David F GliddenandClaude Opus 4.6
066a47a26b
Brewfile: stripped to essential tools (~600MB freed), removed boost, cmake, aerc, newsboat, fontforge, starship, and 24 auto-dependencies. Added caffeine, ollama, fastfetch, ocrmypdf, tea, sshpass, vitetris. Dropped 1password, iterm2, github-desktop, hazel, swiftbar, oversight. Shell: fixed all stale references (fzf, zoxide, starship, old paths, Homebrew node aliases). Updated project paths to ~/_Dev/. Added CapableMind aliases (cm, bmf, bmf-health, bmf-status, bmf-logs). Configs: removed iterm2, neofetch, swiftbar configs. Added capablemind (launchd plists, MCP example, bmf-start script). Updated SSH config with git.skemantix.com. Added CLAUDE.md to dotfiles. Scripts: consolidated 3 backup scripts into 1 (backup-all-secrets.sh), added pass store backup. Added setup-capablemind.sh for full environment reconstruction. Updated symlinks.sh for new config structure. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
150 lines
4.3 KiB
Bash
Executable File
150 lines
4.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Complete backup of all private keys, secrets, and sensitive configurations
|
|
# Following prime directive: one durable, encrypted container for everything
|
|
|
|
set -euo pipefail
|
|
|
|
BACKUP_DIR="$HOME/dotfiles/backups"
|
|
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
|
|
TEMP_DIR=$(mktemp -d)
|
|
|
|
# Colors
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[1;33m'
|
|
RED='\033[0;31m'
|
|
NC='\033[0m'
|
|
|
|
echo -e "${YELLOW}🔐 Creating complete encrypted backup of all secrets${NC}"
|
|
echo "Timestamp: $TIMESTAMP"
|
|
echo ""
|
|
|
|
# Create backup structure in temp directory
|
|
mkdir -p "$TEMP_DIR/secrets"/{ssh,gnupg,docker,config}
|
|
|
|
echo -e "${YELLOW}📦 Collecting all sensitive data...${NC}"
|
|
|
|
# SSH keys and config
|
|
if [[ -d "$HOME/.ssh" ]]; then
|
|
echo " 🔑 SSH keys and configuration"
|
|
cp -r "$HOME/.ssh" "$TEMP_DIR/secrets/"
|
|
fi
|
|
|
|
# GPG keyring and keys
|
|
if [[ -d "$HOME/.gnupg" ]]; then
|
|
echo " 🔐 GPG private keys and keyring"
|
|
mkdir -p "$TEMP_DIR/secrets/.gnupg"
|
|
|
|
# Copy essential GPG files (not temporary/socket files)
|
|
cp -r "$HOME/.gnupg/private-keys-v1.d" "$TEMP_DIR/secrets/.gnupg/" 2>/dev/null || true
|
|
cp "$HOME/.gnupg/pubring.kbx" "$TEMP_DIR/secrets/.gnupg/" 2>/dev/null || true
|
|
cp "$HOME/.gnupg/trustdb.gpg" "$TEMP_DIR/secrets/.gnupg/" 2>/dev/null || true
|
|
cp "$HOME/.gnupg/gpg.conf" "$TEMP_DIR/secrets/.gnupg/" 2>/dev/null || true
|
|
cp "$HOME/.gnupg/gpg-agent.conf" "$TEMP_DIR/secrets/.gnupg/" 2>/dev/null || true
|
|
cp "$HOME/.gnupg/dirmngr.conf" "$TEMP_DIR/secrets/.gnupg/" 2>/dev/null || true
|
|
fi
|
|
|
|
# Docker configuration
|
|
if [[ -f "$HOME/.docker/config.json" ]]; then
|
|
echo " 🐳 Docker authentication"
|
|
mkdir -p "$TEMP_DIR/secrets/.docker"
|
|
cp "$HOME/.docker/config.json" "$TEMP_DIR/secrets/.docker/"
|
|
fi
|
|
|
|
# Password store (pass — software licenses, credentials)
|
|
if [[ -d "$HOME/.password-store" ]]; then
|
|
echo " 🔑 Password store (pass)"
|
|
cp -r "$HOME/.password-store" "$TEMP_DIR/secrets/"
|
|
fi
|
|
|
|
# Any license files or certificates (if found)
|
|
if [[ -f "$HOME/.vuescanrc" ]]; then
|
|
echo " 📄 VueScan license"
|
|
cp "$HOME/.vuescanrc" "$TEMP_DIR/secrets/"
|
|
fi
|
|
|
|
echo ""
|
|
echo -e "${YELLOW}🗜️ Creating encrypted archive...${NC}"
|
|
|
|
# Create the master encrypted backup
|
|
mkdir -p "$BACKUP_DIR/complete"
|
|
tar -czf - -C "$TEMP_DIR" secrets | \
|
|
gpg --symmetric --cipher-algo AES256 --compress-algo 2 \
|
|
--output "$BACKUP_DIR/complete/all_secrets_${TIMESTAMP}.tar.gz.gpg"
|
|
|
|
# Create comprehensive restore instructions
|
|
cat > "$BACKUP_DIR/complete/RESTORE_INSTRUCTIONS.md" << 'EOF'
|
|
# Complete Secrets Restore Instructions
|
|
|
|
## Master Encrypted Backup
|
|
|
|
This is your complete backup of all private keys, certificates, and sensitive configurations.
