chezmoi: manage your dotfiles across multiple, diverse machines, securely.
CC Attribution 2.0 Belgium:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Payne, Tom
chezmoi helps you manage your personal configuration files (dotfiles) across multiple diverse machines. A single public branch in a single git repo serves as the source of truth, with machine-to-machine differences and integration with your password manager handled with templates. With chezmoi you can set up your personal environment on a new machine with just two short commands, with minimal dependencies. It runs on Linux, macOS, FreeBSD, OpenBSD, and even more esoteric operating systems like Termux and Windows. In this lightning talk we'll dive straight in to getting started with chezmoi, take a quick peek under the hood to see is architecture and technical choices, and compare it with other dotfile managers.
 Good afternoon. I'm Tom Payne. I'm a software engineer and long time open source contributor. I'm in this lightning talk and can talk about Shane Wah, how to manage your dot files across multiple diverse machines securely. What I'm going to cover and talk about what is Shane Wah, why you should even use a dot file manager. I'll give you a demo and why I should talk specifically about why I think you should use Shane Wah in particular rather than anything else to manage your dot files. And finally, I'll give you a couple of links to help you get started with Shane Wah. So, firstly, what is Shane Wah? It's a dot file manager. The dot files are your personal configuration files like dot bash RC dot vm RC dot git config, etc. Shane Wah is very flexible. It allows you to manage very diverse machines. For example, Linux, Windows and Mac OS in different environments, for example, your home setup or your work setup or from a single source of truth. It's very secure. You can retrieve secrets from your password manager or even encrypt whole files with GPG. And it's very lightweight. It's a single standalone binary, no external dependencies. It's easy to install and it runs everywhere. Why would you even want to manage your dot files? Of course, if you're running on a single machine and nothing ever changes, then you don't need a dot file manager. But if you want a consistent environment in multiple places, for example, I use Git both at home from open source contributions and at work. I want to take my git configs, my aliases, my shell aliases, my editor config. I want to have that consistent across multiple machines. The dot file manager is backed up by git version control and you get all the benefits of version control. That means being able to roll back, having a history, backups, offsite backups effectively. It allows you to manage your secrets very securely. This means that in my home configs, I can make sure there are no work secret access keys and similarly on my work machine, there are no secrets that might... No, personal secrets on my work machine. So let's jump in straight to a demo. What I've got here is a plain installed Ubuntu box and I'm going to install Sheyma. Here I'm using Snap, but Sheyma has binaries and packages built for everything. I'm going to run the Sheyma init command and give it my.files repo. This is an example one. Sheyma is going to clone the repo. And it's going to ask me if it's going to be me at my Ubuntu machine. So Sheyma has cloned the repo and it's created a little config file that contains that email address. What do you ask? Ask for is entirely configured by you, of course. I can ask Sheyma what changes it would make. She'll add if and it's going to create me my git config and a.netrc. To actually make the changes, I run Sheyma apply. And now I get config are present in my home directory. What actually happened in the hood, we can look at the repo that Sheyma checked out. Sheyma CD is a shortcut to go to, to go to that repo. There are two files. There's a one-to-one mapping between files here and the.files actually create. We can look at them in a bit of more detail..get config, this is an example of a template. You'll notice the.tnpl extension. And here I've used the email address that I was asked for when I ran Sheyma in it. If I look at the netexrc example, this is quite interesting. Here we're using a template function to get a secret. The final value, of course, appears in the final.file. But importantly, it doesn't appear in my.files repo. Let's go the other way now. Let's show getting a.file onto another machine. Let's, I've got a tmux config. I'm going to Sheyma add it. This is going to add it to the repo. This is, of course, in my local working copy. I need to add it with git. This is just standard git stuff now. Commit..tmux.gov. And push it. Now it's on my GitHub repo. I'm going to switch to a different machine. This is a free VSD machine. I've got already my.files managed here. But to pull in those changes I just made on the Ubuntu machine, I just ran Sheyma update minus vs of both. I know it shows me what's changed. It does the pull. It shows me what it's going to change. And, of course, it has actually created a.file. So what just happened there? We had a.file stored in the GitHub repo. We ran Sheyma init to copy them onto the first machine, our Ubuntu machine, and generate the initial config file. We used Sheyma diff to see what would change, and then Sheyma apply to actually make those changes. To get the file the other way, we ran Sheyma add to add an existing.file to our source directory. We're using standard git commands. We pushed it to our.github.files repo. And then file on the second machine. We ran Sheyma update to pull those changes all the way into the home directory on the different machine. But why should you use Sheyma specifically to manage your.files? Well, first thing is very popular. It's got over 3.2,000 stars on GitHub. And