional features (WSL, Virtual Machine Platform, .NET), and the Scoop/Choco bootstrap plus the ssh-agent service need it too. User PATH entries do not.

WSL

Install WSL from the Microsoft Store, then:

wsl --install -d Ubuntu
wsl --set-default Ubuntu

Inside the guest, follow the Linux instructions. isWsl is auto-detected and skips what makes no sense in a guest: terminal emulators, fonts, fcitx5, Hyprland/HyDE/sddm/systemd desktop units, kanata, and the personal leisure dotfiles (browser data, OBS, rclone, ncspot, …).

~/.wslconfig configures the VM, so it is applied on the Windows host, not in the guest.

Linux

Arch-based (Arch, CachyOS, EndeavourOS), Ubuntu-based (Mint, Pop!_OS) and Fedora-based are supported; the installer is picked from osFamily. On Ubuntu, ppa:neovim-ppa/stable is added so neovim is current. Anything apt lacks comes from mise.

1. SSH key

One key per identity. Full guide: docs/ssh.md.

• Linux / WSL / macOS

  eval "$(ssh-agent -s)"
  chmod 700 ~/.ssh/
  chmod 644 ~/.ssh/id_ed25519.pub
  chmod 600 ~/.ssh/id_ed25519
  ssh-add ~/.ssh/id_ed25519

• Windows (elevated PowerShell)

  Set-Service ssh-agent -StartupType Automatic
  Start-Service ssh-agent
  ssh-add "$env:USERPROFILE/.ssh/id_ed25519"

2. age key

Encrypted files use age. One identity file per profile under ~/.config/age/, never committed:

profile	identity file
personal	~/.config/age/key.txt
<company>	~/.config/age/<company>-key.txt

Restore from Bitwarden, or generate:

mkdir -p ~/.config/age
age-keygen -o ~/.config/age/key.txt
chmod 600 ~/.config/age/key.txt

Every file is encrypted to all known recipients, so whichever profile's key you hold opens everything this machine ships. chezmoi init only lists identity files that exist, so adding a key later means re-running it.

With no identity at all, every encrypted target is skipped by design — chezmoi apply still succeeds, it just leaves those files out. That is what the "SECRETS THAT NEED AN AGE IDENTITY" block in home/.chezmoiignore.tmpl is for, and why it has to list every encrypted file (see below).

Note

This repo is personal and contains encrypted files you cannot decrypt. Apply with --exclude=encrypted.

3. GitHub API rate limits

chezmoi externals and mise both hammer the GitHub API

export GITHUB_TOKEN='ghp_...'

Only matters for the first bootstrap — afterwards the token lives in the encrypted ~/.config/zsh/private/personal.zsh.

Tip

gh auth login && export GITHUB_TOKEN=$(gh auth token) works too.

4. Slow network

export MISE_JOBS=2
export MISE_HTTP_TIMEOUT=10m
export MISE_FETCH_REMOTE_VERSIONS_TIMEOUT=10m

5. Install chezmoi and apply

(docs)

• shell

  sh -c "$(curl -fsLS get.chezmoi.io)" -- init --apply --ssh --depth 1 --purge-binary KevinNitroG

• pwsh (elevated — see the Windows note above)

  iex "&{$(irm 'https://get.chezmoi.io/ps1')} -- init --apply --ssh --depth 1 --purge-binary KevinNitroG"

Pick profile from the list — one identity per machine, personal or a company. A company machine gets no personal key, no personal secrets and no personal git identity; it authenticates to GitHub with the company key. To script it:

chezmoi init --promptDefaults --promptChoice profile=[company]

6. Commit signing

Per profile in profiles.yml: personal signs with GPG, companies with their SSH key. The machine has one identity, so every repo on it signs the same way.

SSH signing needs only the key; ~/.ssh/allowed_signers is generated. Verify with git log --show-signature -1.

GPG keys are imported by hand — nothing here installs or trusts a private key. Steps, including Windows: docs/gpg.md.