|
|
|
|
### What's Included
|
|
- SSH keys and configuration
|
|
- GPG private keys and keyring
|
|
- Docker authentication
|
|
- Application licenses
|
|
- Any other sensitive configuration files
|
|
|
|
### Restore Process
|
|
|
|
#### Step 1: Decrypt the backup
|
|
```bash
|
|
gpg --decrypt all_secrets_TIMESTAMP.tar.gz.gpg > all_secrets_TIMESTAMP.tar.gz
|
|
```
|
|
|
|
#### Step 2: Extract to temporary location first
|
|
```bash
|
|
mkdir ~/restore_temp
|
|
tar -xzf all_secrets_TIMESTAMP.tar.gz -C ~/restore_temp
|
|
```
|
|
|
|
#### Step 3: Review and restore selectively
|
|
```bash
|
|
# SSH (if needed)
|
|
cp -r ~/restore_temp/secrets/.ssh ~/
|
|
chmod 700 ~/.ssh
|
|
chmod 600 ~/.ssh/config ~/.ssh/*_rsa ~/.ssh/id_*
|
|
chmod 644 ~/.ssh/*.pub
|
|
|
|
# GPG (if needed)
|
|
cp -r ~/restore_temp/secrets/.gnupg ~/
|
|
chmod 700 ~/.gnupg
|
|
chmod 600 ~/.gnupg/*
|
|
chmod 700 ~/.gnupg/private-keys-v1.d
|
|
chmod 600 ~/.gnupg/private-keys-v1.d/*
|
|
gpgconf --kill gpg-agent # Restart GPG agent
|
|
|
|
# Docker (if needed)
|
|
mkdir -p ~/.docker
|
|
cp ~/restore_temp/secrets/.docker/config.json ~/.docker/
|
|
|
|
# Other files as needed
|
|
```
|
|
|
|
#### Step 4: Cleanup
|
|
```bash
|
|
rm -rf ~/restore_temp
|
|
rm all_secrets_TIMESTAMP.tar.gz
|
|
```
|
|
|
|
## Security Notes
|
|
|
|
- This backup contains ALL your private keys and secrets
|
|
- Keep it in multiple secure locations
|
|
- Test restore process periodically
|
|
- Never store unencrypted - always use GPG encryption
|
|
|
|
Created: $(date)
|
|
System: $(sw_vers -productVersion)
|
|
EOF
|
|
|
|
# Cleanup
|
|
rm -rf "$TEMP_DIR"
|
|
|
|
echo -e "${GREEN}✅ Complete encrypted backup created!${NC}"
|
|
echo ""
|
|
echo -e "${GREEN}📍 Location: $BACKUP_DIR/complete/all_secrets_${TIMESTAMP}.tar.gz.gpg${NC}"
|
|
echo -e "${GREEN}📋 Instructions: $BACKUP_DIR/complete/RESTORE_INSTRUCTIONS.md${NC}"
|
|
echo ""
|
|
echo -e "${YELLOW}💡 This replaces all individual backups - one encrypted container for everything!${NC}" |