that means it's well-tested. It's well-debugged. It means that when you... It's likely that someone has already solved the problem that you're yet to encounter. It's really easy to install. There are one-line shell installs. There are pre-built binaries and packages for all popular Linux distributions. It runs on its own straight everywhere. All different operating systems, including Windows, even in quite hysteric places like term-ups on your Android phone. It gives you really quick personal setup for virtual machines and development containers, specifically by being a single binary with no extra dependencies. It's very quick to setup your.files on a new machine. It gives you diversity from a single source of truth. Those templates allow us to control exactly what's in each.file on each individual machine. And we only have to care about differences. So everything that's the same across machines is easily managed. The security, the integration of your password manager and GPG for encrypting whole files is very powerful. And there's loads more functionality that I haven't talked about. For example, it can do good auto commits for you. It can generate archives. You'll see an upcoming version. You'll get three-way mergers. And there's a lot there. How to show more compared to other.file managers? You might be not convinced that you actually need a.file manager. I would argue that as soon as you're using one machine or you start caring about the contents of your.files, you should at least check your.files into a version control. One solution that people use is to use a Begit repo. This really doesn't scale beyond one or two machines. And it becomes very difficult to manage differences from machine to machine. If you've got your own personal shell scripts, I'm sure they work with you right now. But if you need new functionality, you're going to have to implement it yourself. If you come across a new version of your.files, if you come across a new operating system that you need to run on, you're going to have to do the work of porting your shell scripts. SheaMwa has already built, tested, working well for thousands of people. And compared to existing.file managers like.bar, RCA, Homesick, and Yadam, SheaMwa I think is simpler. It uses a pure declarative approach. Importantly, it doesn't have a dependency on a scripting language run time. You don't need to install Python 3 on a target machine. You don't need root access to be able to use SheaMwa. So I would argue that SheaMwa is actually a lot simpler than the existing systems. Under the hood, it's MIT licensed. It's written in Go. It uses Go's cross compilation to build all of those binaries for different operating systems and architectures. It plays well with Unix philosophy. It integrates well with other tools like Git, GPG, and a password manager. It doesn't invent anything that doesn't already exist. It provides atomic file updates. This means that if SheaMwa is interrupted while writing your.files, you'll get either the new.file or the old.file, but nothing in between, never an empty file or a half-written file. And this is important because we want your.files to be robust. We don't want to break you logging in by having a partially written file. The source state, as we saw earlier, is very transparent. There's a one-to-one mapping between the files in your GitHub.files repo and the files in your home directory. That's very easy to understand. That's it. That's SheaMwa. I hope I've persuaded you to at least check it out. It's very well documented. You'll find installation instructions, quick start instructions, FAQ, full reference manual all on SheaMwa.io. If you want to have a poke around with the source, it's on github.com.com. I am very welcome to receive your contributions and your questions. And of course, I'll be around on chat after this talk to answer your questions and help you get started. Thank you very much indeed for listening. Great. So thank you very much indeed for attending my talk. And thanks so much for Chandan for hosting. Apologies for the quiet sound. I didn't realise. The first question I have is from Matt. What template language does SheaMwa use? SheaMwa uses Go's text template language, which was built into the Go standard library. It's used on quite a lot of different systems. For example, the same thing that Helm uses if you're a communities user. And it's very equivalent to things like moustache. In addition to the language, there's also a whole bunch of functions that you can call. These functions can integrate with your password manager. So you can extract secrets. You can check for, you can do tests on your local machine. For example, check if certain files are present or if binaries are present in your path. And so it's very standard text templating language and it's very powerful. It's fully documented on SheaMwa.io in the reference. Coming to the next question. Do you in general tend to share your.files publicly? And do you know if they are being used by others? Yes, I do share my.files publicly. You'll find the TWPain slash.files on GitHub. Of course, there are no secrets in there. On occasion, I've used the full file encryption. When I have this large documents that I want to have but not allowing to read. I don't think anyone would want to use my personal.files. These are very personal things, of course, but they do serve as a useful source of inspiration to see what other people are doing. And in the case of SheaMwa, it's a good example of how many of the features that SheaMwa has. For example, in my particular setup, I have SheaMwa running on about eight different machines, both real and virtual, across all of these different operating systems. To make that possible, I have a little tagging system. I tag whether a machine is personal or work, whether I want certain tooling