From 8b6c56b3003164efe08b7cd1bfc388a7133a37b0 Mon Sep 17 00:00:00 2001 From: Riz Ashraf Date: Tue, 7 Apr 2026 00:47:41 +0100 Subject: [PATCH] Harden .ssh security and templatize shell configs --- .chezmoiignore.tmpl | 4 + dot_bashrc => dot_bashrc.tmpl | 53 +++++-------- dot_zshrc => dot_zshrc.tmpl | 144 ++++++++++++++-------------------- run_once_install_modules.ps1 | 3 +- 4 files changed, 87 insertions(+), 117 deletions(-) rename dot_bashrc => dot_bashrc.tmpl (67%) rename dot_zshrc => dot_zshrc.tmpl (51%) diff --git a/.chezmoiignore.tmpl b/.chezmoiignore.tmpl index 879e822..f1f31d4 100644 --- a/.chezmoiignore.tmpl +++ b/.chezmoiignore.tmpl @@ -2,6 +2,10 @@ .conan/data .conan2/p/** .conan/data/** +.ssh +.ssh/** +id_* +*.ppk {{ if eq .chezmoi.os "windows" }} install_wsl_plugins.sh {{ else }} diff --git a/dot_bashrc b/dot_bashrc.tmpl similarity index 67% rename from dot_bashrc rename to dot_bashrc.tmpl index e84ae38..9ccfb83 100644 --- a/dot_bashrc +++ b/dot_bashrc.tmpl @@ -9,7 +9,6 @@ case $- in esac # don't put duplicate lines or lines starting with space in the history. -# See bash(1) for more options HISTCONTROL=ignoreboth # append to the history file, don't overwrite it @@ -23,10 +22,6 @@ HISTFILESIZE=2000 # update the values of LINES and COLUMNS. shopt -s checkwinsize -# If set, the pattern "**" used in a pathname expansion context will -# match all files and zero or more directories and subdirectories. -#shopt -s globstar - # make less more friendly for non-text input files, see lesspipe(1) [ -x /usr/bin/lesspipe ] && eval "$(SHELL=/bin/sh lesspipe)" @@ -40,19 +35,11 @@ case "$TERM" in xterm-color|*-256color) color_prompt=yes;; esac -# uncomment for a colored prompt, if the terminal has the capability; turned -# off by default to not distract the user: the focus in a terminal window -# should be on the output of commands, not on the prompt -#force_color_prompt=yes - if [ -n "$force_color_prompt" ]; then if [ -x /usr/bin/tput ] && tput setaf 1 >&/dev/null; then - # We have color support; assume it's compliant with Ecma-48 - # (ISO/IEC-6429). (Lack of such support is extremely rare, and such - # a case would tend to support setf rather than setaf.) - color_prompt=yes + color_prompt=yes else - color_prompt= + color_prompt= fi fi @@ -74,40 +61,26 @@ esac # enable color support of ls and also add handy aliases if [ -x /usr/bin/dircolors ]; then - test -r ~/.dircolors && eval "$(dircolors -b ~/.dircolors)" || eval "$(dircolors -b)" + test -r ~/.dircolors && eval "$(dircolors -b ~/.dircolors)" || eval "$(dircolors -b)" alias ls='ls --color=auto' - #alias dir='dir --color=auto' - #alias vdir='vdir --color=auto' - alias grep='grep --color=auto' alias fgrep='fgrep --color=auto' alias egrep='egrep --color=auto' fi -# colored GCC warnings and errors -#export GCC_COLORS='error=01;31:warning=01;35:note=01;36:caret=01;32:locus=01:quote=01' - # some more ls aliases alias ll='ls -alF' alias la='ls -A' alias l='ls -CF' -# Add an "alert" alias for long running commands. Use like so: -# sleep 10; alert +# Add an "alert" alias for long running commands. alias alert='notify-send --urgency=low -i "$([ $? = 0 ] && echo terminal || echo error)" "$(history|tail -n1|sed -e '\''s/^\s*[0-9]\+\s*//;s/[;&|]\s*alert$//'\'')"' -# Alias definitions. -# You may want to put all your additions into a separate file like -# ~/.bash_aliases, instead of adding them here directly. -# See /usr/share/doc/bash-doc/examples in the bash-doc package. - if [ -f ~/.bash_aliases ]; then . ~/.bash_aliases fi -# enable programmable completion features (you don't need to enable -# this, if it's already enabled in /etc/bash.bashrc and /etc/profile -# sources /etc/bash.bashrc). +# enable programmable completion features if ! shopt -oq posix; then if [ -f /usr/share/bash-completion/bash_completion ]; then . /usr/share/bash-completion/bash_completion @@ -115,14 +88,28 @@ if ! shopt -oq posix; then . /etc/bash_completion fi fi + export PYENV_ROOT="$HOME/.pyenv" export PATH="$PYENV_ROOT/bin:$PATH" if command -v pyenv 1>/dev/null 2>&1; then eval "$(pyenv init --path)" fi -export PYENV_ROOT="$HOME/.pyenv" + export XDG_DATA_DIRS="/usr/local/share:/usr/share:${XDG_DATA_DIRS:-/usr/local/share:/usr/share}" alias ghostty="ghostty 2>/dev/null" +{{- if eq .chezmoi.os "linux" }} +# --- Linux/WSL Specifics --- +{{- if (lstat (joinPath .chezmoi.homeDir ".local/bin/env")) }} . "$HOME/.local/bin/env" +{{- end }} +{{- if (lstat (joinPath .chezmoi.homeDir ".cargo/env")) }} . "$HOME/.cargo/env" +{{- end }} +cd ~ +{{- end }} + +{{- if eq .chezmoi.os "windows" }} +# --- Windows Specifics --- +# Add your windows-specific bash (git bash) tweaks here if any. +{{- end }} diff --git a/dot_zshrc b/dot_zshrc.tmpl similarity index 51% rename from dot_zshrc rename to dot_zshrc.tmpl index 5bc3524..e31c3fd 100644 --- a/dot_zshrc +++ b/dot_zshrc.tmpl @@ -1,11 +1,14 @@ -cd ~ +{{- if eq .chezmoi.os "linux" -}} +# Instant prompt for Powerlevel10k +if [[ -r "${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh" ]]; then + source "${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh" +fi -# if [[ -r "${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh" ]]; then -# source "${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh" -# fi - -# --- Homebrew Initialization (Primary) --- -eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)" +# --- Homebrew Initialization --- +if [ -f "/home/linuxbrew/.linuxbrew/bin/brew" ]; then + eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)" +fi +{{- end }} VI_MODE_SET_CURSOR=true MODE_INDICATOR="%F{yellow}+%f" @@ -43,26 +46,28 @@ HISTSIZE=10000 SAVEHIST=10000 HISTFILE=~/.zsh_history -# # to customize prompt, run `p10k configure` or edit ~/.p10k.zsh. -# [[ ! -f ~/.p10k.zsh ]] || source ~/.p10k.zsh +# to customize prompt, run `p10k configure` or edit ~/.p10k.zsh. +[[ ! -f ~/.p10k.zsh ]] || source ~/.p10k.zsh export PYENV_ROOT="$HOME/.pyenv" export JDK8_HOME="$HOME/.jdks/jdk-1.8" -export JDK8_32_HOME="$HOME/.jdks/jdk-1.8-i586" export JDK21_HOME="$HOME/.jdks/jdk-21" export JDK25_HOME="$HOME/.jdks/jdk-25" -export JAVA_HOME="$JDK25_HOME" +export JAVA_HOME="$JDK21_HOME" export GROOVY_HOME="$HOME/devtools/groovy" export M2_HOME="$HOME/devtools/maven" export NODE_ENV=development -export GDK_BACKEND=x11 -# PATH Configuration (Homebrew and Local Bin prioritized) -export