🚀 Complete machine migration setup with encrypted backups

- Added comprehensive configuration files for seamless migration
- SSH, GPG, Karabiner, iTerm2, Neofetch, SwiftBar configs
- Pass license management system with templates and documentation
- Enhanced shell functions with MAS updates and moon phase tracking
- Comprehensive encrypted backup system (GPG AES256)
- Included encrypted backups of all sensitive data
- BBEdit as default editor with proper configuration
- Fixed shell compatibility issues
- Merged existing .zsh configs with improvements

Security:
- All sensitive data is GPG encrypted (.gpg files)
- Private keys excluded from version control
- Only configs and encrypted backups are tracked

Following prime directive: durable, thoughtful solutions

🤖 Generated with Claude Code

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
David F Glidden
2025-07-28 23:10:36 +02:00
co-authored by Claude
parent a0e34f78ae
commit 389febb161
67 changed files with 2484 additions and 545 deletions
+144
View File
@@ -0,0 +1,144 @@
#!/usr/bin/env bash
# Complete backup of all private keys, secrets, and sensitive configurations
# Following prime directive: one durable, encrypted container for everything
set -euo pipefail
BACKUP_DIR="$HOME/dotfiles/backups"
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
TEMP_DIR=$(mktemp -d)
# Colors
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
RED='\033[0;31m'
NC='\033[0m'
echo -e "${YELLOW}🔐 Creating complete encrypted backup of all secrets${NC}"
echo "Timestamp: $TIMESTAMP"
echo ""
# Create backup structure in temp directory
mkdir -p "$TEMP_DIR/secrets"/{ssh,gnupg,docker,config}
echo -e "${YELLOW}📦 Collecting all sensitive data...${NC}"
# SSH keys and config
if [[ -d "$HOME/.ssh" ]]; then
echo " 🔑 SSH keys and configuration"
cp -r "$HOME/.ssh" "$TEMP_DIR/secrets/"
fi
# GPG keyring and keys
if [[ -d "$HOME/.gnupg" ]]; then
echo " 🔐 GPG private keys and keyring"
mkdir -p "$TEMP_DIR/secrets/.gnupg"
# Copy essential GPG files (not temporary/socket files)
cp -r "$HOME/.gnupg/private-keys-v1.d" "$TEMP_DIR/secrets/.gnupg/" 2>/dev/null || true
cp "$HOME/.gnupg/pubring.kbx" "$TEMP_DIR/secrets/.gnupg/" 2>/dev/null || true
cp "$HOME/.gnupg/trustdb.gpg" "$TEMP_DIR/secrets/.gnupg/" 2>/dev/null || true
cp "$HOME/.gnupg/gpg.conf" "$TEMP_DIR/secrets/.gnupg/" 2>/dev/null || true
cp "$HOME/.gnupg/gpg-agent.conf" "$TEMP_DIR/secrets/.gnupg/" 2>/dev/null || true
cp "$HOME/.gnupg/dirmngr.conf" "$TEMP_DIR/secrets/.gnupg/" 2>/dev/null || true
fi
# Docker configuration
if [[ -f "$HOME/.docker/config.json" ]]; then
echo " 🐳 Docker authentication"
mkdir -p "$TEMP_DIR/secrets/.docker"
cp "$HOME/.docker/config.json" "$TEMP_DIR/secrets/.docker/"
fi
# Any license files or certificates (if found)
if [[ -f "$HOME/.vuescanrc" ]]; then
echo " 📄 VueScan license"
cp "$HOME/.vuescanrc" "$TEMP_DIR/secrets/"
fi
echo ""
echo -e "${YELLOW}🗜️ Creating encrypted archive...${NC}"
# Create the master encrypted backup
mkdir -p "$BACKUP_DIR/complete"
tar -czf - -C "$TEMP_DIR" secrets | \
gpg --symmetric --cipher-algo AES256 --compress-algo 2 \
--output "$BACKUP_DIR/complete/all_secrets_${TIMESTAMP}.tar.gz.gpg"
# Create comprehensive restore instructions
cat > "$BACKUP_DIR/complete/RESTORE_INSTRUCTIONS.md" << 'EOF'
# Complete Secrets Restore Instructions
## Master Encrypted Backup
This is your complete backup of all private keys, certificates, and sensitive configurations.
