dotfiles

Personal dotfiles managed with chezmoi.

Platform: Linux x86_64 only.

Bootstrap a new machine

# Step 1: install chezmoi
sh -c "$(curl -fsLS get.chezmoi.io)" -- -b ~/.local/bin

# Step 2: init and apply (prompts will appear)
~/.local/bin/chezmoi init --apply github.com/prakashsurya/dotfiles

The two-step form is required — piping directly from curl replaces stdin, causing chezmoi to skip prompts and produce incomplete configuration.

Alternatively, if you have already cloned the repo:

./install.sh

This installs chezmoi (if missing), runs chezmoi init --apply on first run, or chezmoi apply on subsequent runs. Can be re-run safely at any time.

You will be prompted for:

• GitHub personal access token
• OneLogin client_id / client_secret
• OneLogin role ARN
• OneLogin AWS app IDs (x2)

Day-to-day usage

chezmoi edit ~/.gitconfig     # edit a dotfile in your $EDITOR
chezmoi diff                  # preview pending changes
chezmoi apply                 # apply changes to $HOME
chezmoi update                # pull latest from GitHub + apply

To add a new dotfile:

chezmoi add ~/.some-config-file         # plain file
chezmoi add --template ~/.some-file     # as a template (for machine-specific values)

Then commit from the source directory:

cd $(chezmoi source-path)
git add -A && git commit -m "feat: add ..." && git push

After bootstrapping — manual steps

These are intentionally not automated:

1. SSH key + git-utils: Generate a key, add it to GitHub, then re-apply:

   ssh-keygen -t ed25519
   # Add the public key to GitHub (Settings → SSH keys) and authorized_keys
   chezmoi apply

   The second chezmoi apply detects ~/.ssh/id_ed25519 and, gated on that key, does the private-repo work: clones delphix/git-utils (then pins Python 3.10.7 via pyenv), clones prakashsurya/llm-wiki to ~/llm-wiki, and installs the Claude plugins from the private marketplaces. None of those happen on the first apply.
2. Set fish as default shell: chsh -s $(which fish)
3. Disable SSH password login: Two files need updating — the main config and the Delphix-specific drop-in which re-enables keyboard-interactive auth:

   sudo sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
   sudo sed -i -e 's/^#\?ChallengeResponseAuthentication.*/ChallengeResponseAuthentication no/' \
               -e 's/^#\?KbdInteractiveAuthentication.*/KbdInteractiveAuthentication no/' \
               /etc/ssh/sshd_config.d/9-delphix.conf
   sudo systemctl restart ssh

   Ensure your SSH key is in ~/.ssh/authorized_keys before doing this. Verify with:

   sudo sshd -T | grep -E 'passwordauthentication|kbdinteractiveauthentication'

4. Neovim plugins: Launch nvim — kickstart.nvim uses lazy.nvim which auto-installs plugins on first run (the nvim config is pulled unmodified from upstream via chezmoiexternal)
5. Jenkins tokens: Add manually after setup:

   git config --global dlpx.jenkins-token-selfservice-jenkins-delphix-com <token>
   git config --global dlpx.jenkins-token-masking-jenkins-delphix-com <token>
   git config --global dlpx.jenkins-token-saas-jenkins-eng-tools-general-aws-delphixcloud-com <token>
   git config --global dlpx.jenkins-token-ops-jenkins-delphix-com <token>
   git config --global dlpx.jenkins-token-selfservice-jenkins-eng-tools-prd-aws-delphixcloud-com <token>
   git config --global dlpx.jenkins-token-ops-jenkins-eng-tools-prd-aws-delphixcloud-com <token>

Notes

• Architecture: The neovim bootstrap script downloads a Linux x86_64 binary and the fish config hardcodes the corresponding PATH entry. ARM is not supported.
• git-utils Python version: The 07-pin-git-utils-python chezmoi script pins Python 3.10.7. If git-utils changes its requirement, update PYTHON_VERSION in home/.chezmoiscripts/run_always_after_07-pin-git-utils-python.sh.
• Bundle access: /nas comes pre-mounted on these VM images (systemd nas.mount unit + support-tools group, baked into the image). No dotfiles-managed setup is needed — this superseded the old support-tools-ssh flow (AWS SSM jump host + granted role assumption), which has been removed from these dotfiles.

Repository structure

dotfiles/
├── README.md
├── install.sh                       # bootstrap wrapper (installs chezmoi, inits or applies)
├── .chezmoiroot                     # points chezmoi source root to home/
└── home/
    ├── .chezmoi.toml.tmpl           # machine config (prompts on first run)
    ├── .chezmoidata/packages.toml   # apt package list
    ├── .chezmoiexternal.toml.tmpl   # external git repos (nvim, tmux; git-utils + llm-wiki when SSH key exists)
    ├── .chezmoiignore               # never-track guard for ~/.claude runtime state and secrets
    ├── .chezmoiscripts/
    │   ├── run_onchange_before_01-install-packages.sh.tmpl
    │   ├── run_onchange_after_02-install-pyenv.sh
    │   ├── run_onchange_after_04-install-neovim.sh
    │   ├── run_onchange_after_05-install-gh.sh
    │   ├── run_onchange_after_06-install-claude.sh
    │   ├── run_onchange_after_10-install-claude-plugins.sh
    │   └── run_always_after_07-pin-git-utils-python.sh
    ├── dot_gitconfig.tmpl           # → ~/.gitconfig
    ├── dot_tmux.conf                # → ~/.tmux.conf
    ├── dot_onelogin-aws.config.tmpl # → ~/.onelogin-aws.config
    ├── dot_config/fish/config.fish.tmpl # → ~/.config/fish/config.fish
    ├── dot_ssh/config.tmpl          # → ~/.ssh/config
    └── private_dot_claude/          # → ~/.claude  (private_ ⇒ mode 0700)
        ├── CLAUDE.md.tmpl           # → ~/.claude/CLAUDE.md (wiki pointer + durable-memory rule)
        ├── modify_private_settings.json # jq-merges dotfiles-owned keys into ~/.claude/settings.json
        └── conventions/.gitkeep     # → ~/.claude/conventions/ (repo-specific working rules)

.chezmoiignore is a defensive block, not a deployment filter: nothing in it is in the source tree today. It exists so a future chezmoi add ~/.claude cannot sweep credentials, session state, the voice corpus, or handoff notes into this repo — which is public.