Dotfiles

Personal dotfiles managed with chezmoi and mise.

What's included

• zsh config with completions, history, key bindings (preferred)
• bash config as fallback with equivalent features
• starship prompt (plain-text fallback for terminals without font support)
• neovim config with Lazy plugin manager
• tmux config with TPM
• git global config with gitleaks pre-commit hook for secret detection
• direnv integration
• fzf for fuzzy finding and history search
• 1Password credential protection against exfiltration (see CREDENTIAL-PROTECTION.md)

Tools (managed by mise)

chezmoi, just, neovim, lsd, bat, delta, fd, ripgrep, fzf, starship, tmux, direnv, go, node, gitleaks, gh, kubectl, kubectx, kubens, krew, uv, rust

Prerequisites

macOS (Homebrew):

xcode-select --install
brew install curl git zsh

Ubuntu/Debian:

sudo apt update && sudo apt install -y curl git build-essential
# optional: sudo apt install -y zsh

Arch Linux:

sudo pacman -Sy --noconfirm curl git base-devel
# optional: sudo pacman -S zsh

Install

Option 1 — one-liner with chezmoi:

sh -c "$(curl -fsSL https://get.chezmoi.io)" -- init --apply NoUseFreak/dot

Option 2 — clone and run:

git clone https://github.com/NoUseFreak/dot.git
cd dot
bash setup.sh

Chezmoi drives the full installation via run_onchange_ hooks:

1. Deploy all dotfiles
2. Install mise and all tools (mise install)
3. Install tmux plugins via TPM
4. Install neovim plugins via Lazy

The hooks re-run automatically when their tracked config files change (e.g. adding a tool to mise/config.toml triggers a reinstall).

If zsh is available it will be set as the default shell. Otherwise bash is used with an equivalent configuration.

Day-to-day

Apply changes after editing dotfiles:

just apply   # chezmoi init --apply
just diff    # preview changes before applying

Credential Protection

This setup includes comprehensive credential protection to prevent exfiltration attacks. See CREDENTIAL-PROTECTION.md for details.

Quick setup for a tool:

setup-credential npm   # or: uv, pip, cargo, go, tea, gh, docker, aws

All package manager commands (npm, pip, cargo, go, etc.) are automatically wrapped to inject credentials from 1Password at runtime instead of storing them in config files.

Test

Run the full setup in a disposable container to verify nothing is broken:

just test-ubuntu    # test on Ubuntu (with zsh)
just test-debian    # test on Debian (with zsh)
just test-fedora    # test on Fedora (with zsh)
just test-arch      # test on Arch Linux (with zsh)
just test-bash      # test on Ubuntu (bash only)
just test-all       # test all of the above

Interactive shell

Drop into a container with everything installed:

just shell

Structure

setup.sh                          # bootstrap (chezmoi init --apply)
goss.yaml                         # post-install validation (goss)
justfile                          # task runner (apply, diff, test, shell)
dot_zshenv                        # zsh early env (sources shared env)
dot_bash_profile                  # bash login shell (sources shared env + bashrc)
dot_bashrc                        # bash interactive config
dot_config/
  shell/env                       # shared environment variables
  shell/alias                     # shared shell aliases
  zsh/dot_zshrc                   # zsh interactive config
  starship.toml                   # starship prompt (nerd font)
  starship-plain.toml             # starship prompt (plain text)
  mise/config.toml                # tool versions
  git/config                      # global git config
  git/ignore                      # global gitignore
  git/hooks/executable_pre-commit # gitleaks secret scanner
  nvim/                           # neovim config
  tmux/                           # tmux config

Files prefixed with dot_ are deployed by chezmoi (e.g. dot_zshenv becomes ~/.zshenv).