.dotfiles

A signed, local-first Trusted agent workstation baseline for macOS, Linux, and WSL. One CLI to apply, diagnose, repair, and attest.

Install

bash -c "$(curl -fsSL https://raw.githubusercontent.com/sebastienrousseau/dotfiles/master/install.sh)"

Then check your setup and take a tour:

dot doctor        # verify installation
dot learn         # interactive tour of your new dotfiles

You need git and curl. Works on macOS, Ubuntu/Debian, Arch, WSL2, and GitHub Codespaces.

Silent install (no prompts):

DOTFILES_SILENT=1 DOTFILES_NONINTERACTIVE=1 \
  bash -c "$(curl -fsSL https://raw.githubusercontent.com/sebastienrousseau/dotfiles/master/install.sh)"

Docker sandbox:

docker run --rm -e DOTFILES_NONINTERACTIVE=1 ubuntu:24.04 bash -c \
  'apt-get update -qq && apt-get install -y -qq git curl sudo >/dev/null 2>&1 \
  && git clone --depth 1 https://github.com/sebastienrousseau/dotfiles.git ~/.dotfiles \
  && bash ~/.dotfiles/install.sh \
  && export PATH="$HOME/.local/bin:$PATH" \
  && dot doctor'

Overview

This repo goes beyond a simple dotfiles collection. It works more like workstation infrastructure. Every file is tracked, the runtime scope is clear, and the workflow is simple: install, apply, diagnose, repair, attest, and recover. Chezmoi handles templates and platform differences. The dot CLI sits on top and ties it all together.

• Encrypted secrets with Age and SOPS
• Portable runtimes with Mise, plus Nix when you need fully repeatable builds
• Built-in recovery with dot doctor, dot heal, restore, rollback, and bundle tools
• Tracked governance with policy files, attestation output, and compliance checks stored in the repo

Architecture

Run it once or a hundred times. The machine ends up in the same state.

graph TD
    A[User Shell] --> B{dot CLI}
    B --> C[Diagnostics: dot doctor / smoke-test]
    B --> D[Maintenance: dot update / prewarm]
    B --> E[Lifecycle: dot apply / rollback]
    D --> F[Chezmoi Source]
    F --> G[Zsh / Fish / Bash Configs]
    F --> H[Tool Runtimes: Mise / Nix]
    G --> I[~/.cache/shell Fast Init]

Features

The dot CLI

Full reference: docs/reference/UTILS.md

First 5 Minutes

After you install:

1. Check — dot doctor checks tools, paths, and security
2. Explore — dot learn walks you through shell, secrets, themes, and performance
3. Customize — edit ~/.config/chezmoi/chezmoi.toml for per-machine settings (Profiles)
4. Toggle features — turn features on or off in .chezmoidata.toml (Feature Flags)
5. Apply — dot apply applies the config; dot prewarm caches shell startup

See the Migration Guide for version upgrades.

What's Included

• Zsh loads in stages through small modules, not one big startup script
• Fish is set up for fast interactive use with _cached_eval and deferred loading
• Nushell handles structured terminal workflows while fitting into the rest of the setup
• PowerShell keeps cross-platform and WSL sessions on the same baseline
• Starship, Zoxide, Atuin, and fzf handle navigation and command recall

• Mise manages language and tool versions in user space, keeping the base system clean
• Nix Flakes offer strict repeatable builds when that matters more than speed
• Pueue gives long-running tasks a proper queue instead of extra terminal tabs
• Neovim ships as a full Lua-based editor, not a starter template
• Lazygit rounds out the terminal workflow without needing a GUI

• Age / SOPS keep secrets encrypted at rest and out of plaintext history
• SSH signing and trust metadata back up signed commits and verifiable changes
• Gitleaks, policy checks, and compliance workflows build security into the repo from the start
• Telemetry controls and local-first defaults keep you in charge of your workstation
• Attestation and registry files record machine state, policy, prompt, and model metadata in tracked JSON

For security hardening options, see the Security docs.

THE ARCHITECT ᛫ Sebastien Rousseau
THE ENGINE ᛞ EUXIS ᛫ Enterprise Unified Execution Intelligence System

License

Licensed under the MIT License. See LICENSE for details.

Back to Top