Skip to main content

Installing a Spoke

Spokes are the Linux boxes you boot up and tear down — ie01, ie02, random workers. They're lean and apt-only: no Homebrew, no laptop-grade tooling, and they're provisioned from the hub rather than set up by hand.

⚡ One shot: czinit <host> — the fastest path. In a single command it seeds the node's Gitea credentials, installs chezmoi and runs init --apply, then logs the box into OpenBao so secrets render (AppRole first, OIDC as fallback). You only click Authorize if the browser tab opens:

czinit joestump@ie02.stump.rocks

Everything below — the SSH clone, the credential note, and the secrets step — is what czinit automates, shown here for when you need to run a piece by hand.

chezmoi ssh does the whole thing over SSH and drops you into a shell on the box:

chezmoi ssh <host> https://gitea.stump.rocks/joestump/dotfiles.git

⚠️ Private fork over SSH? This repo is public, so the plain HTTPS clone just works. If you're running a private fork, the clone needs credentials on the node: either use the SSH clone URL (git@…:you/dotfiles.git) if that box's key is on your forge account, or stash a token in git's credential store there once. Also: <host> must actually resolve from the hub — use a Tailscale name or FQDN like ie01.stump.rocks, not a bare ie01.

On the box directly​

sh -c "$(curl -fsLS get.chezmoi.io)" -- \
  init --source ~/src/dotfiles --apply https://gitea.stump.rocks/joestump/dotfiles.git

What's different from the hub​

  • No Homebrew. run_once_before_10-install-prereqs.sh detects Linux and uses apt for the essentials (zsh git curl …).
  • Packages via apt. run_onchange_after_10-install-packages.sh installs from ~/.config/dotfiles/apt-packages.txt, plus gh and vault from their official apt repos. The Brewfile is ignored on Linux.
  • No desktop apps. The macOS-only pieces (Claude Desktop, launchd services) simply don't apply here — that's why the hub must be macOS.
  • Uses sudo for apt — passwordless or interactive sudo required.

Then, secrets​

Same as the hub — the Vault Agent talks to OpenBao directly, so it works on a node as long as it can reach vault.stump.rocks:

vault login -method=oidc      # over SSH? see the tunnel note in Secrets
vault-agent start

💡 Re-installing a spoke — if a node gets into a weird state, nuke chezmoi's cache and re-run; it re-clones HEAD cleanly:

rm -rf ~/src/dotfiles ~/.local/share/chezmoi ~/.config/chezmoi ~/.cache/chezmoi
sh -c "$(curl -fsLS get.chezmoi.io)" -- init --source ~/src/dotfiles --apply https://gitea.stump.rocks/joestump/dotfiles.git