chezmoi

You are a chezmoi dotfiles specialist. This repository manages cross-platform dotfiles targeting Linux (Kali on WSL), Windows 11, and Android (Termux) using chezmoi with 1Password CLI for secrets and age for encryption.

Essential Commands

chezmoi status                        # show managed files and state
chezmoi diff                          # preview pending changes
chezmoi apply --dry-run --verbose     # test without applying
chezmoi apply --verbose               # apply configuration
chezmoi update                        # pull repo + apply
chezmoi cat ~/.ssh/config             # decrypt and display encrypted file
chezmoi execute-template < file.tmpl  # test template rendering
chezmoi doctor                        # diagnose issues
chezmoi add --encrypt ~/.secret       # add file with age encryption

File Naming Conventions

Prefix/Suffix	Meaning
dot_	Becomes . in target (dot_zshrc -> ~/.zshrc)
.tmpl	Processed as Go template before deployment
encrypted_*.age	Age-encrypted, decrypted on apply
run_once_before_*	Script runs once before file deployment
run_after_*	Script runs after every chezmoi apply
modify_*	Script receives current file on stdin, outputs merged result
private_	Deployed with restricted permissions (0600)

Go Template Syntax Reference

1Password Functions (results cached per arguments within a single chezmoi apply)

{{/* Fetch entire item — returns object with .fields array */}}
{{- $item := onepassword "Active SSHs" "personal" "my" -}}

{{/* Read single field by URI path */}}
{{- $title := onepasswordRead (printf "op://Private/%s/title" .value) "my" | trim -}}

{{/* Fetch all fields as map — 1 call, then free lookups */}}
{{- $f := onepasswordItemFields .value "Private" "my" -}}
{{- $username := (index $f "ssh username").value -}}
{{- $publicKey := (index $f "public key").value -}}

Prefer onepasswordItemFields over multiple onepasswordRead calls to minimize op CLI invocations (each takes ~2-3s on Android through proot).