dotfiles

-set shell := ["nu", "--commands"]

-

-default:

- @just --list

-

-# initialize crypto, install hooks, verify, link dorkfiles into HOME

-link:

- java bootstripper.java bootstrap

-

-# compile checked-in Quickshell shaders from source

-nugu-shaders:

- mkdir quickshell/nuguland/shaders

- /usr/lib/qt6/bin/qsb --glsl 330 --hlsl 50 --msl 12 -o quickshell/nuguland/shaders/aurora.frag.qsb quickshell/nuguland/shaders/aurora.frag

-

-# verify crypto filters, hooks, and staged secrets

-check:

- java bootstripper.java check

-

-clean:

- java bootstripper.java clean

-

-# run the same checks as the Git pre-commit hook

-pre-commit:

- java bootstripper.java pre-commit

-

-# integration test in ephemeral rootless Podman Linux; fresh system deps: git + java

-# tests every *.symlinks manifest; primary hostname printed first for quick failure context

-test hostname="desktop":

- #!/usr/bin/env bash

- set -euo pipefail

-

- root="$(git rev-parse --show-toplevel)"

- key="$root/.git/dotfiles-aes.key"

- image="registry.fedoraproject.org/fedora:latest"

- container="dotfiles-integration-$(date +%Y%m%d%H%M%S)-$$"

-

- if [ ! -r "$key" ]; then

- echo "missing $key"

- exit 1

- fi

-

- trap 'podman rm -f "$container" >/dev/null 2>&1 || true' EXIT

-

- echo "container=$container"

- podman run --name "$container" --rm -i --hostname "{{hostname}}" \

- -e PRIMARY_HOSTNAME="{{hostname}}" \

- -v "$root:/src:ro" \

- -v "$key:/dotfiles-aes.key:ro" \

- "$image" bash -s <<'CONTAINER'

- set -euo pipefail

-

- ok() { echo "ok:$1"; }

- fail() { echo "FAIL:$1"; exit 1; }

-

- target_path() {

- local home="$1"

- local target="$2"

- if [[ "$target" == ~* ]]; then

- printf '%s%s\n' "$home" "${target:1}"

- else

- printf '%s\n' "$target"

- fi

- }

-

- targets_for() {

- awk '

- { sub(/\r$/, "") }

- NF == 0 { next }

- source == "" { source = $0; next }

- { print $0; source = "" }

- END { if (source != "") exit 2 }

- ' "$1"

- }

-

- run_manifest() {

- local host="$1"

- local manifest="$host.symlinks"

- local home="/tmp/home-$host"

- local bootstrap_log="/tmp/bootstrap-$host.log"

- local check_log="/tmp/check-$host.log"

- local clean_log="/tmp/clean-$host.log"

-

- echo "manifest=$manifest"

- rm -rf "$home"

- mkdir -p "$home"

-

- HOSTNAME="$host" java -Duser.home="$home" bootstripper.java bootstrap >"$bootstrap_log" 2>&1 || {

- echo "FAIL:bootstrap:$host"

- tail -120 "$bootstrap_log"

- exit 1

- }

- ok "bootstrap:$host"

-

- HOSTNAME="$host" java -Duser.home="$home" bootstripper.java check >"$check_log" 2>&1 || {

- echo "FAIL:check:$host"

- cat "$check_log"

- exit 1

- }

- ok "check:$host"

-

- while IFS= read -r target; do

- local path

- path="$(target_path "$home" "$target")"

- test -L "$path" || fail "link:$host:$target"

- done < <(targets_for "$manifest")

- ok "links:$host"

-

- HOSTNAME="$host" java -Duser.home="$home" bootstripper.java clean >"$clean_log" 2>&1 || {

- echo "FAIL:clean:$host"

- cat "$clean_log"

- exit 1

- }

- ok "clean:$host"

- }

-

- fresh_crypto_smoke() {

- local repo=/tmp/fresh-crypto

- rm -rf "$repo" /tmp/fresh-crypto-home

- mkdir -p "$repo/tools" /tmp/fresh-crypto-home

- cp bootstripper.java "$repo/"

- cp tools/aes.java "$repo/tools/"

- cd "$repo"

- git init --quiet

- printf 'secret.txt\n' > .secrets

- printf 'dummy.txt\n~/dummy.txt\n' > mini.symlinks

- printf 'not a real secret\n' > secret.txt

- printf 'dummy\n' > dummy.txt

-

- DOTFILES_AES_PASSPHRASE=test java bootstripper.java init-crypto >/tmp/fresh-init.log 2>&1 || { cat /tmp/fresh-init.log; fail fresh-init; }