installed, whether it's a temporary machine, like a dev container, or a GitHub code space, or a temporary variant virtual machine. So I have this sort of set of tags, and I use those tags in the templates to get... There's something that's consistent across all machines, like my Git config, for example, and my editor config, and allow other things to vary, for example, what's installed, and whether my personal secrets or work secrets are checked out on those machines. Thanks Tom. Moving to the next question. Could you set up like a profile or something to separate specific types of machines, like Fedora or Iwant to also... Yes, the way that SheaMwa does this is a little bit different. SheaMwa works from a single source of truth. So there's a single directory tree, and from that directory tree, it generates the different profiles that you want. And generally, there are two aspects to this. In some profiles, you might want certain files present and other files absent, and there's a thing called SheaMwa Remove, which allows you to do this. And the second thing is that the contents of files might vary according to profiles, and that's where the templates come in. So yes, you can have very fine-grained control over different profiles. I'm looking for other questions. If people have more questions, yeah, we have got another question. Does SheaMwa have this recommended approach to setting configurations with colleagues or friends? Sorry, did you repeat the question, please? If people have more questions, yeah, we have got another question. Bill, please rise. So just to follow up on the question about Ubuntu and Fedora machines. The first question that SheaMwa applies is a bunch of preset variables that you can use in your templates, and this includes identifying the operating system release by reading ETC OS release on learning machines, and that allows you to distinguish between Ubuntu, Fedora, Debian, Gen2, etc. And there are other useful configuration variables as well, the machine type, the operating system, all these are pre-filled in for you, so they're ready to go out of the box. Okay. I think I've got one more question. So does my have a recommended approach to setting configurations with colleagues or friends? Of course, my recommendation is use SheaMwa for this. If you, it's likely that things will be personal, but enough that you don't want to share entire directory trees, it's probably more on sharing of an individual files. So when putting your.files in a repo on GitHub, whatever.file manager you choose to use is a great way to do this. And SheaMwa specifically does not have a specific way of doing this. But I'd very much interested in kind of discussing that on GitHub, that's how we could implement that. So that's the question I have from the people. Great. Thank you very much indeed. Yeah. So if you have more questions, so there is a Hallway track, which you can join the post and what will direct you to that. Thank you, Tom. Thank you very much.
 Good afternoon. I'm Tom Payne. I'm a software engineer and long time open source contributor.  I'm in this lightning talk and can talk about Shane Wah, how to manage your dot files across multiple diverse machines securely.  What I'm going to cover and talk about what is Shane Wah, why you should even use a dot file manager.  I'll give you a demo and why I should talk specifically about why I think you should use Shane Wah in particular rather than anything else to manage your dot files.  And finally, I'll give you a couple of links to help you get started with Shane Wah.  So, firstly, what is Shane Wah? It's a dot file manager.  The dot files are your personal configuration files like dot bash RC dot vm RC dot git config, etc.  Shane Wah is very flexible. It allows you to manage very diverse machines.  For example, Linux, Windows and Mac OS in different environments, for example, your home setup or your work setup or from a single source of truth.  It's very secure. You can retrieve secrets from your password manager or even encrypt whole files with GPG.  And it's very lightweight. It's a single standalone binary, no external dependencies.  It's easy to install and it runs everywhere.  Why would you even want to manage your dot files?  Of course, if you're running on a single machine and nothing ever changes, then you don't need a dot file manager.  But if you want a consistent environment in multiple places, for example, I use Git both at home from open source contributions and at work.  I want to take my git configs, my aliases, my shell aliases, my editor config.  I want to have that consistent across multiple machines.  The dot file manager is backed up by git version control and you get all the benefits of version control. That means being able to roll back, having a history, backups,  offsite backups effectively.  It allows you to manage your secrets very securely.  This means that in my home configs, I can make sure there are no work secret access keys and similarly on my work machine, there are no secrets that might...  No, personal secrets on my work machine.  So let's jump in straight to a demo.  What I've got here is a plain installed Ubuntu box and I'm going to install Sheyma.  Here I'm using Snap, but Sheyma has binaries and packages built for everything.  I'm going to run the Sheyma init command and give it my.files repo.  This is an example one.  Sheyma is going to clone the repo.  And it's going to ask me if it's going to be me at my Ubuntu machine.  So Sheyma has cloned the repo and it's created a little config file that contains that email address.  What do you ask?  Ask for is entirely configured by you, of course.  I can ask Sheyma what changes it would make.  She'll add if and it's going to create me my git config and a.netrc.  To actually make the changes, I run Sheyma apply.  