#+title: dotfiles management
#+PROPERTY: header-args :mkdirp yes
#+auto_tangle: t

* git

#+begin_src conf :tangle ~/.gitconfig
[user]
	name = cashmere
	email = cashmere@autistici.org
	useConfigOnly = true
	signingkey = B877C0AC3B080FBB!
[init]
	defaultBranch = master
[commit]
	gpgsign = true
[gpg]
	format = openpgp
	program = gpg
[pull]
	rebase = true
[push]
	autoSetupRemote = true
	default = current
[fetch]
	prune = true
	pruneTags = true
[diff]
	algorithm = histogram
[merge]
	conflictstyle = zdiff3
[alias]
	dft = -c diff.external=difft diff
	dlog = -c diff.external=difft log -p --ext-diff
	dshow = -c diff.external=difft show --ext-diff
[rebase]
	autosquash = true
	autostash = true
[core]
	autocrlf = input
[remote "origin"]
	gcrypt-participants = B877C0AC3B080FBB
	gcrypt-signingkey = B877C0AC3B080FBB
[wt]
	basedir = .git/wt
	copyignored = true
	copymodified = true
#+end_src

* .env

#+begin_src sh :tangle ~/.env
# Common environment for login shells and X session
EDITOR=vi
PAGER=less
export EDITOR PAGER

PASSWORD_STORE_DIR=$HOME/pass
export PASSWORD_STORE_DIR

DISTDIR=$HOME/ports/distfiles
WRKDIRPREFIX=$HOME/ports/work
PORTSDIR=/usr/local/poudriere/ports/base
export DISTDIR WRKDIRPREFIX PORTSDIR

# Launch gpg-agent and expose its SSH socket
gpgconf --launch gpg-agent
export SSH_AUTH_SOCK=$(gpgconf --list-dirs agent-ssh-socket)
#+end_src

* .profile

#+begin_src sh :tangle ~/.profile
#
# .profile - POSIX Shell startup script for login shells
#
# see also sh(1), environ(7).
#

# set ENV to a file invoked each time sh is started for interactive use.
ENV=$HOME/.shrc; export ENV

# Let sh(1) know it's at home, despite /home being a symlink.
if [ "$PWD" != "$HOME" ] && [ "$PWD" -ef "$HOME" ] ; then cd ; fi

# Query terminal size; useful for serial lines.
if [ -x /usr/bin/resizewin ] ; then /usr/bin/resizewin -z ; fi

# Display a random cookie on each login.
if [ -x /usr/bin/fortune ] ; then /usr/bin/fortune freebsd-tips ; fi

# Shared environment (GPG, editor, password-store)
. "$HOME/.env"

# Start xonsh for interactive login shells on a tty
if [ -n "$PS1" ] && [ -x /usr/local/bin/xonsh ]; then
    exec /usr/local/bin/xonsh
fi
#+end_src

* .xinitrc

#+begin_src sh :tangle ~/.xinitrc
. "$HOME/.env"
export GPG_TTY=$(tty)
exec i3
#+end_src

* .xonshrc

#+begin_src python :tangle ~/.xonshrc
import subprocess, shutil

$PATH.insert(0, $HOME + '/.cargo/bin')
$PATH.insert(0, $HOME + '/.local/bin')

$GPG_TTY = $(tty).strip()

if shutil.which("gpg-agent"):
    subprocess.run(["gpgconf", "--launch", "gpg-agent"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
    $SSH_AUTH_SOCK = $(gpgconf --list-dirs agent-ssh-socket).strip()
    subprocess.run(["gpg-connect-agent", "updatestartuptty", "/bye"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)

if shutil.which("atuin"):
    running = subprocess.run(["pgrep", "-x", "atuin"], capture_output=True).returncode == 0
    if not running:
        subprocess.Popen(["atuin", "daemon", "start"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, start_new_session=True)


execx($(atuin init xonsh))
execx($(zoxide init xonsh), 'exec', __xonsh__.ctx, filename='zoxide')
#+end_src

* atuin

#+begin_src toml :tangle ~/.config/atuin/config.toml
auto_sync = true
sync_address = "https://atuin.cashmere.rs"
sync_frequency = "1m"

[daemon]
enabled = false
systemd_socket = false

[dotfiles]
enabled = true
#+end_src

* ssh

** =authorized_keys=

#+begin_src conf :tangle ~/.ssh/authorized_keys
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILOwBidfdZzcSEIPSRT0C8U9U55WSES1ugqAKE+nvgQ9 (none)
#+end_src

* gpg setup

** gpg-agent.conf

#+begin_src conf :tangle ~/.gnupg/gpg-agent.conf
enable-ssh-support
default-cache-ttl 600
max-cache-ttl 7200
pinentry-program /usr/local/bin/pinentry-emacs
#+end_src

