#+title: dotfiles management #+PROPERTY: header-args :mkdirp yes #+auto_tangle: t * git #+begin_src conf :tangle ~/.gitconfig [user] name = cashmere email = cashmere@autistici.org useConfigOnly = true signingkey = B877C0AC3B080FBB! [init] defaultBranch = master [commit] gpgsign = true [gpg] format = openpgp program = gpg [pull] rebase = true [push] autoSetupRemote = true default = current [fetch] prune = true pruneTags = true [diff] algorithm = histogram [merge] conflictstyle = zdiff3 [alias] dft = -c diff.external=difft diff dlog = -c diff.external=difft log -p --ext-diff dshow = -c diff.external=difft show --ext-diff [rebase] autosquash = true autostash = true [core] autocrlf = input [remote "origin"] gcrypt-participants = B877C0AC3B080FBB gcrypt-signingkey = B877C0AC3B080FBB [wt] basedir = .git/wt copyignored = true copymodified = true #+end_src * .env #+begin_src sh :tangle ~/.env # Common environment for login shells and X session EDITOR=vi PAGER=less export EDITOR PAGER PASSWORD_STORE_DIR=$HOME/pass export PASSWORD_STORE_DIR DISTDIR=$HOME/ports/distfiles WRKDIRPREFIX=$HOME/ports/work PORTSDIR=/usr/local/poudriere/ports/base export DISTDIR WRKDIRPREFIX PORTSDIR # Launch gpg-agent and expose its SSH socket gpgconf --launch gpg-agent export SSH_AUTH_SOCK=$(gpgconf --list-dirs agent-ssh-socket) #+end_src * .profile #+begin_src sh :tangle ~/.profile # # .profile - POSIX Shell startup script for login shells # # see also sh(1), environ(7). # # set ENV to a file invoked each time sh is started for interactive use. ENV=$HOME/.shrc; export ENV # Let sh(1) know it's at home, despite /home being a symlink. if [ "$PWD" != "$HOME" ] && [ "$PWD" -ef "$HOME" ] ; then cd ; fi # Query terminal size; useful for serial lines. if [ -x /usr/bin/resizewin ] ; then /usr/bin/resizewin -z ; fi # Display a random cookie on each login. if [ -x /usr/bin/fortune ] ; then /usr/bin/fortune freebsd-tips ; fi # Shared environment (GPG, editor, password-store) . "$HOME/.env" # Start xonsh for interactive login shells on a tty if [ -n "$PS1" ] && [ -x /usr/local/bin/xonsh ]; then exec /usr/local/bin/xonsh fi #+end_src * .xinitrc #+begin_src sh :tangle ~/.xinitrc . "$HOME/.env" export GPG_TTY=$(tty) exec i3 #+end_src * .xonshrc #+begin_src python :tangle ~/.xonshrc import subprocess, shutil $PATH.insert(0, $HOME + '/.cargo/bin') $PATH.insert(0, $HOME + '/.local/bin') $GPG_TTY = $(tty).strip() if shutil.which("gpg-agent"): subprocess.run(["gpgconf", "--launch", "gpg-agent"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL) $SSH_AUTH_SOCK = $(gpgconf --list-dirs agent-ssh-socket).strip() subprocess.run(["gpg-connect-agent", "updatestartuptty", "/bye"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL) if shutil.which("atuin"): running = subprocess.run(["pgrep", "-x", "atuin"], capture_output=True).returncode == 0 if not running: subprocess.Popen(["atuin", "daemon", "start"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, start_new_session=True) def _jail_connect(args): if args: name = args[0] else: print("running jails:") jls name = input("jail: ").strip() if not name: return doas jexec -U cashmere @(name) env HOME=/home/cashmere USER=cashmere LOGNAME=cashmere xonsh -l aliases['jail'] = _jail_connect execx($(atuin init xonsh)) execx($(zoxide init xonsh), 'exec', __xonsh__.ctx, filename='zoxide') #+end_src * atuin #+begin_src toml :tangle ~/.config/atuin/config.toml auto_sync = true sync_address = "https://atuin.cashmere.rs" sync_frequency = "1m" [daemon] enabled = false systemd_socket = false [dotfiles] enabled = true #+end_src * ssh ** =authorized_keys= #+begin_src