PATH="$HOME/.local/bin:$PATH:$JAVA_HOME/bin:$M2_HOME/bin:$GROOVY_HOME/bin:$PYENV_ROOT/bin:$HOME/.npm-global/bin:/snap/bin" +{{- if eq .chezmoi.os "linux" }} +export GDK_BACKEND=x11 +export PNPM_HOME="$HOME/.local/share/pnpm" +export PATH="$PNPM_HOME:$HOME/.local/bin:$PATH:$JAVA_HOME/bin:$M2_HOME/bin:$GROOVY_HOME/bin:$PYENV_ROOT/bin:$HOME/.npm-global/bin:/snap/bin" +{{- else }} +export PATH="$JAVA_HOME/bin:$M2_HOME/bin:$GROOVY_HOME/bin:$PYENV_ROOT/bin:$HOME/.npm-global/bin:/snap/bin:$HOME/.local/bin:/usr/local/bin:/usr/bin" +{{- end }} typeset -g POWERLEVEL9K_INSTANT_PROMPT=quiet -export ZSH="/home/riz/.oh-my-zsh" -# ZSH_THEME="powerlevel10k/powerlevel10k" +export ZSH="$HOME/.oh-my-zsh" plugins=( git @@ -70,19 +75,26 @@ plugins=( zsh-autosuggestions zsh-history-substring-search zsh-completions + {{- if eq .chezmoi.os "linux" }} fzf-tab + {{- end }} zsh-syntax-highlighting ) +{{- if eq .chezmoi.os "linux" }} # fzf-tab settings zstyle ':fzf-tab:complete:cd:*' fzf-preview 'eza -1 --color=always $realpath' zstyle ':fzf-tab:complete:*' fzf-flags --color=fg:1,fg+:2 --height=50% zstyle ':completion:*:descriptions' format '[%d]' zstyle ':completion:*' list-colors ${(s.:.)LS_COLORS} +{{- end }} + +if command -v fzf >/dev/null 2>&1; then + source <(fzf --zsh) +fi -source <(fzf --zsh) export FZF_DEFAULT_OPTS="--height 40% --layout=reverse --border --preview 'bat --style=numbers --color=always --line-range :500 {}'" -export FZF_CTRL_T_OPTS="--preview 'bat --style=numbers --color=always --line-range :500 {}'" +export FZF_CTRL_T_OPTS="--preview 'bat --style=numbers --color=always --line-range :500 {}'" export FZF_ALT_C_OPTS="--preview 'eza --tree --icons --color=always {} | head -200'" # General Aliases @@ -90,35 +102,36 @@ alias ai='gemini' alias vi=nvim alias g=git alias lg=lazygit -alias code="/mnt/c/Users/reazul.ashraf/AppData/Local/Programs/Microsoft\ VS\ Code/bin/code" +alias code="/mnt/c/Users/reazul.ashraf/AppData/Local/Programs/Microsoft\ VS\ Code/bin/code" alias pbcopy='xclip -selection clipboard' alias pbpaste='xclip -selection clipboard -o' -# --- Gold Standard Tool Mapping (Deduplicated & High Performance) --- -# Homebrew provides these; aliases ensure they are used consistently. -alias ls='eza --icons --group-directories-first' -alias la='eza --icons -la --group-directories-first --git' -alias tree='eza --tree --icons' -alias cat='bat' -alias find='fd' -alias ff='fd' -alias grep='rg' -alias sed='sd' -alias awk='choose' -alias ps='procs' -alias top='btm' -alias curl='xh' -alias zip='ouch' -alias tar='ouch' -alias diff='delta' -alias tldr='tealdeer' -# -------------------------------------------------------------------- +# --- Gold Standard Tool Mapping --- +if command -v eza >/dev/null 2>&1; then + alias ls='eza --icons --group-directories-first' + alias la='eza --icons -la --group-directories-first --git' + alias tree='eza --tree --icons' +else + alias ls='ls --color=auto' + alias la='ls -la' +fi + +if command -v bat >/dev/null 2>&1; then alias cat='bat'; fi +if command -v batcat >/dev/null 2>&1; then alias cat='batcat'; alias bat='batcat'; fi +if command -v fd >/dev/null 2>&1; then alias find='fd'; alias