Manually add/sync encrypted file to template

chezmoi re-add re-encrypts managed files, but not home/.chezmoitemplates/. Use the helper for those:

chezmoi-encrypt-template.sh ~/.config/Code/User/settings.json VSCode/encrypted_settings.json
chezmoi-encrypt-template.sh ~/.config/rclone/rclone.conf rclone/encrypted_rclone.conf

It reads chezmoi's own recipients, so every file stays readable by every profile. The raw equivalent:

age -a $(chezmoi data --format json | jq -r '.chezmoi.config.age.recipients | map("-r " + .) | join(" ")') \
  file >"$(chezmoi source-path)/.chezmoitemplates/file"

Note

$(chezmoi source-path) already points inside home/ because of .chezmoiroot — do not add another home/ to the path.

Then list it in .chezmoiignore.tmpl

Every encrypted file needs its target path in the "SECRETS THAT NEED AN AGE IDENTITY" block of home/.chezmoiignore.tmpl. Adding an encrypted_ / .age source is a two-file change.

chezmoi decrypts while rendering the target state, so one file that no available key can open does not fail alone — it aborts the entire chezmoi apply. Without the entry, a machine that has not got its age key yet cannot apply anything at all.

Audit that the list is complete:

find home -name '*encrypted_*' -o -name '*.age'

---

📝 Other notes

• New company onboarding
• SSH keys & commit signing
• Repo architecture (for humans and agents)
• Windows
• Linux
• Browser
• Terminal
• Zathura

---

💁 References

Wallpaper

• https://github.com/D3Ext/aesthetic-wallpapers
• https://github.com/DenverCoder1/minimalistic-wallpaper-collection
• https://github.com/Gingeh/wallpapers

Other dotfiles

Click to expand

• For use
  • https://github.com/HyDE-Project/HyDE
  • https://github.com/JaKooLit/Hyprland-Dots
  • https://github.com/end-4/dots-hyprland
  • https://github.com/gh0stzk/dotfiles (BSPWM)
  • https://github.com/koeqaife/hyprland-material-you
  • https://github.com/prasanthrangan/hyprdots
  • https://gitlab.com/stephan-raabe/dotfiles
• Chezmoi
  • https://github.com/megabyte-labs/install.doctor
  • https://github.com/lildude/dotfiles/ (Have config for codespace)
• Others
  • https://github.com/2KAbhishek/dots2k
  • https://github.com/2nthony/dotfiles (Lazygit?)
  • https://github.com/Alexis12119/dotfiles
  • https://github.com/Cybersnake223/Hypr
  • https://github.com/Integralist/dotfiles
  • https://github.com/JoosepAlviste/dotfiles
  • https://github.com/amitds1997/dotfiles (setup for arch and mac, git stuff, something is new to me)
  • https://github.com/asilvadesigns/config
  • https://github.com/bahamas10/dotfiles (YSAP)
  • https://github.com/chaneyzorn/dotfiles
  • https://github.com/craftzdog/dotfiles-public
  • https://github.com/dlvhdr/dotfiles
  • https://github.com/dreamsofautonomy/zensh
  • https://github.com/linkarzu/dotfiles-latest
  • https://github.com/mischavandenburg/dotfiles
  • https://github.com/nguyenvukhang/docker-dev
  • https://github.com/nguyenvukhang/dots (git config!)
  • https://github.com/omerxx/dotfiles (have good tmux plugins)
  • https://github.com/p3nguin-kun/dotfiles
  • https://github.com/petobens/dotfiles (X config, tmux for linux & mac)
  • https://github.com/rusty-electron/dotfiles
  • https://github.com/siduck/dotfiles
  • https://github.com/stevearc/dotfiles
  • https://github.com/wincent/wincent (Old dotfiles 😱)
• Nix
  • https://git.aquaticservers.com/aqua/AquaticOS (Hyprland)
  • https://codeberg.org/HirschBerge/hyprlua (Temp lua hyprland)