### What's Included
- SSH keys and configuration
- GPG private keys and keyring
- Docker authentication
- Application licenses
- Any other sensitive configuration files
### Restore Process
#### Step 1: Decrypt the backup
```bash
gpg --decrypt all_secrets_TIMESTAMP.tar.gz.gpg > all_secrets_TIMESTAMP.tar.gz
```
#### Step 2: Extract to temporary location first
```bash
mkdir ~/restore_temp
tar -xzf all_secrets_TIMESTAMP.tar.gz -C ~/restore_temp
```
#### Step 3: Review and restore selectively
```bash
# SSH (if needed)
cp -r ~/restore_temp/secrets/.ssh ~/
chmod 700 ~/.ssh
chmod 600 ~/.ssh/config ~/.ssh/*_rsa ~/.ssh/id_*
chmod 644 ~/.ssh/*.pub
# GPG (if needed)
cp -r ~/restore_temp/secrets/.gnupg ~/
chmod 700 ~/.gnupg
chmod 600 ~/.gnupg/*
chmod 700 ~/.gnupg/private-keys-v1.d
chmod 600 ~/.gnupg/private-keys-v1.d/*
gpgconf --kill gpg-agent # Restart GPG agent
# Docker (if needed)
mkdir -p ~/.docker
cp ~/restore_temp/secrets/.docker/config.json ~/.docker/
# Other files as needed
```
#### Step 4: Cleanup
```bash
rm -rf ~/restore_temp
rm all_secrets_TIMESTAMP.tar.gz
```
## Security Notes
- This backup contains ALL your private keys and secrets
- Keep it in multiple secure locations
- Test restore process periodically
- Never store unencrypted - always use GPG encryption
Created: $(date)
System: $(sw_vers -productVersion)
EOF
# Cleanup
rm -rf "$TEMP_DIR"
echo -e "${GREEN}✅ Complete encrypted backup created!${NC}"
echo ""
echo -e "${GREEN}📍 Location: $BACKUP_DIR/complete/all_secrets_${TIMESTAMP}.tar.gz.gpg${NC}"
echo -e "${GREEN}📋 Instructions: $BACKUP_DIR/complete/RESTORE_INSTRUCTIONS.md${NC}"
echo ""
echo -e "${YELLOW}💡 This replaces all individual backups - one encrypted container for everything!${NC}"
+170
View File
@@ -0,0 +1,170 @@
#!/usr/bin/env bash
# Backup all private keys and sensitive configurations
# Following prime directive: durable, thoughtful backup strategy
set -euo pipefail
BACKUP_DIR="$HOME/dotfiles/backups"
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
# Colors
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
RED='\033[0;31m'
NC='\033[0m'
echo -e "${YELLOW}🔐 Creating encrypted backup of private keys and secrets${NC}"
echo "Timestamp: $TIMESTAMP"
echo ""
# Create backup directory
mkdir -p "$BACKUP_DIR"/{ssh,gpg,docker}
# Function to create encrypted backup
create_encrypted_backup() {
local source_dir="$1"
local backup_name="$2"
local backup_path="$BACKUP_DIR/$backup_name"
if [[ -d "$source_dir" ]] || [[ -f "$source_dir" ]]; then
echo -e "${YELLOW}Backing up: $source_dir${NC}"
# Create tar archive and encrypt in one step
tar -czf - -C "$(dirname "$source_dir")" "$(basename "$source_dir")" | \
gpg --symmetric --cipher-algo AES256 --compress-algo 2 \
--output "${backup_path}/${backup_name}_${TIMESTAMP}.tar.gz.gpg"
# Create restore instructions
cat > "${backup_path}/RESTORE_INSTRUCTIONS.md" << EOF
# ${backup_name^} Restore Instructions
## Decrypting and Restoring ${backup_name^}
To restore from backup: \`${backup_name}_${TIMESTAMP}.tar.gz.gpg\`
### Step 1: Decrypt the backup
\`\`\`bash