** sshcontrol :crypt:

-----BEGIN PGP MESSAGE-----

hQIMA0fZrn09GBJoARAAmta7oMHqtV+SvJj/7Q+EfG+QJkzNiVYC+hQhA+la8pLF
T97DglIRO724duxSfy7MSRiYO6yy6wUCH5ZK4Ll7EHelf2S49VWSviPFadz9Dwm6
206z7AzeyFyGvfVDjYhJZ78CIpZltnPUs48LDNmXK3Y2CogCeFQJI85apVdK7jhd
Qb1rXbYAVaVCHtdDQU4sqNM0/zPDS+6gMNgrQDK2IVqyEVOMHMQkqtW9xAn71ebP
RgcznEjm4IkWD03MWR5u7qN3izP+8g451tUVVOcII9z+/oI6kHCwaEvFwx2uVDI8
iTydVV252X19fVX1F7UqDLEiY1HdpCsLagc0uE/TduF4FG8ubfrmLijHi5rs/4Qs
aa4F6g8wPkVy5GY87Nm7MNSTgcC2EFIeborg1/Xu2CT0ZvQ+l4p+v52zfASwtAWR
SMwdrKM46nI4Ogy/Vx0vfinB0z+ynNLWdpzMsiKGQSuwCcwxV8+yz2MI0JUgnCUA
8FhH5gIEdIaj327QbhoPkqkszoMw7YXANHnF3wzf7iW5bk8LalBnlo92/Wx3xvi9
O6G3GjcncP5UOmjTV1MVNUZLPNN/BNOinT/7i4PyFmHNDsrPlP0RfZI7B0x4sMuN
r9/vOf2D1mopCNUoM+wtoj/Z329YN7mR0jP2EisTy8nE3OGKtUl/jEZ58mvOtZ6F
AQwDHE1EcNNBM3MBB/9d055TRdlIn1maiUv3KhN7L21ZkkDDCJKQCDdrILe39fEQ
mPlxBdCaPC7WHr1b0Msp1EMiUtJmzg//RB7gItPhdO6V+7EaEYQI3iBQc/kvLft4
tmIE+8HV8DUNy4mv6qc8bb2y0TsAQXJx4vwgPo9v9cdJDFFwS/UCpRiJozvK3tyK
0OiidRJ79r6vs55nV25wrxeCZHAINn1Vq4WtjJGrT+UwBRN9hvGMqoV0wjsgzMe9
Fucqgu53HSoj6YpmKuGBOTmDqhqcHV0UySa5ZLlcHtlnYxlM8QOxF0ZwV5O9Qb18
Sj/uXsGtaiidHRs3pSabSYwwuVwIchO83THJr17ThF4DvHPnD0odxDQSAQdADmdE
K1/IeaEsVfB4eITc0vy+X/M7aflQT1lc+jGsPlowQoGPkrWwBdOeDxV2uK3cJ2/r
sEMf/sjIQ9YtVJ4+KpESzMiouKpEVAzlJLgZpMkW0poBZpGEoDGNnLn5tLdXMe3C
4g6MaiJzkLOMi11TvQ1ht5QLPGxM+LfTsyAHAY2aV8zOjnDi1v/jZMDOkIblPRMS
FfuESFQeLl8trlIWwMOWo25TvTp1sokBfQEPHAxQrgv65hENgtHnxKGhpgfnFAsB
hnYPbP6lDh0yTebZdGsd/3BxpHbNm7sKAINJRCcYdptPV6rWMfNGu3kR
=GG9k
-----END PGP MESSAGE-----

* fastfetch

#+begin_src json :tangle ~/.config/fastfetch/config.jsonc
{
  "$schema": "https://github.com/fastfetch-cli/fastfetch/raw/master/doc/json_schema.json",
  "display": {
    "key": {
      "width": 10
    },
    "separator": ""
  },
  "logo": {
    "type": "auto",
    "source": "~/.config/fastfetch/frieren.txt",
    "color": {
      "1": "#ccccff",
      "2": "#c6d2ff",
      "3": "#c1d7ff",
      "4": "#bedcff",
      "5": "#bde0fe"
    },
    "padding": {
      "top": 1,
      "left": 1
    }
  },
  "modules": [
    "break",
    {
      "type": "command",
      "key": "󰀄 USER",
      "keyColor": "#ccccff",
      "text": "echo $USER@$(hostnamectl hostname)"
    },
    {
      "type": "os",
      "key": "󰣇 OS",
      "keyColor": "#c9cfff",
      "format": "{name} {version-id}"
    },
    {
      "type": "command",
      "key": "󰌽 KER",
      "keyColor": "#c6d2ff",
      "text": "echo $(uname -r | cut -d- -f1) $(uname -m)"
    },
    {
      "type": "packages",
      "key": "󰏗 PKG",
      "keyColor": "#c4d4ff",
      "format": "{all}"
    },
    {
      "type": "terminal",
      "key": "󰆍 TERM",
      "keyColor": "#c1d7ff",
      "format": "{pretty-name}"
    },
    {
      "type": "shell",
      "key": "󰞷 SH",
      "keyColor": "#c0d9ff",
      "format": "{pretty-name}"
    },
    {
      "type": "uptime",
      "keyColor": "#bedcff",
      "key": "󰥔 UP"
    },
    {
      "type": "memory",
      "key": "󰍛 RAM",
      "keyColor": "#bddeff",
      "format": "{used} / {total} ({percentage})"
    },
    {
      "type": "disk",
      "folders": "/",
      "key": "󰋊 SSD",
      "keyColor": "#bde0fe",
      "format": "{size-used} / {size-total} ({size-percentage})"
    },
    {
      "type": "custom",
      "format": "\u001b[90m \u001b[91m \u001b[92m \u001b[93m \u001b[94m \u001b[95m \u001b[96m \u001b[97m"
    },
    "break"
  ]
}
#+end_src

