GitHub - aroman/dotfiles: :sunglasses: Avi's dotfiles

Avi's dotfiles

Managed with rcm (macOS) and NixOS + home-manager (Linux).

Most macOS packages are in the Brewfile. NixOS packages are declared in nixos/modules/home.nix.

What's in here

Shell: fish + starship prompt
Terminal: Ghostty (Everblush theme)
Editor: Zed (primary), Neovim (lazy.nvim), vim (barebones fallback)
Git: difftastic (structural diffs), SSH signing, git-lfs
NixOS: niri compositor, Ptyxis terminal, handlr-regex URL dispatching
macOS: Caps Lock → Escape (hidutil), Touch ID sudo, Dock/Finder defaults

Non-brew apps (macOS)

1Password (not installed via Brew for security reasons)
BetterDisplay
OrbStack

Setup (macOS)

# Install rcm and core tools
brew install rcm fish git
brew bundle

# Set fish as default shell
sudo sh -c 'echo $(which fish) >> /etc/shells'
chsh -s $(which fish)

# Install fish plugins
fish -c 'curl -sL https://git.io/fisher | source && fisher install jorgebucaran/fisher && fisher install jorgebucaran/hydro'

# Clone and link dotfiles
git clone git@github.com:aroman/dotfiles.git .dotfiles
rcup

# Build bat theme cache
bat cache --build

# Directories
mkdir -p ~/Projects
mkdir -p ~/Pictures/Screenshots
defaults write com.apple.screencapture location ~/Pictures/Screenshots

# Keyboard
defaults write -g ApplePressAndHoldEnabled -bool false
defaults write -g InitialKeyRepeat -int 15
defaults write -g KeyRepeat -int 2

# Mail
defaults write com.apple.mail AddressesIncludeNameOnPasteboard -bool false

# Appearance
defaults write -g AppleReduceDesktopTinting -bool yes

# Finder
defaults write NSGlobalDomain AppleShowAllExtensions -bool true
chflags nohidden ~/Library
/usr/libexec/PlistBuddy -c "Set :DesktopViewSettings:IconViewSettings:arrangeBy grid" ~/Library/Preferences/com.apple.finder.plist
/usr/libexec/PlistBuddy -c "Set :FK_StandardViewSettings:IconViewSettings:arrangeBy grid" ~/Library/Preferences/com.apple.finder.plist
/usr/libexec/PlistBuddy -c "Set :StandardViewSettings:IconViewSettings:arrangeBy grid" ~/Library/Preferences/com.apple.finder.plist

# Dock
defaults write com.apple.dock autohide -bool true
defaults write com.apple.dock autohide-delay -float 0
defaults write com.apple.dock persistent-apps -array
defaults write com.apple.dock show-recents -bool false
defaults write com.apple.dock ResetLaunchPad -bool true
defaults write com.apple.dock mineffect -string scale
defaults write com.apple.Dock showhidden -bool true

# Trackpad
defaults write com.apple.AppleMultitouchTrackpad Clicking -bool true

# Velja (disable App Nap so link routing stays fast)
defaults write com.sindresorhus.Velja NSAppSleepDisabled -bool true

# Touch ID for sudo (survives macOS upgrades)
# pam-reattach is needed for tmux sessions; ignore_ssh falls back to password for SSH
# See: https://sixcolors.com/post/2023/08/in-macos-sonoma-touch-id-for-sudo-can-survive-updates/
brew install pam-reattach
printf 'auth       optional       /opt/homebrew/lib/pam/pam_reattach.so ignore_ssh\nauth       sufficient     pam_tid.so\n' | sudo tee /etc/pam.d/sudo_local > /dev/null

Reboot to apply everything: sudo shutdown -r now

Setup (NixOS)

Bootstrapping a fresh install

On the new machine (fresh NixOS with nothing installed):

# Get git in a temporary shell
nix-shell -p git

# Clone dotfiles (HTTPS — no SSH keys yet)
mkdir -p ~/Projects
git clone https://github.com/aroman/dotfiles.git ~/Projects/dotfiles

Then, from another machine that already has the repo:

# 1. Enable SSH on the fresh install so you can access it remotely
#    On the new machine, edit the default NixOS config:
#      sudo nano /etc/nixos/configuration.nix
#    Add: services.openssh.enable = true;
#    Then: sudo nixos-rebuild switch

# 2. Pull the hardware config directly
mkdir -p nixos/hosts/<hostname>
# Use the machine's IP (run `ip addr` on it to find it — mDNS likely won't work yet)
scp <user>@<ip>:/etc/nixos/hardware-configuration.nix nixos/hosts/<hostname>/