gpg --decrypt ${backup_name}_${TIMESTAMP}.tar.gz.gpg > ${backup_name}_${TIMESTAMP}.tar.gz
\`\`\`
### Step 2: Extract the archive
\`\`\`bash
tar -xzf ${backup_name}_${TIMESTAMP}.tar.gz -C ~/
\`\`\`
### Step 3: Set correct permissions
\`\`\`bash
chmod 700 ~/$(basename "$source_dir")
find ~/$(basename "$source_dir") -type f -exec chmod 600 {} \;
\`\`\`
## Security Notes
- Keep this encrypted backup secure
- Contains private keys/sensitive data
- Test restore process periodically
## Backup Contents
This backup includes: $(basename "$source_dir")
Created: $(date)
System: $(sw_vers -productVersion)
EOF
echo -e "${GREEN}✅ Backup created: ${backup_path}/${backup_name}_${TIMESTAMP}.tar.gz.gpg${NC}"
else
echo -e "${RED}⚠️ Source not found: $source_dir${NC}"
fi
}
# Backup GPG private keys and keyring
if [[ -d "$HOME/.gnupg" ]]; then
echo -e "${YELLOW}🔑 Backing up GPG private keys and keyring...${NC}"
# Create temporary directory with essential GPG files
temp_gpg=$(mktemp -d)
mkdir -p "$temp_gpg/.gnupg"
# Copy essential GPG files (not temporary/socket files)
cp -r "$HOME/.gnupg/private-keys-v1.d" "$temp_gpg/.gnupg/" 2>/dev/null || true
cp "$HOME/.gnupg/pubring.kbx" "$temp_gpg/.gnupg/" 2>/dev/null || true
cp "$HOME/.gnupg/trustdb.gpg" "$temp_gpg/.gnupg/" 2>/dev/null || true
cp "$HOME/.gnupg/gpg.conf" "$temp_gpg/.gnupg/" 2>/dev/null || true
cp "$HOME/.gnupg/gpg-agent.conf" "$temp_gpg/.gnupg/" 2>/dev/null || true
cp "$HOME/.gnupg/dirmngr.conf" "$temp_gpg/.gnupg/" 2>/dev/null || true
# Create encrypted backup
tar -czf - -C "$temp_gpg" .gnupg | \
gpg --symmetric --cipher-algo AES256 --compress-algo 2 \
--output "$BACKUP_DIR/gpg/gpg_keyring_${TIMESTAMP}.tar.gz.gpg"
# Cleanup
rm -rf "$temp_gpg"
# Create restore instructions
cat > "$BACKUP_DIR/gpg/RESTORE_INSTRUCTIONS.md" << 'EOF'
# GPG Keyring Restore Instructions
## Decrypting and Restoring GPG Keys
To restore from backup: `gpg_keyring_TIMESTAMP.tar.gz.gpg`
### Step 1: Decrypt the backup
```bash
gpg --decrypt gpg_keyring_TIMESTAMP.tar.gz.gpg > gpg_keyring_TIMESTAMP.tar.gz
```
### Step 2: Extract to home directory
```bash
tar -xzf gpg_keyring_TIMESTAMP.tar.gz -C ~/
```
### Step 3: Set correct permissions
```bash
chmod 700 ~/.gnupg
chmod 600 ~/.gnupg/*
chmod 700 ~/.gnupg/private-keys-v1.d
chmod 600 ~/.gnupg/private-keys-v1.d/*
```
### Step 4: Restart GPG agent
```bash
gpgconf --kill gpg-agent
gpg --list-secret-keys # This will restart the agent
```
## Security Notes
- Contains your GPG private keys - highly sensitive
- Keep encrypted backup in secure location
- Test restore process periodically
## What's Included
- Private keys (private-keys-v1.d/)
- Public keyring (pubring.kbx)
- Trust database (trustdb.gpg)
- GPG configuration files
Created: $(date)
System: $(sw_vers -productVersion)
EOF
echo -e "${GREEN}✅ GPG keyring backup created${NC}"
fi
# Backup Docker configuration
if [[ -f "$HOME/.docker/config.json" ]]; then
create_encrypted_backup "$HOME/.docker" "docker"
fi
# Summary
echo ""
echo -e "${GREEN}🎉 Backup Summary:${NC}"