And now I get config are present in my home directory.  What actually happened in the hood, we can look at the repo that Sheyma checked out.  Sheyma CD is a shortcut to go to, to go to that repo.  There are two files.  There's a one-to-one mapping between files here and the.files actually create.  We can look at them in a bit of more detail. .get config, this is an example of a template.  You'll notice the.tnpl extension.  And here I've used the email address that I was asked for when I ran Sheyma in it.  If I look at the netexrc example, this is quite interesting.  Here we're using a template function to get a secret.  The final value, of course, appears in the final.file.  But importantly, it doesn't appear in my.files repo.  Let's go the other way now.  Let's show getting a.file onto another machine.  Let's, I've got a tmux config.  I'm going to Sheyma add it.  This is going to add it to the repo.  This is, of course, in my local working copy.  I need to add it with git.  This is just standard git stuff now.  Commit. .tmux.gov.  And push it.  Now it's on my GitHub repo.  I'm going to switch to a different machine.  This is a free VSD machine.  I've got already my.files managed here.  But to pull in those changes I just made on the Ubuntu machine,  I just ran Sheyma update minus vs of both.  I know it shows me what's changed.  It does the pull.  It shows me what it's going to change.  And, of course, it has actually created a.file.  So what just happened there?  We had a.file stored in the GitHub repo.  We ran Sheyma init to copy them onto the first machine,  our Ubuntu machine, and generate the initial config file.  We used Sheyma diff to see what would change,  and then Sheyma apply to actually make those changes.  To get the file the other way, we ran Sheyma add to add  an existing.file to our source directory.  We're using standard git commands.  We pushed it to our.github.files repo.  And then file on the second machine.  We ran Sheyma update to pull those changes all the way  into the home directory on the different machine.  But why should you use Sheyma specifically to manage your.files?  Well, first thing is very popular.  It's got over 3.2,000 stars on GitHub.  And that means it's well-tested.  It's well-debugged.  It means that when you...  It's likely that someone has already solved the problem  that you're yet to encounter.  It's really easy to install.  There are one-line shell installs.  There are pre-built binaries and packages  for all popular Linux distributions.  It runs on its own straight everywhere.  All different operating systems, including Windows,  even in quite hysteric places like term-ups on your Android phone.  It gives you really quick personal setup  for virtual machines and development containers,  specifically by being a single binary  with no extra dependencies.  It's very quick to setup your.files on a new machine.  It gives you diversity from a single source of truth.  Those templates allow us to control exactly what's  in each.file on each individual machine.  And we only have to care about differences.  So everything that's the same across machines is easily managed.  The security, the integration of your password manager  and GPG for encrypting whole files is very powerful.  And there's loads more functionality that I haven't talked about.  For example, it can do good auto commits for you.  It can generate archives.  You'll see an upcoming version.  You'll get three-way mergers.  And there's a lot there.  How to show more compared to other.file managers?  You might be not convinced that you actually need a.file manager.  I would argue that as soon as you're using one machine  or you start caring about the contents of your.files,  you should at least check your.files into a version control.  One solution that people use is to use a Begit repo.  This really doesn't scale beyond one or two machines.  And it becomes very difficult to manage differences  from machine to machine.  If you've got your own personal shell scripts,  I'm sure they work with you right now.  But if you need new functionality,  you're going to have to implement it yourself.  If you come across a new version of your.files,  if you come across a new operating system  that you need to run on,  you're going to have to do the work of porting your shell scripts.  SheaMwa has already built, tested, working well for thousands of people.  And compared to existing.file managers like.bar,  RCA, Homesick, and Yadam,  SheaMwa I think is simpler.  It uses a pure declarative approach.  Importantly, it doesn't have a dependency on a scripting language run time.  You don't need to install Python 3 on a target machine.  You don't need root access to be able to use SheaMwa.  So I would argue that SheaMwa is actually a lot simpler than the existing systems.  Under the hood, it's MIT licensed.  It's written in Go.  It uses Go's cross compilation to build all of those binaries  for different operating systems and architectures.  It plays well with Unix philosophy.  It integrates well with other tools like Git,  GPG, and a password manager.  It doesn't invent anything that doesn't already exist.  It provides atomic file updates.  This means that if SheaMwa is interrupted while writing your.files,  you'll get either the new.file or the old.file,  but nothing in between, never an empty file or a half-written file.  And this is important because we want your.files to be robust.  We don't want to break you logging in by having a partially written file.  The source state, as we saw earlier, is very transparent.  There's a one-to-one mapping between the files in your GitHub.files repo  and the files in your home directory.  That's very easy to understand.  That's it. That's SheaMwa.  I hope I've persuaded you to at least check it out.  It's very well documented.  