conf :tangle ~/.ssh/authorized_keys ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILOwBidfdZzcSEIPSRT0C8U9U55WSES1ugqAKE+nvgQ9 (none) #+end_src * gpg setup ** gpg-agent.conf #+begin_src conf :tangle ~/.gnupg/gpg-agent.conf enable-ssh-support default-cache-ttl 600 max-cache-ttl 7200 pinentry-program /usr/local/bin/pinentry-emacs #+end_src ** sshcontrol :crypt: -----BEGIN PGP MESSAGE----- hQIMA0fZrn09GBJoAQ/8CNgrMmtje3ID2JbpQ3s3hwm32kQYQaApv9oVlYxs3v0B e9p2lXV8VtihnnaSOwnZl3QRUZFPYuV6qTvhyY8XMtlpyRfBOjnAaR8JdnuGyQXf Xsy+gaMARQlU2kR76s9wmjrVxuJIdUFPP8yVz1rxB7RvNsaLU3D0M/ZopcovbBhJ DIQJkQ1H1QQM7OBnGmvBVrL21zaSwKuVkb6Or0CZLF8QoO25OYfRlM5w2r2y2rRj dX0E6NhDd+n0/06ly4oo01wO3MnQiqdTs1ov+JtZf5s7S5ahhPC5BJOAlVxtll9b RRR8n/pWueLNdbK/SAUnbPSUsKJiOFRAv5mQa+SGby28kMNIyDR9chIL+0+dFfvc OxKgL6c21yAiMzXKmunTnYG2aqLF9UpPa0pSXHR80kr0vfX7pmz99uMAUjHSduM0 akZajlLuoOzQI60mh6urSbPxghtVfTLJi25hgxFj1XiZ6A24GvhmcMeRkxlG0yWE 7biF+oZeWN1IFb4hWOx0fyiYZ6j3kbqPicts4Ytd3aTPP14LTbcq6pqg0UQ1BLXm 9x1oiSeCySdDM68JGvA6KwYzyh70DTDRXD8lTfxooeDdTMmw6ghaoF81spFO3Vi6 jVAgE1ecSgCUO6K7YwFFRhJujOBGrCbl+bEl+AOnlu4itSuwohEIGuWWNscRsn6F AQwDHE1EcNNBM3MBB/9pKBWGDZkkE9EDmmzWgDLlUYZLxZECr5PJC9vamoiYqJwb dRBqh4G4RM60Qtz9AeEZ9CpaMnUiXtpzXpMPz574PLXZYm2IDSpANUv+Fp+ge9LL SBB9+02sA9aIR+xTV63sLHxAxN8GSKZT4kPl1aKBRUHEsh8oi77SQBqqwUIvmwYI IOaMA5k9EpW5aEakWqEgo9gFj9k+TA8biUl7EW2qmex8jvZjCSUr8dHQfCDwWHPh k49zvAu9EUjOM8s+00elJ+p0rW2Ab8PmRVLQPxsGxOkK5NQp2V7heSLz1b494n1m OBL+dHDxn2lwPnuVbigohOEyGTc+qiQQM6oLovaFhF4DvHPnD0odxDQSAQdA+vH4 fhdVx37ZqHdp2BsN1S/QeQgr7AWS5SBUAxf3pEow3OScsbIInSkLJ9bFZ8nQJOBI Bv3HO/doPyga8IFpGwsDKhG5InzMvG+md11F5K6j0psBklLzDd8KbYOIPYjbBvSS Plc0i5QPFpy/FnI0/2zSJYu08WbPitbHem57Tk6a3V1xkXVavziV8kc5eygdTfxt jBbQe5Lt9tDbPd8Fe7yNIhGJ8OFdKzzliqCCSzzga8AKzJ6AyixHsl3scpU9n8Jb Br3gms1smZVfUdn9NwAmOOZgcgGGvPQz+kruWcOKOoBKOFSQWrqx1bqEuw== =XEf0 -----END PGP MESSAGE----- * Tasks ** Services *** CANCELLED [#C] Unlock disk encryption over SSH CLOSED: [2026-07-17 Fri 21:57] :LOGBOOK: - State "CANCELLED" from "DONE" [2026-07-17 Fri 21:57] \\ not needed - State "DONE" from "TODO" [2026-07-17 Fri 21:57] :END: *** CANCELLED Navidrome CLOSED: [2026-07-17 Fri 21:57] :LOGBOOK: - State "CANCELLED" from "TODO" [2026-07-17 Fri 21:57] \\ someday maybe :END: *** DONE yggdrasil CLOSED: [2026-07-12 Sun 17:08] :LOGBOOK: - State "DONE" from "NEXT" [2026-07-12 Sun 17:08] :END: ** Ports *** DONE [#A] poudriere CLOSED: [2026-07-12 Sun 17:07] :LOGBOOK: - State "DONE" from [2026-07-12 Sun 17:07] :END: *** poudriere.conf Source of truth for =/usr/local/etc/poudriere.conf=. Tangles through tramp's doas method and asks for the login password. See the "Setup" section of WORKFLOW.org for how this file is used. #+begin_src conf # /usr/local/etc/poudriere.conf PACKAGE_FETCH_BRANCH=quarterly PACKAGE_FETCH_URL=pkg+https://pkg.FreeBSD.org/FreeBSD:15:amd64 # Use the existing ZFS pool ZPOOL=zroot # Poudriere root filesystem on ZFS ZROOTFS=/poudriere # FreeBSD mirror for jail creation FREEBSD_HOST=https://download.FreeBSD.org # Copy host resolv.conf into the jail for network access RESOLV_CONF=/etc/resolv.conf # Where poudriere keeps jails and ports trees BASEFS=/usr/local/poudriere # Share distfiles with the custom ports tree to avoid re-fetching DISTFILES_CACHE=/home/cashmere/ports/distfiles # Speed up builds with tmpfs USE_TMPFS=yes # Optional: ccache to speed up repeated Rust/C builds # Install devel/ccache first, then uncomment: # CCACHE_DIR=/var/cache/ccache # Sanity checks USE_PORTLINT=no #+end_src * nix package manager #+begin_src conf :tangle ~/.config/nix/nix.conf experimental-features = nix-command flakes #+end_src