#+begin_src text :tangle ~/.config/fastfetch/frieren.txt
$1⣿⣿⣿⣿⣿⣿⣿⣿⣿⣻⣿⣿⣿⡿⢿⡿⠿⠿⣿⣿⣿⣿⣿⣿⡿⣿⣿⣿⡿⣿⣿
$1⣿⣿⣿⣿⠿⠿⢿⣿⣿⠟⣋⣭⣶⣶⣞⣿⣶⣶⣶⣬⣉⠻⣿⣿⡿⣋⣉⠻⣿⣿⣿
$2⣿⢻⣿⠃⣤⣤⣢⣍⣴⣿⢋⣵⣿⣿⣿⣿⣷⣶⣝⣿⣿⣧⣄⢉⣜⣥⣜⢷⢹⢇⢛
$2⡏⡦⡁⡸⢛⡴⢣⣾⢟⣿⣿⣿⢟⣾⣧⣙⢿⣿⣿⣿⣿⣿⣿⣿⢩⢳⣞⢿⡏⢷⣾
$3⣷⣵⡇⣗⡾⢁⣾⣟⣾⣿⡿⣻⣾⣿⣿⣿⡎⠛⡛⢿⣿⡟⣿⣿⡜⡜⢿⡌⠇⢾⣿
$3⣿⣿⠁⣾⠏⣾⣿⣿⣽⣑⣺⣥⣿⣿⣿⣿⣷⣶⣦⣖⢝⢿⣿⣿⣿⡀⠹⣿⣼⢸⣿
$4⣿⣿⢰⡏⢡⣿⣿⠐⣵⠿⠛⠛⣿⣿⣿⣿⣿⠍⠚⢙⠻⢦⣼⣿⣿⠁⣄⣿⣿⠘⣿
$4⣿⣿⢸⢹⢈⣿⣿⠘⣡⡞⠉⡀⢻⣿⣿⣿⣿⢃⠠⢈⢳⣌⣩⣿⣿⠰⠿⢼⣿⠀⣿
$5⣿⠿⣘⠯⠌⡟⣿⡟⣾⣇⢾⡵⣹⣟⣿⣿⣿⣮⣓⣫⣿⣟⢿⣿⢿⡾⡹⢆⣦⣤⢹
$5⣅⣛⠶⠽⣧⣋⠳⡓⢿⣿⣿⣿⣿⣿⢿⣿⣿⣿⣿⣿⣿⣫⣸⠏⡋⠷⣛⣫⡍⣶⣿
#+end_src

* Tasks

** Services

*** TODO [#C] Unlock disk encryption over SSH

*** TODO Navidrome

*** DONE yggdrasil
CLOSED: [2026-07-12 Sun 17:08]
:LOGBOOK:
- State "DONE"       from "NEXT"       [2026-07-12 Sun 17:08]
:END:

** Ports

*** DONE [#A] poudriere
CLOSED: [2026-07-12 Sun 17:07]
:LOGBOOK:
- State "DONE"       from              [2026-07-12 Sun 17:07]
:END:

*** poudriere.conf

Source of truth for =/usr/local/etc/poudriere.conf=. Tangles through tramp's doas method and asks for the login password. See the "Setup" section of WORKFLOW.org for how this file is used.

#+begin_src conf :tangle /doas::/usr/local/etc/poudriere.conf
# /usr/local/etc/poudriere.conf

PACKAGE_FETCH_BRANCH=quarterly
PACKAGE_FETCH_URL=pkg+https://pkg.FreeBSD.org/FreeBSD:15:amd64

# Use the existing ZFS pool
ZPOOL=zroot

# Poudriere root filesystem on ZFS
ZROOTFS=/poudriere

# FreeBSD mirror for jail creation
FREEBSD_HOST=https://download.FreeBSD.org

# Copy host resolv.conf into the jail for network access
RESOLV_CONF=/etc/resolv.conf

# Where poudriere keeps jails and ports trees
BASEFS=/usr/local/poudriere

# Share distfiles with the custom ports tree to avoid re-fetching
DISTFILES_CACHE=/home/cashmere/ports/distfiles

# Speed up builds with tmpfs
USE_TMPFS=yes

# Optional: ccache to speed up repeated Rust/C builds
# Install devel/ccache first, then uncomment:
# CCACHE_DIR=/var/cache/ccache

# Sanity checks
USE_PORTLINT=no
#+end_src

* nix package manager

#+begin_src conf :tangle ~/.config/nix/nix.conf
experimental-features = nix-command flakes
#+end_src