d o t s

I prefer things that work OOTB™. The best config is no config.

Install

git clone <this repo> ~/dot
chezmoi init --source=~/dot --apply

That is the whole bootstrap, on macOS (Apple Silicon) and on a headless Fedora box. It installs packages, compiles the terminfo entry, deploys the config, sets up git, and installs the tmux plugins. DOT_SKIP_PACKAGES=1 skips the package step.

How deployment works. .chezmoiroot points chezmoi at home/, so only what lives under that directory is ever written to $HOME — everything else here is repo-only and cannot leak out by being forgotten in an ignore file.

Two kinds of thing live under home/:

• symlink entries (most of it) — home/**/symlink_*.tmpl are one-line files whose content is a path back into this repo. chezmoi turns each into a symlink, so ~/.config/fish, ~/.config/nvim, ~/.claude/*, ~/.codex/* and friends point straight at the checkout. Editing them edits the repo, exactly as before chezmoi existed.
• managed files (six of them) — small, static files no application ever rewrites: the vivid theme, yazi.toml, hammerspoon's init.lua, .profile, the ghostty config, the MacDown stylesheet. These get copied into place.

The split is deliberate. Anything an application writes to itself stays a symlink, because rendering it would turn every Codex [projects.*] entry, every Karabiner GUI change, and every /config write into drift that the next chezmoi apply would revert. Never add exact_ to a fish, claude or codex directory — it would delete secrets.fish, auth.json, and the session archives.

Machine-specific paths are resolved at runtime rather than templated: $HOME -relative paths, test -d guards, type -q, and tmux if-shell. The same files work on both machines, which is why almost nothing here needs to be a template.

macOS apps

• ghostty - the terminal; truecolor, fast, and it stays out of the way. tmux does the multiplexing (see .config/tmux/)
• karabiner - do useful things like map ctrl+hjkl to arrow keys
• hammerspoon - app-scoped automation past what Karabiner can remap: event taps, timers, focused UI inspection
• secretive - SSH keys in the Secure Enclave, via a custom $SSH_AUTH_SOCK
• NepTunes - lastfm scrobbler for use with Apple Music
• Ice - hide menu bar items

more stuff in Brewfile, which is grouped by purpose and is the single source of truth for what gets installed — brew bundle check --file=Brewfile --verbose reports anything that has drifted.

Shared agent sources

Reusable agent skills and common helpers live in agents/. The compatibility path ~/.agents is a symlink to this tracked source; runtime directories keep only their adapters and generated state.

Codex

Codex CLI config is tracked under codex/. The live ~/.codex paths for AGENTS.md, config.toml, hooks.json, keybindings.json, rules/, browser/config.toml, and skills/ are symlinked back into this repo by chezmoi. (computer-use/ is tracked but not deployed.)

Runtime state stays outside git: auth files, SQLite databases, sessions, history, logs, plugin caches, app bundles, temp files, dependency directories such as skill virtualenvs, and skills/.system/ — the skills Codex ships and overwrites itself, which are an installed payload rather than configuration.

Two files are configuration and runtime state at once, because Codex writes both kinds into the same place and offers no include mechanism. Each gets a git clean filter, so the working tree keeps everything Codex needs while git stores only the deliberate part:

File	Filter	Strips
codex/config.toml	scripts/codex-config-clean.py	[projects.*] trust blocks, notice flags, version stamps
codex/rules/default.rules	scripts/codex-rules-clean.py	learned approvals scoped to one command, worktree, or PR

Both filter commands are per-clone git config and cannot be committed; home/.chezmoiscripts/run_onchange_after_50-git.sh installs them. Without them git stores the files verbatim — noisy, not broken. The rules filter never drops a non-allow rule: dropping a deny would loosen the sandbox in a fresh clone.

Claude Code

Claude Code config is tracked under claude/. The live ~/.claude paths for CLAUDE.md, settings.json, statusline.sh, and skills/ are symlinked back into this repo.

Runtime state stays outside git and untouched in ~/.claude: projects/ (including auto-memory), sessions/, history.jsonl, file-history/, telemetry/, cache/, daemon/, backups/, and other generated dirs.

VS Code

VS Code user settings.json is tracked under vscode/. The live ~/Library/Application Support/Code/User/settings.json is symlinked back into this repo. Machine-specific state (argv.json's crash-reporter-id, globalStorage/, History/, workspaceStorage/) stays untracked.

Host-specific config

Juniper-only operational state, LaunchAgents, services, and machine-specific topology live in /Users/xrisk/dev/juniper.

notes | work | writing

• notion - basic, good, easy
• zotero - open source, use better-bibtex
• nvim

(n)vim stuff

Plugins are managed by lazy.nvim and pinned in nvim/lazy-lock.json, so a fresh clone gets the same versions rather than whatever is current.

• vim-sleuth - autodetect indentation settings
• vimtex - just works™, syncs with Skim.app
• live-preview.nvim - renders Markdown in the editor, so .md needs no separate viewer app (Neovide is the Launch Services handler)

The old "I don't have time to set up 50 LSPs" position did not survive contact with reality — the servers are now declared in Brewfile under the editor section, and the config wires them up.

Full config at nvim/init.lua; see nvim/README.md for detail.

fave fonts

• SF Pro / Mono
• Inter
• Baskerville (great for academic writing)
• Source Code Pro
• Helvetica (old but golde)
• Inconsolata

more stuff in my Brewfile