bcherb2
a001406a33
A disposable ubuntu container, a fake private tier and a fake bootstrap endpoint, so the whole documented path — chezmoi init --apply, dotup pick, dotup private, cmp apply, dotsecrets — can run end to end without touching a real machine or a real credential. The fake tier mirrors the real one's structure (seven secrets and one alias) because dotsecrets is copied verbatim and the "8 exports, not 7" assertion depends on that cardinality; its ids are sequential and obviously synthetic. check-verbatim.sh keeps the fake tier's copies of shipped files honest, and snapshot.sh records file modes so a 644 where a 600 belongs is a diff.
72 lines
2.8 KiB
Cheetah
72 lines
2.8 KiB
Cheetah
{{- $name := get . "gitName" -}}
|
|
{{- $email := get . "gitEmail" -}}
|
|
{{- $signing := get . "gitSigningKey" -}}
|
|
{{- $wan := get . "giteaWanSsh" -}}
|
|
{{- $lan := get . "giteaLanSsh" -}}
|
|
; ~/.config/git/config.local -- PRIVATE tier.
|
|
;
|
|
; The other half of the seam. ~/.gitconfig comes from the public repo, carries
|
|
; no [user], and ends with `[include] path = ~/.config/git/config.local`. Git
|
|
; treats a missing include as a no-op, so a public-only machine reads the
|
|
; public half and stops -- and `git commit` correctly refuses to guess who you
|
|
; are.
|
|
;
|
|
; Everything here is identity, not configuration: it is the answer to "whose
|
|
; machine is this", which is exactly the question the public tier must not be
|
|
; able to answer.
|
|
;
|
|
; Values come from the [data] prompts in .chezmoi.toml.tmpl, asked once at
|
|
; `chezmoi init`. Re-answer them with `cmp init` (see README).
|
|
|
|
{{ if and $name $email -}}
|
|
[user]
|
|
name = {{ $name }}
|
|
email = {{ $email }}
|
|
{{- if $signing }}
|
|
signingkey = {{ $signing }}
|
|
[commit]
|
|
gpgsign = true
|
|
[tag]
|
|
gpgsign = true
|
|
{{- end }}
|
|
{{- else -}}
|
|
; NO IDENTITY CONFIGURED.
|
|
;
|
|
; gitName and/or gitEmail are empty in the chezmoi config, which means either
|
|
; you pressed enter through the prompts or something overwrote
|
|
; ~/.config/chezmoi/chezmoi.toml after this tier was initialised. Re-run:
|
|
;
|
|
; chezmoi init -S ~/.local/share/dotfiles-private
|
|
;
|
|
; Until then git will refuse to commit, which is the correct complaint.
|
|
{{- end }}
|
|
|
|
; Every remote in every repo you own is ssh. This rewrite is what lets a
|
|
; copy-pasted https:// GitHub URL clone over the key you actually have, which
|
|
; matters most on a machine built ten minutes ago. It lived in the old
|
|
; dot_gitconfig; phase 3 removed it from the public tier because it names an
|
|
; authentication method tied to your keys, not a neutral default.
|
|
[url "git@github.com:"]
|
|
insteadOf = https://github.com/
|
|
|
|
{{ if $wan -}}
|
|
; Gitea clone/push shortcuts: git clone gitea:ben/repo.git
|
|
[url "{{ $wan }}"]
|
|
insteadOf = gitea:
|
|
{{ end -}}
|
|
{{ if $lan -}}
|
|
[url "{{ $lan }}"]
|
|
insteadOf = gitea-lan:
|
|
{{ end }}
|
|
{{- if and $wan $lan }}
|
|
[alias]
|
|
; Configure `origin` to push to BOTH gitea servers at once. Run once inside
|
|
; a repo whose origin points at either gitea host:
|
|
;
|
|
; git dual-gitea
|
|
;
|
|
; After this, `git push` writes to WAN + LAN simultaneously. Fetch/pull
|
|
; continues to use origin's existing fetch URL.
|
|
dual-gitea = "!f() { url=$(git remote get-url origin) || { echo 'no origin remote' >&2; return 1; }; p=${url#gitea:}; p=${p#gitea-lan:}; p=${p#{{ $wan }}}; p=${p#{{ $lan }}}; if [ \"$p\" = \"$url\" ]; then echo \"origin is not a gitea remote: $url\" >&2; return 1; fi; git config --unset-all remote.origin.pushurl 2>/dev/null; git remote set-url --add --push origin \"gitea:$p\"; git remote set-url --add --push origin \"gitea-lan:$p\"; echo 'Dual-push configured on origin:'; git remote -v; }; f"
|
|
{{- end }}
|