echo "📁 Backups stored in: $BACKUP_DIR"
echo "🔐 All backups are GPG encrypted with AES256"
echo "📋 Each backup includes restore instructions"
echo ""
echo -e "${YELLOW}💡 Recommended: Store a copy of these backups in a separate secure location${NC}"
echo -e "${YELLOW}📋 Test restore process periodically to ensure backups work${NC}"
+48
View File
@@ -0,0 +1,48 @@
#!/usr/bin/env bash
# Shell configuration diagnostic tool
# Following the prime directive: understand before fixing
set -euo pipefail
echo "🔍 Shell Configuration Diagnostic"
echo "=================================="
echo "1. Current shell: $SHELL"
echo "2. Zsh version: $(zsh --version)"
echo ""
echo "3. Checking for conflicting aliases:"
alias | grep -E "(cd=|chamber=)" || echo " No cd/chamber aliases found"
echo ""
echo "4. Testing functions.zsh syntax:"
if zsh -n ~/dotfiles/shell/functions.zsh; then
echo " ✅ Syntax is valid"
else
echo " ❌ Syntax error found"
fi
echo ""
echo "5. Testing incremental loading:"
echo " Loading environment.zsh..."
source ~/dotfiles/shell/environment.zsh && echo " ✅ OK" || echo " ❌ FAILED"
echo " Loading paths.zsh..."
source ~/dotfiles/shell/paths.zsh && echo " ✅ OK" || echo " ❌ FAILED"
echo " Loading functions.zsh..."
if source ~/dotfiles/shell/functions.zsh 2>&1 | head -1; then
echo " ✅ OK"
else
echo " ❌ FAILED - this is where the issue occurs"
fi
echo ""
echo "6. Checking for hidden characters around line 311:"
sed -n '310,312p' ~/dotfiles/shell/functions.zsh | cat -A
echo ""
echo "🎯 Recommended next steps:"
echo " - If syntax is clean, the issue is environmental"
echo " - Check what aliases exist before functions.zsh loads"
echo " - Consider isolation: load functions in clean shell"
+93
View File
@@ -0,0 +1,93 @@
#!/usr/bin/env zsh
# Safe shell configuration reload with conflict resolution
# Embodies μέτρον: thoughtful, measured approach to shell management
set -euo pipefail
DOTFILES_DIR="$HOME/dotfiles"
# Colors
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
RED='\033[0;31m'
NC='\033[0m'
echo -e "${YELLOW}🔧 Safe Shell Configuration Reload${NC}"
echo "Following prime directive: durable solutions over expedient fixes"
echo ""
# Step 1: Clear conflicting aliases
echo "1️⃣ Clearing potential conflicts..."
unalias cd chamber 2>/dev/null || true
echo " ✅ Aliases cleared"
# Step 2: Load in proper order with error handling
echo "2️⃣ Loading configuration modules..."
# Environment first (sets foundation)
if source "$DOTFILES_DIR/shell/environment.zsh" 2>/dev/null; then
echo " ✅ Environment loaded"
else
echo -e " ${RED}❌ Environment failed${NC}"
exit 1
fi
# Paths second (builds PATH properly)
if source "$DOTFILES_DIR/shell/paths.zsh" 2>/dev/null; then
echo " ✅ Paths loaded"
else
echo -e " ${RED}❌ Paths failed${NC}"
exit 1
fi
# Functions third (defines utilities)
if source "$DOTFILES_DIR/shell/functions.zsh" 2>/dev/null; then
echo " ✅ Functions loaded"
else
echo -e " ${RED}❌ Functions failed - attempting repair${NC}"
# Attempt repair: comment out problematic functions
echo " 🔧 Attempting automatic repair..."
