Dotty private

dotty private¶

Manage the encrypted private dotfiles repository.

Synopsis¶

The private repository carries what the public one must not: git identities, ssh host configuration, known_hosts — anything that leaks PII. Each profile keeps its own home tree there, age-encrypted to that profile's security keys alone, so the repository stores ciphertext only and a leak exposes nothing. Decrypted files live under the dotty data directory (0700) and reach $HOME through an active-profile symlink, so activating another profile swaps the whole private identity at once.

Examples¶

  dotty private init ~/Repos/dotfiles.private
  dotty private enroll --serial 17741369
  dotty private encrypt ~/.ssh/known_hosts
  dotty private status

Options¶

  -h, --help          help for private
      --repo string   private repository (default: the active profile's stored answer)

Options inherited from parent commands¶

      --profile string   profile to operate on (defaults to the active profile)

SEE ALSO¶

• dotty - Utilities for a terminal-driven workflow and dotfiles.
• dotty private edit - Edit an encrypted entry in place.
• dotty private encrypt - Adopt a live file into the private profile, encrypted.
• dotty private enroll - Add a security key to the profile's recipients.
• dotty private init - Scaffold or adopt the private repository.
• dotty private link - Decrypt the profile's private tree and link it into $HOME.
• dotty private rekey - Re-encrypt every entry to the profile's current recipients.
• dotty private status - Report each private entry's freshness, plus repository hygiene.
• dotty private verify - Check the repository for plaintext accidents.