path: root/dotfiles.org

#+title: dotfiles management
#+PROPERTY: header-args :mkdirp yes
#+auto_tangle: t

* git

#+begin_src conf :tangle ~/.gitconfig
[user]
	name = cashmere
	email = cashmere@autistici.org
	useConfigOnly = true
	signingkey = B877C0AC3B080FBB!
[init]
	defaultBranch = master
[commit]
	gpgsign = true
[gpg]
	format = openpgp
	program = gpg
[pull]
	rebase = true
[push]
	autoSetupRemote = true
	default = current
[fetch]
	prune = true
	pruneTags = true
[diff]
	algorithm = histogram
[merge]
	conflictstyle = zdiff3
[alias]
	dft = -c diff.external=difft diff
	dlog = -c diff.external=difft log -p --ext-diff
	dshow = -c diff.external=difft show --ext-diff
[rebase]
	autosquash = true
	autostash = true
[core]
	autocrlf = input
[remote "origin"]
	gcrypt-participants = B877C0AC3B080FBB
	gcrypt-signingkey = B877C0AC3B080FBB
[wt]
	basedir = .git/wt
	copyignored = true
	copymodified = true
#+end_src

* .env

#+begin_src sh :tangle ~/.env
# Common environment for login shells and X session
EDITOR=vi
PAGER=less
export EDITOR PAGER

PASSWORD_STORE_DIR=$HOME/pass
export PASSWORD_STORE_DIR

DISTDIR=$HOME/ports/distfiles
WRKDIRPREFIX=$HOME/ports/work
PORTSDIR=/usr/local/poudriere/ports/base
export DISTDIR WRKDIRPREFIX PORTSDIR

XDG_RUNTIME_DIR=$HOME/.run
export XDG_RUNTIME_DIR

gpgconf --launch gpg-agent
export SSH_AUTH_SOCK=$(gpgconf --list-dirs agent-ssh-socket)
#+end_src

* .profile

#+begin_src sh :tangle ~/.profile
#
# .profile - POSIX Shell startup script for login shells
#
# see also sh(1), environ(7).
#

# set ENV to a file invoked each time sh is started for interactive use.
ENV=$HOME/.shrc; export ENV

# Let sh(1) know it's at home, despite /home being a symlink.
if [ "$PWD" != "$HOME" ] && [ "$PWD" -ef "$HOME" ] ; then cd ; fi

# Query terminal size; useful for serial lines.
if [ -x /usr/bin/resizewin ] ; then /usr/bin/resizewin -z ; fi

# Display a random cookie on each login.
if [ -x /usr/bin/fortune ] ; then /usr/bin/fortune freebsd-tips ; fi

# Shared environment (GPG, editor, password-store)
. "$HOME/.env"

# Start xonsh for interactive login shells on a tty
if [ -n "$PS1" ] && [ -x /usr/local/bin/xonsh ]; then
    exec /usr/local/bin/xonsh
fi
#+end_src

* .xinitrc

#+begin_src sh :tangle ~/.xinitrc
. "$HOME/.env"
export GPG_TTY=$(tty)
exec i3
#+end_src

* .xonshrc

#+begin_src python :tangle ~/.xonshrc
import subprocess, shutil

$PATH.insert(0, $HOME + '/.cargo/bin')
$PATH.insert(0, $HOME + '/.local/bin')

$GPG_TTY = $(tty).strip()

if shutil.which("gpg-agent"):
    subprocess.run(["gpgconf", "--launch", "gpg-agent"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
    $SSH_AUTH_SOCK = $(gpgconf --list-dirs agent-ssh-socket).strip()
    subprocess.run(["gpg-connect-agent", "updatestartuptty", "/bye"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)

if shutil.which("atuin"):
    running = subprocess.run(["pgrep", "-x", "atuin"], capture_output=True).returncode == 0
    if not running:
        subprocess.Popen(["atuin", "daemon", "start"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, start_new_session=True)

def _jail_connect(args):                                                                                                          
    if args:                                                                                                                      
        name = args[0]                                                                                                            
    else:                                                                                                                         
        print("running jails:")                                                                                                  
        jls                                                                                                                       
        name = input("jail: ").strip()                                                                                            
    if not name:                                                                                                                  
        return                                                                                                                    
    doas jexec -U cashmere @(name) env HOME=/home/cashmere USER=cashmere LOGNAME=cashmere xonsh -l                                

aliases['jail'] = _jail_connect        

execx($(atuin init xonsh))
execx($(zoxide init xonsh), 'exec', __xonsh__.ctx, filename='zoxide')
#+end_src

