Dotfiles

My dotfiles configuration, managed with chezmoi and Homebrew.

Chezmoi prompts for one of two profiles:

• personal
• work

The profile controls which targets and packages are rendered. Common configuration lives in the root; profile-specific configuration is filtered by .chezmoiignore.tmpl.

Profile data is stored in local chezmoi configuration, not in Git. This includes Git identity, Homebrew location, runtime versions, monitor metadata, and optional feature flags:

• enableOverSight
• enableCodexGuidance
• enableObsidianSkill

The optional work features default to off. Do not replace local values with committed defaults.

Install chezmoi, then clone the repository and review the rendered changes:

git clone https://github.com/daviesgeek/DotFiles.git ~/dotfiles
chezmoi init --source ~/dotfiles
chezmoi diff

For a preview that excludes scripts:

chezmoi apply --dry-run --exclude=scripts

Apply the configuration only after reviewing the diff:

chezmoi apply

Applying can install Homebrew packages, Oh My Zsh, and configured runtime dependencies. It can also change selected macOS defaults. Preview and dry-run commands do not apply those changes.

Use these commands before and after changes:

chezmoi status
chezmoi diff
chezmoi verify

After changing profile data, regenerate the local chezmoi configuration and review the managed-path difference before removing stale targets:

chezmoi init --prompt
chezmoi managed --include=files,symlinks --path-style=absolute
chezmoi diff

Remove stale files manually and selectively only after reviewing the output. Do not broadly delete configuration directories.

The repository includes three validation levels:

./validate-dotfiles.sh routine
./validate-dotfiles.sh preview
./validate-dotfiles.sh release

routine checks templates, shell syntax, package ownership, and profile boundaries. preview additionally renders both profiles and checks for stale targets. release includes secret scanning and requires a clean release worktree.

Validation does not apply configuration, install packages, start applications, or perform cleanup.

Install the repository-local pre-commit hook after cloning:

./install-git-hooks.sh

The hook scans staged changes with gitleaks. It requires the Homebrew package from Brewfile.common and preserves a Beads pre-commit hook if one is present.

Packages are split into common and profile-specific manifests:

• Brewfile.common
• Brewfile.personal
• Brewfile.work
• Brewfile.local (optional, untracked machine-local additions)

Automation installs the common manifest, the selected profile, and Brewfile.local when it exists. The local file is intentionally ignored by Git and chezmoi does not deploy it as ~/Brewfile.local, so it can be used for machine-specific packages without promoting them to the shared manifests. Changes to it still trigger the run_onchange_ Homebrew hook.

Create it in the repository source directory when needed:

touch ~/Code/dotfiles/Brewfile.local

Review the combined manifests without installing anything with:

profile=personal
manifest="$(mktemp)"
trap 'rm -f "$manifest"' EXIT
cat Brewfile.common "Brewfile.$profile" >"$manifest"
[ ! -f Brewfile.local ] || cat Brewfile.local >>"$manifest"
brew bundle check --verbose --no-upgrade --file "$manifest"

Adopt an already-installed supported package one at a time:

./adopt-package.sh common cask obsidian
./adopt-package.sh personal brew ffmpeg
./adopt-package.sh work mas Xcode

The adoption script edits manifests only. It does not install, delete, stage, commit, or push anything.

Clean up packages that are installed but no longer belong to the active profile's manifests with:

./cleanup-brew-bundle.sh

The script delegates confirmation to Homebrew: review its removal list and answer y or n. It uses the active chezmoi profile and includes Brewfile.local, so machine-specific packages listed there are preserved. Anything else managed by Homebrew, including formulae, casks, and Mac App Store apps, may be uninstalled. In non-interactive use, Homebrew declines the cleanup rather than removing anything.

OverSight is disabled by default. When enabled, its Home Assistant URL and entity IDs come from local chezmoi data. Its token stays in the macOS login Keychain:

security add-generic-password -U -a "$USER" -s homeassistant-token -w

This repository does not manage SSH keys, GPG private keys, tokens, credentials, CLI authentication, sessions, caches, databases, logs, or other generated application state. Authenticate tools such as gh, Docker, npm, and cloud CLIs separately after setup.

Prompt answers, including Git and text-expansion email values, remain in the local chezmoi configuration and are not committed.