Personal Dotfiles

This repository contains my personal configuration for my macOS system and programs.

Preview

Install

curl -fsSL https://bensadik.net/dotfiles | bash

Tech

• Nix - Nix is a powerful package manager for Unix systems that makes package management reliable and reproducible.
• nix-darwin - nix-darwin is a set of tools for using Nix as a standalone macOS package manager.
• Homebrew - Homebrew is a package manager for macOS.
• home-manager - Manage user configuration using Nix.

Infisical

Machine secrets are pulled from Infisical and loaded by Zsh.

Build-time secrets are also synced into secrets/secrets.yaml for sops-nix. A fresh install expects these Infisical keys to exist:

1. EMAIL
2. FULLNAME
3. WHISPER_HOSTNAME
4. SSH_ID_ED25519_PERSONAL
5. SSH_ID_ED25519_PERSONAL_PUB
6. SSH_ID_ED25519_WORK
7. SSH_ID_ED25519_WORK_PUB
8. SSH_ID_ED25519_SECURE
9. SSH_ID_ED25519_SECURE_PUB

To seed those SSH key secrets from the current machine, run:

~/dotfiles/bin/push-ssh-keys

Use ~/dotfiles/bin/push-ssh-keys --dry-run to preview the target without changing Infisical.

1. Fill in programs/infisical/infisical.conf
2. Apply the dotfiles: sudo darwin-rebuild switch --flake ~/dotfiles#$USER
3. Authenticate with infisical login if you are not using INFISICAL_MACHINE_TOKEN
4. Pull secrets with infisync

INFISICAL_MACHINE_PROJECT_ID="<project-id>"
INFISICAL_MACHINE_ENV="prod"
INFISICAL_MACHINE_PATH="/"

# Optional for self-hosted Infisical
# INFISICAL_MACHINE_DOMAIN="https://infisical.example.com/api"

# Optional for non-interactive auth
# INFISICAL_MACHINE_TOKEN="<machine-identity-or-service-token>"

Pulled secrets are written to ~/.local/state/infisical/machine.env with 0600 permissions and auto-loaded in new shells.