dotfiles

Managed with chezmoi. Secrets injected via Bitwarden CLI at apply time. System provisioning (brew tools, flatpaks, backup, desktop, distroboxes) is handled by mise tasks, triggered automatically by chezmoi apply.

A systemd user timer (chezmoi-check) sends a desktop notification when upstream dotfile changes are available.

Fresh install

Bluefin-DX is not a separate ISO. Download the standard Bluefin ISO from projectbluefin.io, install it, then switch to DX on first boot:

ujust rebase-helper

Select bluefin-dx → stable, confirm, and reboot. After reboot, Homebrew is pre-installed (mise is installed by the first apply). Install chezmoi, and the pinned Bitwarden CLI: bw unlock --raw is broken in 2026.3+, so do not use the brew version (the bw-cli task keeps the pinned one in place afterwards, see below):

brew install chezmoi
BW=2026.1.0; mkdir -p ~/.local/bin; cd "$(mktemp -d)"
curl -fsSL "https://github.com/bitwarden/clients/releases/download/cli-v$BW/bw-linux-$BW.zip" -o bw.zip
unzip -q bw.zip && install -m 755 bw ~/.local/bin/bw

Log in to Bitwarden and unlock:

bw login <e-mail>
export BW_SESSION="$(bw unlock --raw)"

Apply everything: dotfiles and full system provisioning. The repo is public, so the initial clone needs no credentials. SSH keys are restored from the restic backup during provisioning and the chezmoi remote switches to SSH automatically.

chezmoi init --apply "https://code.aves-it.eu/nivo/dotfiles.git"

Open a new terminal. Done.

Day-to-day sync

bwu              # unlock Bitwarden (alias from .bash_aliases)
chezmoi update   # pull from repo + apply dotfiles + re-run provisioning if anything changed

To run a specific provisioning task manually (mise tasks lists them; chezmoi apply prints the list too):

mise run setup                   # run all tasks
mise run brew-bundle             # just brew tools
mise run flatpaks                # just flatpaks
mise run resticprofile-schedule  # reschedule backup (e.g. after changing profiles.yaml)
mise run dconf-restore           # reapply GNOME settings

What chezmoi manages

File/Dir	Notes
~/.bashrc	Fedora base, brew, mise activation, aliases, kubectl and k8s tool completion, pyenv, krew, direnv, starship
~/.bash_aliases	Bitwarden shortcuts (bwu, bwl); sources the customer overlay if present
~/.gitconfig	Git identity, push defaults
~/.ssh/config	Includes the customer overlay's hosts, plus the devpod entry
~/.config/starship.toml	Prompt: git, devops modules (k8s, terraform, direnv, ...), SSH hostname
~/.config/resticprofile/profiles.yaml	Backup schedule; AWS keys from Bitwarden (private_ source, written 0600)
~/.config/resticprofile/restic-password, restic_excludes	Repo password from Bitwarden; paths to skip
~/.config/monitors.xml	Monitor layouts, create-only (see Monitors)
~/.led_battery_monitor_settings.json	LED battery monitor config
~/.gnupg/gpg.conf, gpg-agent.conf	GPG settings
~/.mutt/, ~/.muttrc	mutt; the mailbox list comes from ~/.private-host/mailboxes
~/.config/direnv/direnvrc	direnv config
~/.config/mise/config.toml	mise tool versions and the customer task include
~/.config/mise/tasks/	Provisioning tasks (see below)
~/.config/distrobox/	Containerfiles for the platform-dev and ai-tools boxes
~/.config/containers/systemd/	Quadlets for the local model and vector-store services behind mem0
~/.config/mem0/server.py, mcp.json	mem0 memory server (MCP, runs in ai-tools) and the MCP client config that points to it
~/.config/systemd/user/	chezmoi-check service + timer, resticprofile-failure-notify@
~/.local/bin/	bootstrap-distrobox, bootstrap-devcontainer, chezmoi-check, dconf-restore, mem0-mcp, customer-secrets

Not managed: SSH private keys (restored by ssh-keys), Thunderbird and browser profiles, and the backup timers (resticprofile generates those; resticprofile-schedule patches them).

Monitors

dot_config/create_monitors.xml uses chezmoi's create_ prefix: it is written to ~/.config/monitors.xml only when that file does not exist, and never overwritten. GNOME rewrites the file whenever you change the display settings, so a managed copy would be reverted on every apply (and would revert your changes).

