dotfiles

My Arch Linux configuration, managed with chezmoi.

Overview

Principles

• Wayland only. No X server, no display manager. Sway starts from exec sway at the end of the zsh login shell on TTY1 (autologin via a host-local getty@tty1 drop-in that's deliberately gitignored).
• XDG everywhere. Every tool is pushed to $XDG_CONFIG_HOME / $XDG_CACHE_HOME / $XDG_DATA_HOME — ~ stays clean. Zsh itself lives under $XDG_CONFIG_HOME/zsh, bootstrapped by a single-line dot_zshenv.
• sudo-rs, not the C sudo. Memory-safe Rust rewrite, drop-in CLI compatible. Same one that Ubuntu 25.10 ships as default.
• GPG for everything signable. Commits and tags are signed; the same GPG agent also serves SSH authentication — one key, one cache, one PIN entry.
• Secrets via pass. API keys and tokens are pulled into env vars at shell init; nothing is committed.
• Plain-text over configuration-as-code. Packages and enabled units are tracked as one-per-line .txt files in meta/ and systemd-units/, diffed against pacman -Qeq and systemctl list-unit-files. No DSL, no state file.
• Fresh-install reproducible. A single curl | sh on a base Arch system yields the full desktop.

The stack

Keybinds are documented in KEYBINDS.md.

Bootstrap on a fresh Arch install

bootstrap.sh assumes the Arch installation guide has been followed up to the point of having a booted system with a wheel-group user. On a minimal system (only base installed), prepare the user once as root:

pacman -S --needed sudo
useradd -m -G wheel -s /bin/bash <user>
passwd <user>

Then log in as that user and run:

curl -fsSL https://raw.githubusercontent.com/sommerfelddev/dotfiles/master/bootstrap.sh | sh

The script installs pacman prerequisites, enables %wheel in sudoers, builds paru-bin from the AUR, clones this repo to ~/dotfiles, runs just init, enables recommended systemd units (fstrim, timesyncd, resolved, reflector, paccache, pkgstats, acpid, cpupower, iwd, plus tlp on laptops), refreshes the pacman mirrorlist, and creates XDG user directories. On EFI systems missing an Arch boot entry, it prints the efibootmgr command to register the UKI (run after your first mkinitcpio -P).

Setup on an existing system

chezmoi init --source ~/dotfiles
chezmoi apply -v

Layout

Everything is driven by just recipes against four parallel models:

Recipes at a glance

Run just or just --list for the full menu. Recipes follow a DOMAIN-VERB scheme across four domains (dotfiles, etc, pkg, unit) with chezmoi-aligned verbs (add, forget, re-add, apply, diff, merge, status). Top-level dispatchers sniff argument shape and delegate.

fmt / check-fmt / lint cover: Lua (stylua, selene), shell (shfmt, shellcheck), Python (ruff), TOML (taplo), justfile (just --fmt), plus Markdown/JSON/YAML/CSS (prettier). Each accepts either no argument (whole repo) or a single file path.

Drift workflow

Four sources of drift are tracked independently and combined by just status:

• Dotfiles (just dotfiles-status): live $HOME files differ from the repo. Resolve with just apply (repo → home), just re-add PATH (home → repo), just diff PATH, or just merge PATH.
• Packages (just pkg-status): installed but undeclared, or declared but missing. Resolve by adding to a meta/ group (just add GROUP PKG) or uninstalling.
• /etc (just etc-status / just etc-diff): repo-tracked files in etc/ that differ from or are missing on the live /etc. Resolve with just etc-apply (repo → live), just etc-re-add PATH (live → repo), or just etc-untrack PATH.
• Units (just unit-status): enabled units not in any systemd-units/{system,user}/*.txt, or declared units that aren't enabled (checked for both scopes).

Firewall

Stateful nftables firewall with a laptop profile: default-deny inbound, allow outbound, loopback + established + ICMP/ICMPv6 + DHCPv6 client only. Ruleset at etc/nftables.conf; enabled via nftables.service in systemd-units/system.txt. Kernel hardening (rp_filter, no redirects, no source-route, log_martians) lives in etc/sysctl.d/99-sysctl.conf.

The ruleset is scoped to table inet filter and uses destroy table inet filter on reload, so podman/netavark's own tables are preserved. Don't systemctl stop nftables — the package ExecStop runs a global nft flush ruleset which would nuke podman rules. Reload with sudo systemctl reload nftables or sudo nft -f /etc/nftables.conf instead.

Verify with sudo nft list ruleset.

Git hooks

The user-level hooks at ~/.config/git/hooks/ (set as core.hooksPath in dot_config/git/config) apply globally and auto-dispatch into the repo's hooks if present. Lookup order, first wins:

1. <git-dir>/hooks/<name> — the classic untracked per-clone location (where husky / lefthook / pre-commit install by default). Use this to replace a tracked hook on a shared repo without affecting teammates.
2. <repo-top>/.githooks/<name> — the project's tracked, shared hook.

Projects opt in by just dropping a file at .githooks/<name> — no core.hooksPath override, no passthrough stubs. Per-event behavior:

• pre-commit → repo's .githooks/pre-commit (if any). No global logic. In this repo: just check.
• commit-msg → repo's .githooks/commit-msg (if any), then strips any Co-authored-by: whose identity matches an AI agent (Copilot/Claude/Codex/…) so they don't trip the push gate.
• pre-push → repo's .githooks/pre-push (if any), then rejects pushes that contain unsigned commits, commits with a foreign committer, or commits authored/co-authored by an AI agent.
• post-commit → repo's .githooks/post-commit (if any). No global logic. In this repo: chezmoi apply.

Bypass any of these with --no-verify on commit/push.

Disaster recovery

The repo is enough to rebuild a machine's tooling and configuration, but not its state — back these up externally:

• GPG master key and subkeys (gpg --export-secret-keys, gpg --export-ownertrust). The agent also handles SSH auth, so this restores both.
• ~/.password-store/ — the pass store that feeds API keys/tokens into the shell at login.
• SSH private keys under ~/.ssh/id_* (only .pub / config is in the repo).
• LibreWolf profile data (bookmarks, history, extension state) at ~/.var/app/io.gitlab.librewolf-community/.librewolf/ — only the hardening policy lives in firefox/.
• Thunderbird profile data (accounts, calendars, OpenPGP keys) at ~/.var/app/org.mozilla.thunderbird/.thunderbird/ — only non-private prefs live in thunderbird/.

Recovery on a fresh install: run bootstrap.sh, then gpg --import + pass init <KEYID>, restore ~/.password-store/, drop SSH private keys into ~/.ssh/, restore the LibreWolf and Thunderbird profiles, and run once:

xdg-mime default org.mozilla.thunderbird.desktop x-scheme-handler/mailto