kc's dotfiles

Personal dotfiles configuration for kamontat.

• Terminology
  • Target/Destination
  • Source
  • Local Repository
  • Remote Repository
  • Lite Setup
  • Full Setup
• Usage
  • Prerequisites
  • Getting Started
  • Actions
  • Update Target Directory
  • Uninstall Dotfiles
  • Docker Image
    • Image Tags
    • Run Container
    • Full Setup in Container
• Features
  • Zinit
    • Upgrade Zinit
    • Upgrade Plugins
  • LazyVim (Neovim)
    • Upgrade Plugins
  • Homebrew
    • Upgrade Packages
  • Mise
  • 1Password
  • Alfred
    • Setup
  • TablePlus
  • Okta Verify
  • Keybase
  • Docker
    • Verify Docker Image
      • Verify Docker Hub Image
      • Verify GitHub Container Registry Image
  • KDF Helper Scripts
• Known Gaps
  • macOS
• Contributing

Terminology

For additional terminology, see chezmoi reference.

Target/Destination

• Destination Directory: The directory being managed (typically ~).
• Target: Individual files, directories, or symlinks inside the destination directory.
• Target State: The computed desired state for your destination directory.

Source

• Source Directory: Where chezmoi stores source state (~/.local/share/chezmoi by default).
• Source State: The desired state definition (including templates and machine-specific data).

Local Repository

The Git repository on your local machine (usually your Source Directory), which contains your source state and configuration.

Remote Repository

An external Git repository (for example, GitHub) that you push local changes to and pull updates from. This is how you sync your dotfiles across multiple machines.

Lite Setup

Install only non-encrypted data based on data flags.

chezmoi init kc-workspace --apply --force --purge-binary --promptDefaults

Full Setup

Install all configured data based on data flags.

Requirement:

• $HOME/.config/chezmoi/key.txt (otherwise, setup scripts will prompt for the encryption password).

chezmoi init kc-workspace --apply --force --purge-binary \
  --promptDefaults --promptBool "Enable 1Password=true,Enable age=true"

Usage

Prerequisites

1. Sign in to the App Store.

Getting Started

1. Open the Terminal app.
2. Install Homebrew (macOS only).

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

3. Install prerequisite dependencies.

## macOS (you will see <path> from step 2 output)
eval "$("/<path>/brew" shellenv)"
brew install git

## Debian-based
apt install -y git curl

## Alpine-based
apk add -y git curl

4. Install chezmoi temporarily via direct download.

sh -c "$(curl -fsSL get.chezmoi.io)" -- -b "$HOME/.local/bin" -t "v2.74.0"

5. Initialize the chezmoi repository.

## Add --dry-run to check the expected result first
"$HOME/.local/bin/chezmoi" init kc-workspace \
  --apply --force --purge-binary --promptDefaults

6. Sign in to your account in the 1Password app.
7. Enable Developer mode in 1Password (learn more).
   • Enable Show 1Password Developer experience.
   • Enable Integrate with 1Password CLI.
   • Enable Integrate with other apps.
   • Enable Check for developer credentials on disk.
8. Open a new terminal window or tab. Zinit should start downloading dependencies.
9. Validate op status (optional).

## Validate account status
op whoami
# URL:        https://my.1password.com/
# Email:      <your-email>
# User ID:    <your-user-id>

10. Get the full-setup encryption password from 1Password (optional).

## Use app search bar
# 7qxsqxktd3qziyp2m2hzw7bpp4

## Use 1Password CLI
op read --account my "op://h75rks2xxgluyljikha4oforri/7qxsqxktd3qziyp2m2hzw7bpp4/password"

11. Run full setup.

## This prompts for the encryption password from step 10
kdf-setup-full.sh

12. Restart your computer at least once to apply all changes.

Actions

• https://www.chezmoi.io/user-guide/daily-operations/
• https://www.chezmoi.io/user-guide/command-overview/

Common actions you might perform with this repository:

Update Target Directory

chezmoi update --init --apply

Uninstall Dotfiles

chezmoi purge

Docker Image

Prebuilt images are published to both registries on every release:

• Docker Hub: kamontat/dotfiles
• GitHub Container Registry: ghcr.io/kc-workspace/dotfiles

Each image runs as user kamontat (UID 1000) with passwordless sudo, starts zsh by default, and comes with Lite Setup already applied.

