uinaf/dotfiles

A vendor-neutral macOS bootstrap framework for workstations, remote coding users.

The repository manages Homebrew layers, chezmoi source state, mise runtimes, Git and SSH defaults, coding-agent setup, and verification scripts. Installed paths and interfaces use generic dotfiles names; private identities and secret values remain local or in an approved recovery system.

Choose a Profile

• Profiles apply to one Unix user.
• Host-wide Homebrew, power, Spotlight, Tailscale, and LaunchDaemon state still requires an authorized administrator.
• Choose the profile and software layers in User profiles before configuring one or more users on a Mac.

Install

Install Apple Command Line Tools and Homebrew, then clone the repository:

brew install git gh
gh auth login
mkdir -p ~/projects
gh repo clone uinaf/dotfiles ~/projects/dotfiles
cd ~/projects/dotfiles

Then follow the Bootstrap guide. It owns the canonical per-profile command sequences plus first-machine prerequisites, devbox and optional desktop setup, updates, and troubleshooting.

Managed Surfaces

Surface	Source of truth
Packages	Brewfile, Brewfile.developer, and Brewfile.<profile>
Per-user convergence	./dotfiles, backed by chezmoi/, mise, and profile install steps
Runtimes and CLIs	chezmoi/private_dot_config/mise/config.toml.tmpl
Git, SSH, age, and GitHub App setup	scripts/bootstrap/, scripts/secrets/, and Identity provisioning
Global coding-agent rules	chezmoi/, with optional private start and end fragments under ~/.config/dotfiles/
Global coding-agent skills	scripts/agents/, with personal additions selected by profile
Repository and host checks	scripts/verify/ and scripts/audit/

Consumer repositories own project dependencies, encrypted payloads, runtime services, and repository-local agent instructions. The optional SOPS vault template provides a standalone starting point for encrypted capability-scoped repositories.

Verify

List the verification domains and run the one that owns the change:

mise run verify:domain config # example; select the owning domain
mise run verify:fast
mise run verify

• verify:fast runs the deterministic graph.
• verify also scans full Git history.
• CI always runs the deterministic graph.
• Live profile and host checks live in Mise and Security audits.

Documentation

Need	Guide
Install or update a Mac	Bootstrap
Choose a per-user role	User profiles
Provision age, Git, SSH, or GitHub identity	Identity provisioning
Configure a devbox, coding LLM gateway, or shared-host service	Devbox setup
Apply global coding-agent rules or sync skills	Agent setup
Edit chezmoi source state	Chezmoi
Use repo tasks, run local proof, or change runtime pins	Mise
Understand Actions and releases	GitHub pipelines
Run security checks	Security audits
Build mobile and TV apps	Mobile and TV development
Find script entrypoints	Scripts

Contributing

See Contributing for setup and verification expectations. Report vulnerabilities through the private path in Security.

License

MIT. See License.