English | 简体中文
These dotfiles configure my macOS development environment and stay in sync across my Macs with chezmoi. The repository also includes bootstrap scripts for setting up a new Mac.
The full setup targets Apple Silicon Macs. Before installing, compare your macOS major version with the version set checked at the start of main() in the notification script.
Some settings depend on my accounts, GPG keys, and filesystem layout. Adjust them for a different environment.
This repository keeps my Macs in sync, sets up a new Mac, and configures the coding agents I work with: their shared instructions, skills, sandboxes, and guards. It deliberately leaves out:
- Unattended setup: installation needs account sign-ins, interactive prompts, and hardware-backed keys.
- Continuous health checks for provisioned tools: repairing drift in once- or change-triggered setup requires explicit rescheduling.
- Automatic cleanup of retired configuration: existing machines need explicit review and removal.
- One pinned snapshot of the whole environment: tools follow their own declarations and update channels.
- Application runtime state and sign-in sessions, which stay with the applications that write them.
| Area | Start with |
|---|---|
| Agent tooling | dot_agents, dot_claude, dot_codex, private_dot_pi, .chezmoitemplates/agents |
| Git | dot_config/git, .chezmoitemplates/git |
| Repository design | CONCEPTS.md |
| Packages and bootstrap | Brewfile, .chezmoiscripts |
| Shell and applications | dot_zshenv, dot_zprofile, dot_zshrc, dot_zsh, dot_config |
| chezmoi configuration and templates | .chezmoi.toml.tmpl, .chezmoitemplates |
Copy only the parts you need, or fork this repository to adapt the full setup. Before applying a fork, review and adjust .chezmoi.toml.tmpl, Brewfile, and .chezmoiscripts/. The encrypted *.asc files decrypt only with my YubiKey, so replace the ciphertext and the GPG recipients with your own, or remove them along with the parts that use them; the recipients are declared in .chezmoi.toml.tmpl. Some features read credentials from Maskey: create the entries they use in your own Maskey, or switch those features to a similar tool you use. The commands below apply my complete setup; use your fork's repository name when installing your adapted version.
Open Terminal.app on the new Mac and install Apple's Command Line Tools before cloning this repository:
xcode-select --installWait for the installer window to finish, then confirm xcode-select -p and git --version both print something.
Sign in to the App Store before continuing so Brewfile can install its apps under mas's account requirements. Turn on iCloud Keychain for the same Apple Account as your other Macs, so the credentials in Maskey reach this Mac before setup reads them. Keep Terminal.app open to enter private template values, respond to sudo prompts, use your YubiKey when needed, and finish the GitLab sign-in that opens in your browser.
Before running the setup command, grant Terminal.app Full Disk Access in System Settings > Privacy & Security > Full Disk Access for automatic notification preferences. The terminal running later applies needs the same permission; without it, apply stops at the notification step and names the app to turn on. Apps that register for notifications later are configured on the next apply.
Install the full setup with chezmoi's bootstrap command:
sh -c "$(curl -fsLS https://get.chezmoi.io)" -- -b "$(mktemp -d)" init --apply liby-b keeps the bootstrap binary temporary; Brewfile owns the chezmoi installation used and updated afterwards.
If setup fails, resolve the reported error and rerun the same command to continue under chezmoi's script lifecycle.
If chezmoi is already installed, run:
chezmoi init --apply libyAfter setup, run gh auth login: Git uses that sign-in over HTTPS to push to GitHub and to fetch private repositories, and the background upgrade job updates gh extensions only with it.
If you use Rex, install and open it manually, then run setup-rex once from an ordinary Rex pane. Rex settings that chezmoi apply writes take effect after you reopen the app.
Use chezmoi's daily workflow to edit and apply managed files. When troubleshooting this repository's bootstrap, run chezmoi apply -v to stream each script step's full output.
Editing encrypted files requires a YubiKey and should not be delegated to an agent.
When updating an existing Mac or merging upstream into a fork, review commits since the version last applied on that machine for retired paths and fields. Check their current contents before removing them, keeping any local changes you still need. Applying the new source does not clean up all retired configuration, even when chezmoi status is empty.
If .chezmoi.toml.tmpl changed, run chezmoi init before applying to regenerate this machine's configuration.
Before changing this repository, read AGENTS.md for repository-specific workflows, safety boundaries, and validation rules. Open an issue to report a problem or a pull request to propose a change.