Image Tags

Base image is selected by tag suffix:

Base image	Suffix	Example
ubuntu:latest	(none)	latest
debian:latest	-debian	latest-debian
alpine:latest	-alpine	latest-alpine

Available tag names (combine with suffix above):

• latest: latest release
• <major>, <major>.<minor>, <version>: specific release (e.g. 1, 1.2, 1.2.3)
• edge: latest commit on default branch
• sha-<short-sha>: specific commit

Run Container

## Start an interactive shell session (removed on exit)
docker run -it --rm kamontat/dotfiles:latest

## Use other base image or registry
docker run -it --rm kamontat/dotfiles:latest-alpine
docker run -it --rm ghcr.io/kc-workspace/dotfiles:latest-debian

## Mount current directory as workspace
docker run -it --rm -v "$PWD:/home/kamontat/workspace" \
  -w /home/kamontat/workspace kamontat/dotfiles:latest

## Run a single command instead of interactive shell
## (-i loads .zshrc, which sets up PATH)
docker run -it --rm kamontat/dotfiles:latest -ic 'chezmoi status'

To build image locally, see CONTRIBUTING. To verify image integrity, see Verify Docker Image.

Full Setup in Container

Run Full Setup inside a running container. It prompts for the encryption password unless $HOME/.config/chezmoi/key.txt exists.

## Mount age key from host to skip password prompt (optional)
docker run -it --rm \
  -v "$HOME/.config/chezmoi/key.txt:/home/kamontat/.config/chezmoi/key.txt:ro" \
  kamontat/dotfiles:latest

## Inside container
kdf-setup-full.sh

Features

• Zsh configuration: here
  • Zinit as the Zsh plugin manager
• Git configuration: here
• Applications and packages (via Homebrew or apt)
  • Homebrew as package manager
  • Installed applications list: here
• Command-line tools (via mise)
  • Installed tools: here
• Working directory layout
  • Personal for personal projects
  • Works for work projects, organized by workplace
• Encrypted files via gpg
• Password manager via 1Password

Zinit

Installation method: chezmoi/external

Upgrade Zinit

zinit self-update

Upgrade Plugins

zinit update --all

LazyVim (Neovim)

Installation method: mise

Used to manage Neovim plugins and configuration.

Upgrade Plugins

nvim --headless -c '+Lazy! sync' +qa

Homebrew

Installation method: chezmoi/external

Upgrade Packages

--greedy also upgrades casks with :latest or :auto-upgrade.

brew upgrade --greedy

Mise

Main config:

• $HOME/.config/mise/config.toml

Additional configs:

• ~/Works/<name>/mise.toml for work-related config
• ~/Personal/mise.toml for personal-related config

1Password

Installation method: Homebrew (mise for CLI)

This is the core app that ties the configuration together. All secrets and private documents are stored in 1Password.

Alfred

Installation method: Homebrew

• License location: 1Password
• Preference location: iCloud

Setup

1. Enter your license (if any).
2. Enable the permissions requested by the app.
3. Go to Preferences > Advanced > Reveal in Finder.
4. Copy your existing configuration and replace the current one.

TablePlus

Installation method: Setapp

• Connections file: iCloud
• Connection passwords: 1Password

Okta Verify

Installation method: Homebrew

Important: You need your previous device to transfer an account. If your device was reset or sold, use the account recovery method.

Keybase

Installation method: Homebrew

Important: You need your previous device to transfer an account. If your device was reset or sold, use the account recovery method.

Docker

Dotfiles in Docker have a two-stage setup. By default, only Lite Setup is applied. To use full setup, run kdf-setup-full.sh in the Docker instance. See Docker Image for usage.

Verify Docker Image

All Docker images include attestations. You can verify integrity and provenance using the associated cryptographically signed attestations.

Verification output should include:

• Status: ✓ Verification succeeded!
• The repository where the image was created
• The workflow and Git reference used to create the image

Verify Docker Hub Image

# gh attestation verify oci://kamontat/dotfiles:latest --owner kc-workspace
$ gh attestation verify "oci://kamontat/dotfiles:<tag-name>" --owner kc-workspace

...
✓ Verification succeeded!
...

Verify GitHub Container Registry Image

## Add read:packages scope to read images from GHCR
## You may need to log in first: https://cli.github.com/manual/gh_auth_login
$ gh auth refresh --scopes "read:packages"

# gh auth token | docker login "ghcr.io" --username "kamontat" --password-stdin
$ gh auth token | docker login "ghcr.io" --username "<username>" --password-stdin

# gh attestation verify "oci://ghcr.io/kc-workspace/dotfiles:latest" --owner kc-workspace
$ gh attestation verify "oci://ghcr.io/kc-workspace/dotfiles:<tag-name>" --owner kc-workspace

...
✓ Verification succeeded!
...

KDF Helper Scripts

The repository provides helper scripts named kdf-*.sh that should be available to everyone. If you cannot run kdf-*.sh, check your ~/.local/bin directory.

Known Gaps

There are still a few things we cannot automate.

macOS

• Menu bar items: System Settings > Menu Bar > Menu Bar Controls

Contributing

Please refer to the CONTRIBUTING guide.