* atuin

#+begin_src toml :tangle ~/.config/atuin/config.toml
auto_sync = true
sync_address = "https://atuin.cashmere.rs"
sync_frequency = "1m"

[daemon]
enabled = false
systemd_socket = false

[dotfiles]
enabled = true
#+end_src

* ssh

** =authorized_keys=

#+begin_src conf :tangle ~/.ssh/authorized_keys
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILOwBidfdZzcSEIPSRT0C8U9U55WSES1ugqAKE+nvgQ9 (none)
#+end_src

* gpg setup

** gpg-agent.conf

#+begin_src conf :tangle ~/.gnupg/gpg-agent.conf
enable-ssh-support
default-cache-ttl 600
max-cache-ttl 7200
pinentry-program /usr/local/bin/pinentry-emacs
#+end_src

** sshcontrol :crypt:

-----BEGIN PGP MESSAGE-----

hQIMA0fZrn09GBJoAQ/8CNgrMmtje3ID2JbpQ3s3hwm32kQYQaApv9oVlYxs3v0B
e9p2lXV8VtihnnaSOwnZl3QRUZFPYuV6qTvhyY8XMtlpyRfBOjnAaR8JdnuGyQXf
Xsy+gaMARQlU2kR76s9wmjrVxuJIdUFPP8yVz1rxB7RvNsaLU3D0M/ZopcovbBhJ
DIQJkQ1H1QQM7OBnGmvBVrL21zaSwKuVkb6Or0CZLF8QoO25OYfRlM5w2r2y2rRj
dX0E6NhDd+n0/06ly4oo01wO3MnQiqdTs1ov+JtZf5s7S5ahhPC5BJOAlVxtll9b
RRR8n/pWueLNdbK/SAUnbPSUsKJiOFRAv5mQa+SGby28kMNIyDR9chIL+0+dFfvc
OxKgL6c21yAiMzXKmunTnYG2aqLF9UpPa0pSXHR80kr0vfX7pmz99uMAUjHSduM0
akZajlLuoOzQI60mh6urSbPxghtVfTLJi25hgxFj1XiZ6A24GvhmcMeRkxlG0yWE
7biF+oZeWN1IFb4hWOx0fyiYZ6j3kbqPicts4Ytd3aTPP14LTbcq6pqg0UQ1BLXm
9x1oiSeCySdDM68JGvA6KwYzyh70DTDRXD8lTfxooeDdTMmw6ghaoF81spFO3Vi6
jVAgE1ecSgCUO6K7YwFFRhJujOBGrCbl+bEl+AOnlu4itSuwohEIGuWWNscRsn6F
AQwDHE1EcNNBM3MBB/9pKBWGDZkkE9EDmmzWgDLlUYZLxZECr5PJC9vamoiYqJwb
dRBqh4G4RM60Qtz9AeEZ9CpaMnUiXtpzXpMPz574PLXZYm2IDSpANUv+Fp+ge9LL
SBB9+02sA9aIR+xTV63sLHxAxN8GSKZT4kPl1aKBRUHEsh8oi77SQBqqwUIvmwYI
IOaMA5k9EpW5aEakWqEgo9gFj9k+TA8biUl7EW2qmex8jvZjCSUr8dHQfCDwWHPh
k49zvAu9EUjOM8s+00elJ+p0rW2Ab8PmRVLQPxsGxOkK5NQp2V7heSLz1b494n1m
OBL+dHDxn2lwPnuVbigohOEyGTc+qiQQM6oLovaFhF4DvHPnD0odxDQSAQdA+vH4
fhdVx37ZqHdp2BsN1S/QeQgr7AWS5SBUAxf3pEow3OScsbIInSkLJ9bFZ8nQJOBI
Bv3HO/doPyga8IFpGwsDKhG5InzMvG+md11F5K6j0psBklLzDd8KbYOIPYjbBvSS
Plc0i5QPFpy/FnI0/2zSJYu08WbPitbHem57Tk6a3V1xkXVavziV8kc5eygdTfxt
jBbQe5Lt9tDbPd8Fe7yNIhGJ8OFdKzzliqCCSzzga8AKzJ6AyixHsl3scpU9n8Jb
Br3gms1smZVfUdn9NwAmOOZgcgGGvPQz+kruWcOKOoBKOFSQWrqx1bqEuw==
=XEf0
-----END PGP MESSAGE-----