# 3. Create default.nix and home.nix (see existing hosts for reference)
#    Add the host to nixos/flake.nix

# 4. Push
git add nixos/hosts/<hostname> nixos/flake.nix
git commit -m "Add <hostname> NixOS host config"
git push

Finally, on the new machine:

cd ~/Projects/dotfiles
git pull
sudo nixos-rebuild switch --flake ~/Projects/dotfiles/nixos#<hostname>

After the first rebuild, SSH, git, and everything else from common.nix will be available. Set up SSH keys and switch the remote:

# Generate a machine-specific key (name it after the hostname)
ssh-keygen -t ed25519 -C "<hostname>" -f ~/.ssh/<hostname>

# Add to GitHub (auth via browser)
gh auth login
gh ssh-key add ~/.ssh/<hostname>.pub -t "<hostname>"

# Create ~/.ssh/config.local to tell SSH which key to use
echo 'Host github.com
  IdentityFile ~/.ssh/<hostname>' > ~/.ssh/config.local
chmod 600 ~/.ssh/config.local

# Switch remote to SSH
git remote set-url origin git@github.com:aroman/dotfiles.git

# Load the key into the agent (AddKeysToAgent will handle it after this)
ssh-add ~/.ssh/<hostname>

# Symlink dotfiles managed by rcm (scripts in ~/.local/bin, etc.)
rcup -K

# Build bat theme cache (for Everblush theme)
bat cache --build

# Set up git commit signing (key matches the SSH key)
echo '[user]
	signingkey = ~/.ssh/<hostname>.pub' > ~/.gitconfig.local

# Add API keys for tools (ai-commit, etc.)
echo 'set -gx GEMINI_API_KEY "your-key-here"' >> ~/.config/fish/conf.d/secrets.fish

From your main machine, set up passwordless SSH:

ssh-copy-id <hostname>

Existing machine

git clone git@github.com:aroman/dotfiles.git ~/Projects/dotfiles
sudo nixos-rebuild switch --flake ~/Projects/dotfiles/nixos
rcup -K

Hosts are defined in nixos/hosts/. Rebuild alias: bake

Backups (NixOS)

Both NixOS machines back up /home/aroman daily to Backblaze B2 using restic. Backup health is monitored by Healthchecks.io — it alerts if a daily backup doesn't run.

Architecture: restic encrypts and deduplicates client-side, then uploads to B2. Both machines share one B2 bucket and one restic repo. Restic tags snapshots by hostname automatically.

B2 setup:

Bucket: aroman-backups (US West, private, no server-side encryption, no object lock)
Each machine has its own B2 application key scoped to only this bucket
Keys are named restic-wizardtower and restic-moonbinder

Retention: 7 daily, 4 weekly, 6 monthly snapshots.

Secrets (per-machine, not tracked in repo):

File	Contents	Shared?
`/etc/restic/password`	Restic repo encryption password	Same on all machines
`/etc/restic/b2-env`	`B2_ACCOUNT_ID` and `B2_ACCOUNT_KEY`	Different per machine
`/etc/restic/healthchecks-url`	Healthchecks.io ping URL	Different per machine

All stored in 1Password. The directory and files should be chmod 700/600, owned by root.

Setting up a new machine:

sudo mkdir -p /etc/restic && sudo chmod 700 /etc/restic

# Use the SAME restic password as other machines (from 1Password)
sudo nano /etc/restic/password

# Create a new B2 application key scoped to aroman-backups bucket
# (B2 Console → App Keys → Add a New Application Key)
sudo nano /etc/restic/b2-env
# B2_ACCOUNT_ID=<keyID>
# B2_ACCOUNT_KEY=<applicationKey>

# Create a new Healthchecks.io check (Period: 1 day, Grace: 2 hours)
sudo nano /etc/restic/healthchecks-url
# https://hc-ping.com/<uuid>

sudo chmod 600 /etc/restic/password /etc/restic/b2-env /etc/restic/healthchecks-url

Manual operations:

# Trigger a backup now
sudo systemctl start restic-backups-b2.service

# Watch backup progress
sudo journalctl -fu restic-backups-b2.service

# List snapshots
sudo bash -c 'set -a && source /etc/restic/b2-env && restic -r b2:aroman-backups --password-file /etc/restic/password snapshots'

# Restore a file
sudo bash -c 'set -a && source /etc/restic/b2-env && restic -r b2:aroman-backups --password-file /etc/restic/password restore latest --target /tmp/restic-test --include /home/aroman/path/to/file'

URL Dispatching (NixOS / niri)

A domain-based URL routing system that sends links to the right app and Chrome profile automatically. Think Velja for Linux.