You'll find installation instructions, quick start instructions,  FAQ, full reference manual all on SheaMwa.io.  If you want to have a poke around with the source,  it's on github.com.com.  I am very welcome to receive your contributions and your questions.  And of course, I'll be around on chat after this talk  to answer your questions and help you get started.  Thank you very much indeed for listening.  Great.  So thank you very much indeed for attending my talk.  And thanks so much for Chandan for hosting.  Apologies for the quiet sound.  I didn't realise.  The first question I have is from Matt.  What template language does SheaMwa use?  SheaMwa uses Go's text template language,  which was built into the Go standard library.  It's used on quite a lot of different systems.  For example, the same thing that Helm uses if you're a communities user.  And it's very equivalent to things like moustache.  In addition to the language, there's also a whole bunch of functions  that you can call.  These functions can integrate with your password manager.  So you can extract secrets.  You can check for, you can do tests on your local machine.  For example, check if certain files are present or if binaries are present in your path.  And so it's very standard text templating language and it's very powerful.  It's fully documented on SheaMwa.io in the reference.  Coming to the next question.  Do you in general tend to share your.files publicly?  And do you know if they are being used by others?  Yes, I do share my.files publicly.  You'll find the TWPain slash.files on GitHub.  Of course, there are no secrets in there.  On occasion, I've used the full file encryption.  When I have this large documents that I want to have but not allowing to read.  I don't think anyone would want to use my personal.files.  These are very personal things, of course, but they do serve as a useful source of inspiration to see what other people are doing.  And in the case of SheaMwa, it's a good example of how many of the features that SheaMwa has.  For example, in my particular setup, I have SheaMwa running on about eight different machines, both real and virtual,  across all of these different operating systems. To make that possible, I have a little tagging system.  I tag whether a machine is personal or work, whether I want certain tooling installed, whether it's a temporary machine, like a dev container,  or a GitHub code space, or a temporary variant virtual machine.  So I have this sort of set of tags, and I use those tags in the templates to get...  There's something that's consistent across all machines, like my Git config, for example, and my editor config,  and allow other things to vary, for example, what's installed, and whether my personal secrets or work secrets are checked out on those machines.  Thanks Tom. Moving to the next question.  Could you set up like a profile or something to separate specific types of machines, like Fedora or Iwant to also...  Yes, the way that SheaMwa does this is a little bit different. SheaMwa works from a single source of truth.  So there's a single directory tree, and from that directory tree, it generates the different profiles that you want.  And generally, there are two aspects to this. In some profiles, you might want certain files present and other files absent,  and there's a thing called SheaMwa Remove, which allows you to do this. And the second thing is that the contents of files might vary according to profiles,  and that's where the templates come in. So yes, you can have very fine-grained control over different profiles.  I'm looking for other questions.  If people have more questions, yeah, we have got another question. Does SheaMwa have this recommended approach to setting configurations with colleagues or friends?  Sorry, did you repeat the question, please?  If people have more questions, yeah, we have got another question.  Bill, please rise.  So just to follow up on the question about Ubuntu and Fedora machines.  The first question that SheaMwa applies is a bunch of preset variables that you can use in your templates, and this includes identifying the operating system release by reading ETC OS release on learning machines,  and that allows you to distinguish between Ubuntu, Fedora, Debian, Gen2, etc.  And there are other useful configuration variables as well, the machine type, the operating system, all these are pre-filled in for you, so they're ready to go out of the box.  Okay.  I think I've got one more question. So does my have a recommended approach to setting configurations with colleagues or friends?  Of course, my recommendation is use SheaMwa for this.  If you, it's likely that things will be personal, but enough that you don't want to share entire directory trees, it's probably more on sharing of an individual files.  So when putting your.files in a repo on GitHub, whatever.file manager you choose to use is a great way to do this.  And SheaMwa specifically does not have a specific way of doing this.  But I'd very much interested in kind of discussing that on GitHub, that's how we could implement that.  So that's the question I have from the people.  Great. Thank you very much indeed.  Yeah. So if you have more questions, so there is a Hallway track, which you can join the post and what will direct you to that.  Thank you, Tom.  Thank you very much.
chezmoi_0_8555.png chezmoi_8556_16175.png chezmoi_16176_16415.png chezmoi_16416_16487.png chezmoi_16488_17183.png chezmoi_17184_17267.png chezmoi_17268_17807.png chezmoi_17808_18287.png chezmoi_18288_18671.png chezmoi_18672_18731.png chezmoi_18732_19283.png chezmoi_19284_19331.png chezmoi_19332_19667.png chezmoi_19668_20207.png chezmoi_20208_20891.png chezmoi_20892_21227.png chezmoi_21228_21647.png chezmoi_21648_22067.png chezmoi_22068_23351.png chezmoi_23352_25763.png chezmoi_25764_25940.png