0 Fork 0

T

connor fb62fdfc8e todo_rollover: atomic write, honest output, real argument handling

Hardening pass over the script. Every fix below was reproduced before being
made; two findings that looked serious were tested and dropped.

THE ONE THAT MATTERED. The write was not atomic and could destroy a day's
todos. It did:

    cp -p "$src" "$dst"      # yesterday's UNPRUNED note lands at the target
    cat "$tmp" > "$dst"      # then gets overwritten with the real content

Interrupted between those, today's note silently becomes yesterday's,
unpruned. Interrupted during the redirect, it is truncated. Content is now
built in a temp inside the notes directory and renamed over the target, so
the target is either the old file or the new one and never a half-written
mixture.

⚠ `cp -p` was NOT redundant, and a review pass that recommended removing it
was wrong. A bare `cat > "$dst"` preserves the mode only when the target
already exists; on the normal path the target is new and takes 0644 from the
umask. Measured: source 600 -> new file via redirect 644, pre-existing file
600. The mode is now set explicitly with `chmod --reference` before the
rename, which is correct in both cases.

OUTPUT THAT LIED. The success line always said "(pruned)", including when
the prune script was missing and the plain-copy fallback ran. That is the
same defect as the error message that advertised a --force flag before one
existed: a user-facing string asserting work the code did not do. The
message now reports which path was taken, and a prune script that FAILS is
reported instead of aborting on set -e with no explanation.

ARGUMENT HANDLING. Anything that was not --force became a date, so
`todo_rollover --dry-run` failed with "source note .../--dry-run.md not
found" -- a missing-file error for what was really a bad flag. Unknown
options are now rejected, `--` and `-h/--help` work, arity is checked, and
dates are validated for shape AND realness (2026-13-45 is caught up front).

ALSO FIXED
- `[[ -x $PRUNE ]]` was the wrong test: PRUNE is run as `python3 "$PRUNE"`
  and needs no execute bit, so a working prune script was silently skipped.
  Now -f.
- src == dst aborted on a raw `cp: ... are the same file`. Checked explicitly
  up front with a clear message. (It did fail safe -- a review pass claiming
  the source was destroyed was tested and is not reproducible.)
- The heading regex rejected "# 2026-09-21 " with a trailing space and
  prepended a duplicate heading. Now tolerates surrounding whitespace.
- `${tmp}.new` escaped the EXIT trap and leaked on interrupt.
- Dead `mkdir -p "$NOTES"` after the source check had already proven the
  directory exists, and a `mode=` variable that was assigned and never used.

Verified: unknown flag/bad date/missing source exit 1, existing target exits
2, --help exits 0, mode 600 survives the rollover, a non-executable prune
script is used, a failing one leaves the target untouched, the trailing-space
heading is retitled rather than duplicated, and no temp files are left behind.

2026-09-22 11:01:26 -04:00

common

todo_rollover: atomic write, honest output, real argument handling

2026-09-22 11:01:26 -04:00

dotbot @ 087840716e

Rebuild dotfiles as one branch with per-host layers

2026-09-14 14:24:37 -04:00

hosts

sunshine config and todo_rollover script

2026-09-22 10:30:34 -04:00

README.md

dotfiles

Everything that makes a machine mine. One branch, four hosts, no per-machine branches — see Why not a branch per machine below.

Bootstrap a bare machine

git clone --recurse-submodules <remote> ~/.dotfiles
cd ~/.dotfiles && ./install
cp common/zsh/secrets.zsh.example ~/.secrets.zsh && chmod 600 ~/.secrets.zsh   # then fill it in
common/bin/pkg-restore                                                         # install the packages
sudo install -m755 hosts/<host>/sbin/* /usr/local/bin/                         # if that host has any

install picks its host layer from hostname, lowercased. If there is no meta/hosts/<hostname>.conf.yaml it stops rather than silently applying only the base config — a half-configured machine that reports success is worse than a clear failure. For a new machine, copy the closest host config and edit.

Layout

Path	What lives here
`meta/base.conf.yaml`	links every host gets
`meta/hosts/<host>.conf.yaml`	links only that host gets
`common/`	host-agnostic config and scripts
`hosts/<host>/`	that machine's deltas
`hosts/<host>/bin`	scripts only that machine needs; shadows `common/bin` on `PATH`
`hosts/<host>/sbin`	scripts needing root at `/usr/local/bin`; not installed by `./install`
`packages/`	what is installed, per host

Where host-specific things go

The rule is that a file is shared unless the machines genuinely disagree, and when they do the disagreement is expressed as a small file rather than a fork.

zsh — common/zsh/{zshenv,zshrc} source hosts/$DOTFILES_HOST/zsh/*.zsh (interactive) and *.zshenv (all shells). Host fragments are 1–7 lines each. Things that vary by distro rather than by machine — the oh-my-zsh prefix, the zsh-syntax-highlighting path, fd vs fdfind — are probed in common/ instead, so they need no host file at all.
hyprland — common/hypr/hyprland.conf sources the host layer twice: local-env.conf near the top for anything used later in the file ($browser, env, monitor), and local.conf at the bottom for gaps, binds and overrides. Hyprland resolves variables in file order, so a single source at the end would leave $browser undefined at its first use.
waybar — one shared config and style.css; the latter @imports local.css for per-screen padding. colors.css is pywal output, regenerated by update_colors.sh.
git — shared settings in common/git/config, identity via an include of hosts/<host>/git/identity.

Singleton automations

inbox-tidy, movie-recs, rent-utilities and ddns must run on mainframe and nowhere else. They mutate a live mailbox, send notifications, send bills, and update live DNS records. Two independent guards:

The units live only in hosts/mainframe/systemd/, never common/, so no other host's config can reference them.
Each .service carries ConditionHost=mainframe. If one is ever enabled on the wrong machine, systemd logs a condition failure instead of running it.

The scripts themselves are in hosts/mainframe/bin. hypr_refresh on system76 is not a singleton — it is per-machine and correctly unguarded.

Verify after any change: systemctl --user list-timers --all.

`~/.local/bin` is not this repo

It used to be a symlink to scripts/, with GOPATH pointing inside it. Every go install and pipx install therefore wrote into version control — 2.2 GB on the work laptop, 426 MB on the personal one. git status was permanently unusable, which is why nothing was committed for a year.

Now ~/.local/bin is an ordinary directory owned by package managers, GOPATH is ~/.local/share/go, and this repo's common/bin and hosts/$HOST/bin go on PATH directly. Do not link a directory that other tools write into.

Secrets

Never in the repo. ~/.secrets.zsh, mode 600, sourced at the end of zshenv so non-interactive shells get it too — deliberately not rbw, which would add a vault round-trip to every script and every ssh host cmd. rbw stays for lazy, interactive use, as in common/zsh/opencode.zsh.

Back up edits by hand as ~/.secrets.zsh.pre-<thing>, matching the convention used across ~/config.

Keeping it honest

dots reports uncommitted files, ahead/behind, and whether the package manifest has gone stale. zshrc calls dots --nag at login, which prints nothing when everything is clean.

After installing something worth keeping: pkg-snapshot, then commit the diff.

Why not a branch per machine

That was the previous design. A shared change had to be cherry-picked into four branches by hand, so it got made locally and never committed; the next change landed on top of an uncommitted one, and the cost of untangling grew until nobody committed at all. By September 2026 there were 146 dirty files across three machines, two histories that had never met, and a NAS that had never been enrolled. Host layers cost a few small files and remove the merge entirely.

README.md Unescape Escape