* mail

** mbsync

#+begin_src conf :tangle ~/.mbsyncrc
IMAPAccount autistici
Host mail.autistici.org
Port 993
User cashmeresamurai@autistici.org
PassCmd "pass show autistici"
TLSType IMAPS

IMAPStore autistici-remote
Account autistici

MaildirStore autistici-local
Path ~/Mails/autistici/
Inbox ~/Mails/autistici/Inbox
SubFolders Verbatim

Channel autistici
Far :autistici-remote:
Near :autistici-local:
Patterns *
Create Near
SyncState *

IMAPAccount migadu
Host imap.migadu.com
Port 993
User cashmere@cashmere.rs
PassCmd "pass show migadu/cashmere"
TLSType IMAPS

IMAPStore migadu-remote
Account migadu

MaildirStore migadu-local
Path ~/Mails/migadu/
Inbox ~/Mails/migadu/Inbox
SubFolders Verbatim

Channel migadu
Far :migadu-remote:
Near :migadu-local:
Patterns *
Create Near
Expunge Both
SyncState *
#+end_src

** msmtp

#+begin_src conf :tangle ~/.msmtprc
defaults
auth on
tls on
tls_trust_file /usr/local/share/certs/ca-root-nss.crt
logfile ~/.msmtp.log

account autistici
host smtp.autistici.org
port 587
tls_starttls on
from cashmeresamurai@autistici.org
user cashmeresamurai@autistici.org
passwordeval "pass show autistici"

account migadu
host smtp.migadu.com
port 465
tls_starttls off
from cashmere@cashmere.rs
user cashmere@cashmere.rs
passwordeval "pass show migadu/cashmere"

account default : autistici
#+end_src

** mu init

#+begin_src sh
mu init --maildir=$HOME/Mails --my-address=cashmeresamurai@autistici.org --my-address=cashmere@cashmere.rs
#+end_src
* Tasks

** Services

*** CANCELLED [#C] Unlock disk encryption over SSH
CLOSED: [2026-07-17 Fri 21:57]
:LOGBOOK:
- State "CANCELLED"  from "DONE"       [2026-07-17 Fri 21:57] \\
  not needed
- State "DONE"       from "TODO"       [2026-07-17 Fri 21:57]
:END:

*** CANCELLED Navidrome
CLOSED: [2026-07-17 Fri 21:57]
:LOGBOOK:
- State "CANCELLED"  from "TODO"       [2026-07-17 Fri 21:57] \\
  someday maybe
:END:

*** DONE yggdrasil
CLOSED: [2026-07-12 Sun 17:08]
:LOGBOOK:
- State "DONE"       from "NEXT"       [2026-07-12 Sun 17:08]
:END:

** Ports

*** DONE [#A] poudriere
CLOSED: [2026-07-12 Sun 17:07]
:LOGBOOK:
- State "DONE"       from              [2026-07-12 Sun 17:07]
:END:

*** poudriere.conf

#+begin_src conf 
# /usr/local/etc/poudriere.conf

PACKAGE_FETCH_BRANCH=quarterly
PACKAGE_FETCH_URL=pkg+https://pkg.FreeBSD.org/FreeBSD:15:amd64

# Use the existing ZFS pool
ZPOOL=zroot

# Poudriere root filesystem on ZFS
ZROOTFS=/poudriere

# FreeBSD mirror for jail creation
FREEBSD_HOST=https://download.FreeBSD.org

# Copy host resolv.conf into the jail for network access
RESOLV_CONF=/etc/resolv.conf

# Where poudriere keeps jails and ports trees
BASEFS=/usr/local/poudriere

# Share distfiles with the custom ports tree to avoid re-fetching
DISTFILES_CACHE=/home/cashmere/ports/distfiles

# Speed up builds with tmpfs
USE_TMPFS=yes

# Optional: ccache to speed up repeated Rust/C builds
# Install devel/ccache first, then uncomment:
# CCACHE_DIR=/var/cache/ccache

# Sanity checks
USE_PORTLINT=no
#+end_src

** Documentation

*** TODO document nvidia and mangowm setup