domverse
893ec8e3cb
Two layers with a deliberate privilege split: setup.sh does the root work (apt, rustup, cargo tools, starship, chsh) and hands off to chezmoi, which owns everything under $HOME. Tools are built with `cargo install --locked` to match the versions currently running rather than whatever apt ships, at the cost of a 10-20 min cold setup. Excluded on purpose: the atuin sync key and ~/.git-credentials (secrets), ~/.claude/settings.json (per-box decision), fnm/opencode conf.d (out of scope), and fish_variables (machine-local). chezmoi tracks only the executable and private attributes and derives modes from the umask, so setup.sh pins umask 022 and atuin uses private_ to keep 0700/0600. Without both, a 002 umask silently relaxes them to 0775/0664. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
28 lines
1.0 KiB
Plaintext
28 lines
1.0 KiB
Plaintext
# Never manage these — they are secrets or machine-local runtime state.
|
|
# chezmoi will neither read them into source state nor write them to the target.
|
|
|
|
# Git credential store (plaintext tokens — .gitconfig sets helper=store)
|
|
.git-credentials
|
|
|
|
# Atuin runtime state + sync encryption key.
|
|
# The key is tracked by hand in secrets.yml; restore with `atuin login`.
|
|
.local/share/atuin/**
|
|
|
|
# Claude runtime state — history, per-project memory, session data.
|
|
# Only statusline-command.sh is managed. settings.json is deliberately NOT
|
|
# tracked: it pins the model and sets skipDangerousModePermissionPrompt, which
|
|
# is a per-box decision. Set it by hand on each machine.
|
|
.claude/projects/**
|
|
.claude/todos/**
|
|
.claude/statsig/**
|
|
.claude/.caveman-active
|
|
.claude/settings.json
|
|
.claude/settings.local.json
|
|
|
|
# Fish machine-local state (generated by fish itself)
|
|
.config/fish/fish_variables
|
|
|
|
# Out of scope for this repo (installed by their own installers, if at all)
|
|
.config/fish/conf.d/fnm.fish
|
|
.config/fish/conf.d/dtop.env.fish
|