It seeds three layouts for the laptop's built-in panel (eDP-1): alone, with the Dell U2718Q, and with the LG IPS QHD.

To change the seed, copy the file GNOME wrote:

cp ~/.config/monitors.xml "$(chezmoi source-path)/dot_config/create_monitors.xml"
chezmoi git add dot_config/create_monitors.xml && chezmoi git commit -m "Update monitor layouts" && chezmoi git push

To re-seed a machine from the repo, delete ~/.config/monitors.xml and run chezmoi apply.

What mise provisions

Task	What it does	Re-runs when
brew-bundle	brew bundle from Brewfile (kubelogin, onedrive-cli, restic, resticprofile)	Brewfile changes
bw-cli	Installs the pinned Bitwarden CLI into ~/.local/bin (version in .chezmoitemplates/bw-version), removing the brew one	The task or the version changes
flatpaks	Install user flatpaks, add eduvpn remote	flatpaks.txt changes
ssh-keys	Restore SSH keys from the restic backup, then switch the chezmoi remote to SSH	The task changes
resticprofile-schedule	resticprofile schedule --all + patch service (retry + failure notify) + enable timers	profiles.yaml/Brewfile changes
dconf-restore	dconf load from dconf-dump.ini	dconf-dump.ini changes
assistant-cli	Install the coding assistant CLI	The task changes
setup	Runs all of the above

Two more scripts run on change without a task of their own: the chezmoi-check timer is enabled when its unit or script changes, and mise itself is installed to ~/.local/bin on first apply (a brew-installed mise is invisible inside distroboxes, which share ~/.local/bin).

Distroboxes

Box	Image	Purpose
platform-dev	localhost/avesit-platform-dev, built from Containerfile.platform-dev	Infra toolchain (tofu, packer, tflint, sops, talosctl, flux, kustomize, kubeconform, kubectl-cnpg, argocd, yq, age, ...). Rebuilt when the Containerfile changes. The binaries are exported to ~/.local/bin on the host
ai-tools	localhost/ai-tools, built from Containerfile.ai-tools	Runs the mem0 memory server, which any MCP client can use; backed by the local model and vector-store quadlets

Tool versions in the Containerfiles carry # renovate: comments and are bumped by Renovate. Customer boxes are built on the platform-dev image too (see below).

Managing brew tools

brew install <tool>
brew bundle dump --force --file="$(chezmoi source-path)/Brewfile"
chezmoi git add Brewfile && chezmoi git commit -m "Add <tool>" && chezmoi git push

Next chezmoi update will re-run mise run brew-bundle automatically.

Managing flatpaks

Edit flatpaks.txt in the chezmoi source dir, commit, push. Next chezmoi update will install the new flatpak automatically.

Updating the dconf snapshot

dconf dump / > "$(chezmoi source-path)/dconf-dump.ini"
chezmoi git add dconf-dump.ini && chezmoi git commit -m "Update dconf snapshot" && chezmoi git push

Bitwarden items required

Item name	Fields	Purpose
resticprofile-hetzner-s3	username = AWS_ACCESS_KEY_ID, password = AWS_SECRET_ACCESS_KEY	Hetzner S3 credentials
resticprofile-hetzner-repo	password	restic repo encryption password

Customer boxes and private overlays

One source serves the host and every customer box. A customer box is a chezmoi run with data.customer set (~/projects/<codename>/chezmoi.toml for a distrobox, chezmoi init --promptString customer=<codename> on a bare machine). In that mode .chezmoiignore.tmpl is a fail-closed allowlist, so a new file reaches a box only when it is allowlisted on purpose. Customer-specific content is never in this repo; the generic files include it from a private repo:

Where	Private repo	Extension points
Host: ~/.customers	nivo/dotfiles-customers	host-overlay/bash_aliases (sourced by .bash_aliases), host-overlay/ssh-config (included first in ~/.ssh/config), host-overlay/mise-tasks/ (mise task_config.includes)
Host: ~/.private-host	nivo/dotfiles-private-data	host data that does not belong here
Box: ~/.private	nivo/dotfiles-private-<codename>	ssh-config-fragment (included by ~/.ssh/config), mise.toml (linked as ~/.mise.toml), extra-packages and post-provision (bare machines)

All of these are optional: a missing file or repo is skipped. A box only ever clones its own customer repo, never dotfiles-customers, so no box sees another customer's data.