Dotfiles

Personal dotfiles, managed with casa on top of chezmoi. One public-safe repo: every secret is committed only as age ciphertext, and nothing about the keys — names, paths, recipients — is in the repo at all.

Highlights

• One command per machine: laptop or headless VPS, macOS or Linux — the whole machine converges from this repo.
• One passphrase to carry: the private key is in the repo as a passphrase-sealed backup (.casa/keys/main.key.age); a new machine restores it with the passphrase, then everything decrypts silently forever.
• Context gates: answer no to a domain question and that client's SSH/AWS material never even lands on the machine.
• All tools declared: .casadata/packages.toml is the single manifest — brew, casks, taps, go, uv, npm, bun, cargo, and curl | sh installers. Install something by hand and casa offers to record it.

New machine

curl -fsSL https://raw.githubusercontent.com/carrots-sh/casa/main/install.sh | sh -s -- clzmj

That installs Homebrew (if missing) and casa, clones this repo, asks the questionnaire, restores the age key (one passphrase prompt), then applies: dotfiles, secrets, every package, Oh My Zsh, Rust. Restart your shell when it's done.

On a minimal VPS, put the prerequisites in place first:

sudo apt-get update && sudo apt-get install -y git curl

Alternative paths to the same place:

# already have brew                      # no brew, no curl-pipe
brew install carrots-sh/tap/casa         # grab a binary from casa's releases
casa machine setup clzmj                 # then: casa machine setup clzmj

Or plain casa — a fresh machine jumps straight into setup, and casa installs chezmoi itself if it's missing.

Questionnaire

Asked once per machine in casa's UI (answers persist; casa machine answers changes them later):

Prompt	Effect
Machine name	defaults to the hostname
Full name / Email	git identity on every machine
personal	git identities + github/gitlab/hf SSH keys and hosts
unbroker	Unbroker AWS profile + credentials
pz	PZ AWS SSO profiles
hostinger	Hostinger SSH host

The key

main lives at ~/.config/casa/keys/main.txt (raw, passphrase-less — daily operation never prompts). New machines get it one of three ways:

1. Repo backup (default): the restore script decrypts .casa/keys/main.key.age — you type the backup passphrase once.
2. scp -r ~/.config/casa/keys newhost:~/.config/casa/
3. casa secrets keys → doppler push on one machine, pull on the other.

Keys are managed with casa secrets keys (create, default, backup, delete with orphan re-encryption).

Daily use

casa                      # the menu — grouped, filterable, esc to back out
casa tools add            # search, or paste any install command
casa tools import         # record what you installed directly
casa edit zshrc           # fuzzy-pick + edit (encrypted handled transparently)
casa save                 # commit + push with an auto-written message
casa sync                 # upgrade packages, pull, apply

The manifest is also hand-editable — casa's edits preserve your comments, and chezmoi apply reconciles installs/uninstalls either way.

Cross-OS

Everything runs on macOS and Linux. ~/.zprofile and the ignore rules are templated on .chezmoi.os: casks/fonts and macOS-only paths are darwin-gated, ~/Library never renders on Linux, and the shell helpers shim open/pbcopy to xdg-open/wl-copy/xclip.

Unmanaged apps

GUI/personal apps are not managed here — install by hand: Spotify, WhatsApp, Zoom, Slack, Chrome, Helium, Google Drive, VLC, Blender, Affinity, Arturia, MS Word, Wispr Flow, KeyCastr, CodexBar, Ollama.app, Docker Desktop, Ghostty, DBeaver, PortKiller.

To stop brew tracking an installed cask without removing the app: rm -rf "$(brew --caskroom)/<app>".

Secrets

• Per-client AWS blocks are encrypted fragments in dot_aws/secrets/, assembled into ~/.aws/config / ~/.aws/credentials by templates via include | decrypt.
• SSH server configs are encrypted ~/.ssh/config.d/*.conf, pulled in by the native Include in ~/.ssh/config.
• macOS-only app secrets live under private_Library/ (ignored on Linux).

Layout

Committed — data only:

.casa.toml.tmpl          questionnaire → machine/name/email + domain gates; [age] block
.casaignore              context gates; hides secret fragments; Library on Linux
.casadata/packages.toml  the package manifest
.casa/keys/main.key.age  passphrase-sealed key backup (armored)
dot_config/zsh/*.zsh     shell aliases + functions, sourced by ~/.zshrc
dot_aws/  dot_ssh/       templates + encrypted fragments
run_once_after_10-*      personal bootstrap: omz, rust, linux prereqs

Generated by casa (gitignored, never committed): the chezmoi-name symlinks (.chezmoi.toml.tmpl → .casa.toml.tmpl, …) and the run scripts that install packages, run curl | sh tools, and restore keys — they come from the installed casa, so they're always current.