ff='fd'; fi +if command -v rg >/dev/null 2>&1; then alias grep='rg'; fi +if command -v sd >/dev/null 2>&1; then alias sed='sd'; fi +if command -v choose >/dev/null 2>&1; then alias awk='choose'; fi +if command -v procs >/dev/null 2>&1; then alias ps='procs'; fi +if command -v btm >/dev/null 2>&1; then alias top='btm'; fi +if command -v xh >/dev/null 2>&1; then alias curl='xh'; fi +if command -v ouch >/dev/null 2>&1; then alias zip='ouch'; alias tar='ouch'; fi +if command -v delta >/dev/null 2>&1; then alias diff='delta'; fi # Navigation alias ..='cd ..' alias ...='cd ../..' alias ....='cd ../../..' -alias .....='cd ../../../..' # Functions fcd() { @@ -127,62 +140,27 @@ fcd() { } alias jdk8home="export JAVA_HOME=$JDK8_HOME" -alias jdk8home32="export JAVA_HOME=$JDK8_32_HOME" alias jdk21home="export JAVA_HOME=$JDK21_HOME" alias jdk25home="export JAVA_HOME=$JDK25_HOME" -java() { - $JAVA_HOME/bin/java $@ -} - gsquash() { git reset --soft head~$(git rev-list --count head ^$1) echo "To complete then do, git push --force" } -# Development Helpers -dmvn() { - ws="/mnt/c/users/reazul.ashraf/workspace/uichannel-commission-bootstrap" - id="$(docker run -t -d -u root:root -v /home/riz/.m2:/volume/.m2 -w $ws -v $ws:$ws:rw,z -v $ws@tmp:$ws@tmp:rw,z maven:3-openjdk-8-slim cat)" - docker exec -ti $id ls -alp $ws - docker kill $id -} - -sonarscan() { - MAVEN_OPTS="-Dsonar.branch.name=$(git branch --show-current)" JAVA_HOME=$JDK21_HOME mvn org.sonarsource.scanner.maven:sonar-maven-plugin:RELEASE:sonar -DskipTests -} - -# Environment Initializations -eval "$(zoxide init --cmd z zsh)" - -# pnpm -export PNPM_HOME="/home/riz/.local/share/pnpm" -case ":$PATH:" in - *":$PNPM_HOME:"*) ;; - *) export PATH="$PNPM_HOME:$PATH" ;; -esac - -export GOOGLE_CLOUD_PROJECT=inse-r-and-d -export XDG_DATA_DIRS="/usr/local/share:/usr/share:${XDG_DATA_DIRS:-/usr/local/share:/usr/share}" -alias ghostty="ghostty 2>/dev/null" -alias gimp='GDK_BACKEND=x11 gimp' -export PYTHONWARNINGS="ignore:Your system is avx2 capable:RuntimeWarning" - -# Cargo / Local Bin -[ -f "$HOME/.local/bin/env" ] && . "$HOME/.local/bin/env" -[ -f "$HOME/.cargo/env" ] && . "$HOME/.cargo/env" - -# Autosuggestions color (make it readable) -export ZSH_AUTOSUGGEST_HIGHLIGHT_STYLE='fg=cyan' - source $ZSH/oh-my-zsh.sh - +{{- if eq .chezmoi.os "linux" }} export STARSHIP_DEVICE_COLOR="orange" export STARSHIP_CONFIG=~/.config/starship_linux.toml eval "$(starship init zsh)" - - alias refresh-vpn='powershell.exe -ExecutionPolicy Bypass -File "C:\Users\reazul.ashraf\scripts\refresh_wsl_vpn.ps1"' +{{- end }} -export GEMINI_CLI_HOME="/mnt/c/Users/reazul.ashraf" +eval "$(zoxide init --cmd z zsh)" + +# Autosuggestions color +export ZSH_AUTOSUGGEST_HIGHLIGHT_STYLE='fg=cyan' + +# Start in ~ +cd ~ diff --git a/run_once_install_modules.ps1 b/run_once_install_modules.ps1 index 882bf8f..2b628e6 100644 --- a/run_once_install_modules.ps1 +++ b/run_once_install_modules.ps1 @@ -1,12 +1,13 @@ Write-Host "Checking for required PowerShell modules..." $modules = @( + "oh-my-posh", "posh-git", "Profiler", "PSFzf", "PSProfiler", "PSScriptAnalyzer", - "Terminal-Icons", + "Terminal-Icons" ) foreach ($mod in $modules) {