- DOTFILES_AES_PASSPHRASE=test java bootstripper.java check >/tmp/fresh-check-1.log 2>&1 || { cat /tmp/fresh-check-1.log; fail fresh-check-1; }

- git add .dotfiles-aes-salt .secrets bootstripper.java tools/aes.java mini.symlinks dummy.txt secret.txt

- DOTFILES_AES_PASSPHRASE=test java bootstripper.java check >/tmp/fresh-check-2.log 2>&1 || { cat /tmp/fresh-check-2.log; fail fresh-check-2; }

- git show :secret.txt | head -c 6 | grep -qx DFAES1 || fail fresh-staged-encrypted

- HOSTNAME=mini DOTFILES_AES_PASSPHRASE=test java -Duser.home=/tmp/fresh-crypto-home bootstripper.java bootstrap >/tmp/fresh-bootstrap.log 2>&1 || { cat /tmp/fresh-bootstrap.log; fail fresh-bootstrap; }

- test -L /tmp/fresh-crypto-home/dummy.txt || fail fresh-link

- HOSTNAME=mini DOTFILES_AES_PASSPHRASE=test java -Duser.home=/tmp/fresh-crypto-home bootstripper.java clean >/tmp/fresh-clean.log 2>&1 || { cat /tmp/fresh-clean.log; fail fresh-clean; }

- ok fresh-crypto

- }

-

- printf 'rootless='

- awk 'NR == 1 { print ($1 == 0 && $2 != 0) ? "yes" : "unknown" }' /proc/self/uid_map

-

- if ! dnf -qy --setopt=install_weak_deps=False install git-core java-latest-openjdk-headless >/tmp/dnf.log 2>&1; then

- cat /tmp/dnf.log

- fail deps

- fi

- ok deps

- git --version

- java -version 2>&1 | sed -n '1p'

-

- mkdir -p /root/work

- git config --global --add safe.directory /src

- git clone --quiet --no-local /src /root/work/dotfiles || fail clone

- install -m 600 /dotfiles-aes.key /root/work/dotfiles/.git/dotfiles-aes.key

- cd /root/work/dotfiles

-

- java bootstripper.java install-hooks >/tmp/install-hooks.log 2>&1 || { cat /tmp/install-hooks.log; fail install-hooks; }

- test -x .git/hooks/pre-commit || fail hook-executable

- grep -qx 'exec java bootstripper.java pre-commit' .git/hooks/pre-commit || fail hook-content

- ok install-hooks

-

- git show HEAD:nushell/secrets.nu | head -c 6 | grep -qx DFAES1 || fail committed-encrypted

- ok committed-encrypted

-

- mapfile -t hosts < <(find . -maxdepth 1 -name '*.symlinks' -printf '%f\n' | sed 's/\.symlinks$//' | sort)

- printf 'primary-manifest=%s.symlinks\n' "$PRIMARY_HOSTNAME"

- printf 'manifests=%s\n' "${hosts[*]}"

-

- for host in "${hosts[@]}"; do

- run_manifest "$host"

- done

- ok "symlink-manifests:${#hosts[@]}"

-

- if head -c 6 nushell/secrets.nu | grep -qx DFAES1; then

- fail worktree-still-encrypted

- fi

- ok worktree-decrypted

-

- java bootstripper.java pre-commit >/tmp/precommit.log 2>&1 || { echo FAIL:pre-commit; cat /tmp/precommit.log; exit 1; }

- ok pre-commit

-

- fresh_crypto_smoke

-

- echo RESULT:ok

- CONTAINER

-

-# create initial crypto salt

-init-crypto:

- java bootstripper.java init-crypto

-

-# install Git hooks

-hooks:

- java bootstripper.java install-hooks

-

-# remove links to dorkfiles from HOME

-unlink:

- java bootstripper.java clean

-

-# typically the initial git remote for the dotfiles repo is https

-# this command changes the remote to ssh

-ssh-remote:

- git remote rm origin

- git remote add origin git@github.com:bugabinga/dotfiles.git

- git fetch

- git branch --set-upstream-to=origin/trunk trunk

-

-# initial setup: link dotfiles, fix permissions

-setup: link fix_permissions

-

-# install previously exported winget apps. see topgrade config for exports.

-import_winget:

- winget import C:/Users/okr/Tools/winget_installed_apps.json

-

-# fix some file permissions

-fix_permissions:

- let firefox_profile = ('~/.mozilla/firefox/qrza8u52.default-release' | path expand); if ($firefox_profile | path exists) { chmod 700 $firefox_profile }