Felipe M.
54965e17aa
Registering the first Mac surfaced problems that would have hit every future one, not just this machine: metapac keys off a raw gethostname(), which on macOS carries the mDNS ".local" suffix, while the registry is keyed by chezmoi's .chezmoi.hostname, which stops at the first dot. A bare key never matched and metapac refused to run at all. config.toml.tmpl now emits each host twice, bare and ".local", so nothing in the registry has to declare which machines are Macs; the spare key is inert elsewhere. chezmoi was rewriting ~/Library from 0700 to 0755 on every apply, loosening a directory macOS deliberately closes. Both levels now carry the private_ prefix. dot_gitconfig.tmpl would have destroyed real config on adoption: the git-lfs filters, seven aliases, diff.noprefix, rerere and the gh credential helper. All folded in. The lfs block and the GitHub helper are lookPath-gated like the signing block -- lfs filters run on every checkout and abort wholesale when the binary is missing, so asserting them unconditionally breaks a minimal box rather than degrading. gh's path comes from lookPath, not a hardcoded /opt/homebrew/bin/gh. Laugh-Tale takes common + a new darwin group, the macOS counterpart to archlinux.toml, holding only the tooling a backend needs. Its baseline captures 325 packages, 24 taps and 21 App Store apps -- without it `metapac clean` would offer to remove every one of them. Verified on Laugh-Tale: chezmoi status clean after apply, ~/Library still 0700, `metapac unmanaged` reports nothing, `metapac sync` is a no-op, and the status line renders correctly under macOS bash 3.2. Shared groups are still arch-only, so this host draws nothing from common yet; that gap is documented, not closed. Claude-Session: https://claude.ai/code/session_01BvpSVPsLrUK4N53LVTofR8
81 lines
2.8 KiB
Go Template
81 lines
2.8 KiB
Go Template
# Generated by chezmoi from home/dot_gitconfig.tmpl -- do not edit by hand.
|
|
|
|
{{/* 1Password ships the SSH signer at a different path per platform. Signing is
|
|
enabled only where that binary actually exists, so a machine without the
|
|
1Password desktop app (or with only the CLI) gets a working git rather than
|
|
one that fails on every commit. */}}
|
|
{{- $signer := "/opt/1Password/op-ssh-sign" -}}
|
|
{{- if eq .chezmoi.os "darwin" -}}
|
|
{{- $signer = "/Applications/1Password.app/Contents/MacOS/op-ssh-sign" -}}
|
|
{{- end -}}
|
|
{{- $canSign := and (stat $signer) (ne .user.signingkey "") -}}
|
|
|
|
[user]
|
|
name = {{ .user.name | quote }}
|
|
email = {{ .user.email | quote }}
|
|
{{- if $canSign }}
|
|
signingkey = {{ .user.signingkey | quote }}
|
|
{{- end }}
|
|
|
|
[alias]
|
|
br = branch
|
|
cane = commit --amend --no-edit
|
|
co = checkout
|
|
d = diff
|
|
fp = !git fetch --all --prune && git pull --ff-only
|
|
last = log -1 HEAD
|
|
lo = log --oneline -n 10
|
|
pr = pull --rebase
|
|
s = status
|
|
|
|
[diff]
|
|
noprefix = true
|
|
|
|
# Remember conflict resolutions and replay them the next time the same conflict
|
|
# shows up -- pays for itself on long-lived branches and repeated rebases.
|
|
[rerere]
|
|
enabled = true
|
|
|
|
{{ if $canSign -}}
|
|
# Commits are signed with an SSH key held in 1Password. op-ssh-sign talks to the
|
|
# desktop app over its agent socket, so the private key never touches disk.
|
|
[commit]
|
|
gpgsign = true
|
|
|
|
[gpg]
|
|
format = ssh
|
|
|
|
[gpg "ssh"]
|
|
program = {{ $signer | quote }}
|
|
allowedSignersFile = {{ printf "%s/.config/git/allowed_signers" .chezmoi.homeDir | quote }}
|
|
{{- else }}
|
|
# No 1Password SSH signer found at {{ $signer }} on this machine, so commit
|
|
# signing is left off rather than configured to fail.
|
|
{{- end }}
|
|
|
|
{{ if lookPath "git-lfs" -}}
|
|
# Written by `git lfs install`; kept here so a fresh machine gets it from the
|
|
# same place as everything else. Only asserted where git-lfs is actually
|
|
# installed -- these filters abort every checkout if the binary is missing.
|
|
[filter "lfs"]
|
|
clean = git-lfs clean -- %f
|
|
smudge = git-lfs smudge -- %f
|
|
process = git-lfs filter-process
|
|
required = true
|
|
|
|
{{ end -}}
|
|
{{ $gh := lookPath "gh" -}}
|
|
{{ if $gh -}}
|
|
# GitHub auth is delegated to the gh CLI's own token store. The empty `helper`
|
|
# first resets any helper inherited from the system config, so the credential
|
|
# stack cannot fall back to a keychain entry that has gone stale.
|
|
{{ range $host := list "https://github.com" "https://gist.github.com" -}}
|
|
[credential {{ $host | quote }}]
|
|
helper =
|
|
helper = {{ printf "!%s auth git-credential" $gh | quote }}
|
|
{{ end }}
|
|
{{- end -}}
|
|
# git.nakama.town credentials come from 1Password at auth time via
|
|
# home/dot_local/bin/executable_git-credential-op -- see README.md.
|
|
[credential "https://git.nakama.town"]
|
|
helper = "!GIT_CREDENTIAL_OP_REF=op://Private/git.nakama.town {{ .chezmoi.homeDir }}/.local/bin/git-credential-op"
|