Felipe M.
54de7ea4a8
Aliases: co for checkout, fp to fetch all remotes with prune then fast-forward-only pull. Signing uses an SSH key held in 1Password rather than GPG. 1Password has no GPG agent and ships only op-ssh-sign, so SSH signing is what it actually supports; git has handled it since 2.34 and the Forgejo instance verifies it. The private key never touches disk -- op-ssh-sign talks to the desktop app over its agent socket. Only the public half is committed. The signing block is emitted only where the signer binary exists, checked with stat at apply time and resolved per-OS. A machine with just the 1Password CLI gets signing off rather than a git that fails on every commit, and no per-host field has to be kept in sync. allowed_signers is managed too, so `git log --show-signature` can verify our own commits locally instead of reporting an unknown key. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
39 lines
1.6 KiB
Go Template
39 lines
1.6 KiB
Go Template
{{/*
|
|
Renders ~/.config/chezmoi/chezmoi.toml on `chezmoi init`.
|
|
|
|
Its job is to refuse to set up a machine that isn't in the registry -- the
|
|
baseline package group keyed on hostname would otherwise be missing, and
|
|
`metapac clean` on a host with no baseline offers to uninstall the OS.
|
|
|
|
Per-host data itself is not re-exported here. Templates that need it read
|
|
the registry directly:
|
|
|
|
{{ $me := index .hosts .chezmoi.hostname }}
|
|
{{ $me.groups }}
|
|
|
|
and OS branching uses chezmoi's own detection -- .chezmoi.os,
|
|
.chezmoi.osRelease.id, .chezmoi.arch -- rather than anything hand-declared.
|
|
|
|
.chezmoidata is not in scope for the config template, so read it directly.
|
|
*/}}
|
|
{{- $hosts := (include ".chezmoidata/hosts.toml" | fromToml).hosts -}}
|
|
{{- $hostname := .chezmoi.hostname -}}
|
|
{{- if not (hasKey $hosts $hostname) -}}
|
|
{{- fail (printf "unknown host %q -- add a [hosts.%s] entry to home/.chezmoidata/hosts.toml first" $hostname $hostname) -}}
|
|
{{- end -}}
|
|
|
|
# Generated by chezmoi from home/.chezmoi.toml.tmpl -- do not edit by hand.
|
|
|
|
[data.user]
|
|
name = "Felipe M."
|
|
email = "me@fmartingr.com"
|
|
|
|
# Public half of the SSH key used to sign commits. Not a secret -- the private
|
|
# half never leaves 1Password. Swap this one line to rotate the signing key.
|
|
signingkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMkU++/bJGjr1s04fBncoAdwbTZCJjnRyaMKTYeN2KSN"
|
|
|
|
# Secrets come from 1Password via the `onepasswordRead` / `onepassword` template
|
|
# functions; the CLI is expected on PATH and signed in. See README.md.
|
|
[onepassword]
|
|
command = "op"
|
|
mode = "account"
|