Architecture

any app
  -> xdg-open
    -> handlr-regex (registered as default x-scheme-handler/https)
      -> regex match on URL domain
        -> figma.com/*    : figma-open (CDP script)
        -> youtube.com/*  : Chrome (Personal profile)
        -> *              : Chrome (magiccircle.studio profile)

Key files:

nixos/modules/home.nix -- handlr-regex package, .desktop entries, TOML config, MIME associations
local/bin/figma-open -- Figma URL handler script
~/.config/handlr/handlr.toml -- generated regex routing rules

How it works

handlr-regex is a Rust-based xdg-open replacement that matches URLs against regex rules. A .desktop entry registers it as the default handler for x-scheme-handler/http and x-scheme-handler/https. When any app calls xdg-open with an http(s) URL, handlr matches it against the rules in handlr.toml and dispatches to the appropriate command.

Chrome profiles are selected via --profile-directory. Profile names map to directory names under ~/.config/google-chrome/ (e.g. Default, Profile 1).

Figma deep linking via Chrome DevTools Protocol

figma-open goes beyond simple URL dispatching. Figma runs as a Chrome --app window with --remote-debugging-port=9222, exposing the Chrome DevTools Protocol. The script uses CDP over WebSocket (via websocat) to control the running Figma instance:

Same-file navigation (e.g. jumping to a different artboard):

When the target URL has the same base path as the currently open file but a different node-id query parameter, the script avoids a full page reload. Instead, it extracts the node ID and calls Figma's Plugin API directly via Runtime.evaluate:

const node = await figma.getNodeByIdAsync('12438:18221');
figma.currentPage.selection = [node];
figma.viewport.scrollAndZoomIntoView([node]);

This is the same internal API that Figma plugins use -- it selects the node and scrolls the viewport to it instantly, with no reload.

Different-file navigation:

Uses CDP Page.navigate for a standard full navigation to the new file.

Figma not running:

Falls back to launching Chrome with the full --app, --user-data-dir, --user-agent, and --remote-debugging-port flags.

Window focus:

After navigation, the script focuses the Figma window via niri's IPC (niri msg action focus-window), matching on the app_id prefix chrome-www.figma.com.

Adding a new domain rule

Edit the handlr.toml section in nixos/modules/home.nix. Rules are matched top-down, first match wins:

# Route to a specific Chrome profile
[[handlers]]
exec = "google-chrome-stable --profile-directory=\"Profile 1\" %u"
regexes = ['https?://(www\.)?example\.com(/.*)?']

Then rebuild: bake

Name		Name	Last commit message	Last commit date
Latest commit History 449 Commits
.claude		.claude
Library/LaunchAgents		Library/LaunchAgents
claude		claude
config		config
hooks/post-up		hooks/post-up
local		local
nixos		nixos
ssh		ssh
.gitignore		.gitignore
AGENTS.md		AGENTS.md
Brewfile		Brewfile
CLAUDE.md		CLAUDE.md
PLAN.md		PLAN.md
README.md		README.md
duti		duti
gitconfig		gitconfig
gitignore_global		gitignore_global
hushlogin		hushlogin
rcrc		rcrc
rules.velja-rules		rules.velja-rules
tmux.conf		tmux.conf

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Repository files navigation

Avi's dotfiles

What's in here

Non-brew apps (macOS)

Setup (macOS)

Setup (NixOS)

Bootstrapping a fresh install

Existing machine

Backups (NixOS)

URL Dispatching (NixOS / niri)

Architecture

How it works

Figma deep linking via Chrome DevTools Protocol

Adding a new domain rule

About

Uh oh!

Releases

Packages

Uh oh!

Uh oh!

Contributors

Uh oh!

Languages

Folders and files

Latest commit

History

Repository files navigation

Avi's dotfiles

What's in here

Non-brew apps (macOS)

Setup (macOS)

Setup (NixOS)

Bootstrapping a fresh install

Existing machine

Backups (NixOS)

URL Dispatching (NixOS / niri)

Architecture

How it works

Figma deep linking via Chrome DevTools Protocol

Adding a new domain rule

About

Topics

Resources

Uh oh!

Stars

Watchers

Forks

Releases

Packages 0

Uh oh!

Uh oh!

Contributors

Uh oh!

Languages

Packages