chezmoi
Two checkouts, two roles: a production clone pinned to upstream main that renders $HOME, and a workbench you actually edit.
OpenBao + Vault Agent
Secrets never touch the repo. A supervised agent renders env files, AWS credentials, a .netrc and SSH keys from OpenBao on a schedule.
harness
systemctl for your agents. Supervises Crush and Claude Code sessions, runs their cron schedules, and hands you the whole cockpit over SSH.
One set of rules
Claude Code, Claude Desktop and Crush compose their rules from the same partials — and every identity value is derived, never stored.
Oh My Zsh
Curated plugins, a random cute prompt glyph, spaceship + Ghostty, helpers auto-loaded from $ZSH_CUSTOM.
czu
One command syncs, applies, re-renders secrets and reloads the shell — and runs itself every 6h, silent unless something breaks.
Declarative tooling
A Brewfile, an apt list and a Go tools list. Add a line, merge, done — plus three things built from source on apply.
Services & schedules
Daemons and timers, systemd --user on Linux and launchd on macOS, from one source — including a detector for the secret outage you would never otherwise notice.
Garage Pages CI
BATS, shellcheck and gitleaks on every push; this very site builds once and ships to both Garage S3 and GitHub Pages.