# Create backup
cp "$DOTFILES_DIR/shell/functions.zsh" "$DOTFILES_DIR/shell/functions.zsh.backup.$(date +%Y%m%d_%H%M%S)"
# Temporarily disable chamber function
sed -i.tmp 's/^chamber()/# chamber() # DISABLED/' "$DOTFILES_DIR/shell/functions.zsh"
if source "$DOTFILES_DIR/shell/functions.zsh" 2>/dev/null; then
echo " ✅ Functions loaded (chamber disabled)"
echo " 📝 Chamber function disabled - investigate separately"
else
echo -e " ${RED}❌ Functions still failing${NC}"
# Restore backup
mv "$DOTFILES_DIR/shell/functions.zsh.backup.$(date +%Y%m%d_%H%M%S)" "$DOTFILES_DIR/shell/functions.zsh"
exit 1
fi
fi
# Aliases last (safe to override)
if source "$DOTFILES_DIR/shell/aliases.zsh" 2>/dev/null; then
echo " ✅ Aliases loaded"
else
echo -e " ${YELLOW}⚠️ Aliases had issues - continuing${NC}"
fi
echo ""
echo -e "${GREEN}✅ Shell configuration successfully reloaded${NC}"
echo "🎯 Test your sysupdate function now"
# Test critical functions
echo ""
echo "3️⃣ Testing critical functions..."
if declare -f sysupdate >/dev/null; then
echo " ✅ sysupdate function available"
else
echo -e " ${RED}❌ sysupdate not found${NC}"
fi
if declare -f detect_context >/dev/null; then
echo " ✅ detect_context function available"
else
echo -e " ${YELLOW}⚠️ detect_context not found${NC}"
fi
+18 -6
View File
@@ -53,13 +53,25 @@ link_file "$DOTFILES_DIR/.npmrc" "$HOME/.npmrc"
# Link plugin manifest
link_file "$DOTFILES_DIR/shell/.zsh-plugins.txt" "$HOME/.zsh-plugins.txt"
# SSH config (template only - user must customize)
if [ -f "$DOTFILES_DIR/ssh/config.example" ] && [ ! -f "$HOME/.ssh/config" ]; then
echo -e "${YELLOW}Creating SSH config from template...${NC}"
# SSH config
echo -e "${YELLOW}Setting up SSH configuration...${NC}"
if [ -f "$DOTFILES_DIR/ssh/config" ]; then
mkdir -p "$HOME/.ssh"
cp "$DOTFILES_DIR/ssh/config.example" "$HOME/.ssh/config"
link_file "$DOTFILES_DIR/ssh/config" "$HOME/.ssh/config"
chmod 600 "$HOME/.ssh/config"
echo -e "${YELLOW}⚠ Edit ~/.ssh/config with your actual values${NC}"
fi
# GPG configuration
echo -e "${YELLOW}Setting up GPG configuration...${NC}"
if [ -d "$DOTFILES_DIR/gnupg" ]; then
mkdir -p "$HOME/.gnupg"
chmod 700 "$HOME/.gnupg"
for gpg_file in gpg.conf gpg-agent.conf dirmngr.conf; do
if [ -f "$DOTFILES_DIR/gnupg/$gpg_file" ]; then
link_file "$DOTFILES_DIR/gnupg/$gpg_file" "$HOME/.gnupg/$gpg_file"
chmod 600 "$HOME/.gnupg/$gpg_file"
fi
done
fi
# Config directories
@@ -67,7 +79,7 @@ echo -e "${YELLOW}Linking config directories...${NC}"
mkdir -p "$HOME/.config"
# Link config subdirectories if they exist
for config_dir in git iterm2 kitty karabiner; do
for config_dir in git iterm2 kitty karabiner neofetch swiftbar; do
if [ -d "$DOTFILES_DIR/config/$config_dir" ]; then
link_file "$DOTFILES_DIR/config/$config_dir" "$HOME/.config/$config_dir"
fi