Harden .ssh security and templatize shell configs

.chezmoiignore.tmpl

@@ -2,6 +2,10 @@
 .conan/data
 .conan2/p/**
 .conan/data/**
+.ssh
+.ssh/**
+id_*
+*.ppk
 {{ if eq .chezmoi.os "windows" }}
 install_wsl_plugins.sh
 {{ else }}

dot_bashrc.tmpl

@@ -9,7 +9,6 @@ case $- in
 esac
 
 # don't put duplicate lines or lines starting with space in the history.
-# See bash(1) for more options
 HISTCONTROL=ignoreboth
 
 # append to the history file, don't overwrite it
@@ -23,10 +22,6 @@ HISTFILESIZE=2000
 # update the values of LINES and COLUMNS.
 shopt -s checkwinsize
 
-# If set, the pattern "**" used in a pathname expansion context will
-# match all files and zero or more directories and subdirectories.
-#shopt -s globstar
-
 # make less more friendly for non-text input files, see lesspipe(1)
 [ -x /usr/bin/lesspipe ] && eval "$(SHELL=/bin/sh lesspipe)"
 
@@ -40,16 +35,8 @@ case "$TERM" in
     xterm-color|*-256color) color_prompt=yes;;
 esac
 
-# uncomment for a colored prompt, if the terminal has the capability; turned
-# off by default to not distract the user: the focus in a terminal window
-# should be on the output of commands, not on the prompt
-#force_color_prompt=yes
-
 if [ -n "$force_color_prompt" ]; then
     if [ -x /usr/bin/tput ] && tput setaf 1 >&/dev/null; then
-	# We have color support; assume it's compliant with Ecma-48
-	# (ISO/IEC-6429). (Lack of such support is extremely rare, and such
-	# a case would tend to support setf rather than setaf.)
         color_prompt=yes
     else
         color_prompt=
@@ -76,38 +63,24 @@ esac
 if [ -x /usr/bin/dircolors ]; then
     test -r ~/.dircolors && eval "$(dircolors -b ~/.dircolors)" || eval "$(dircolors -b)"    
     alias ls='ls --color=auto'
-    #alias dir='dir --color=auto'
-    #alias vdir='vdir --color=auto'
-
     alias grep='grep --color=auto'
     alias fgrep='fgrep --color=auto'
     alias egrep='egrep --color=auto'
 fi
 
-# colored GCC warnings and errors
-#export GCC_COLORS='error=01;31:warning=01;35:note=01;36:caret=01;32:locus=01:quote=01'
-
 # some more ls aliases
 alias ll='ls -alF'
 alias la='ls -A'
 alias l='ls -CF'
 
-# Add an "alert" alias for long running commands.  Use like so:
+# Add an "alert" alias for long running commands.
-#   sleep 10; alert
 alias alert='notify-send --urgency=low -i "$([ $? = 0 ] && echo terminal || echo error)" "$(history|tail -n1|sed -e '\''s/^\s*[0-9]\+\s*//;s/[;&|]\s*alert$//'\'')"'
 
-# Alias definitions.
-# You may want to put all your additions into a separate file like
-# ~/.bash_aliases, instead of adding them here directly.
-# See /usr/share/doc/bash-doc/examples in the bash-doc package.
-
 if [ -f ~/.bash_aliases ]; then
     . ~/.bash_aliases
 fi
 
-# enable programmable completion features (you don't need to enable
+# enable programmable completion features
-# this, if it's already enabled in /etc/bash.bashrc and /etc/profile
-# sources /etc/bash.bashrc).
 if ! shopt -oq posix; then
   if [ -f /usr/share/bash-completion/bash_completion ]; then
     . /usr/share/bash-completion/bash_completion
@@ -115,14 +88,28 @@ if ! shopt -oq posix; then
     . /etc/bash_completion
   fi
 fi
+
 export PYENV_ROOT="$HOME/.pyenv"
 export PATH="$PYENV_ROOT/bin:$PATH"
 if command -v pyenv 1>/dev/null 2>&1; then
  eval "$(pyenv init --path)"
 fi
-export PYENV_ROOT="$HOME/.pyenv"
+
 export XDG_DATA_DIRS="/usr/local/share:/usr/share:${XDG_DATA_DIRS:-/usr/local/share:/usr/share}"
 alias ghostty="ghostty 2>/dev/null"
 
+{{- if eq .chezmoi.os "linux" }}
+# --- Linux/WSL Specifics ---
+{{- if (lstat (joinPath .chezmoi.homeDir ".local/bin/env")) }}
 . "$HOME/.local/bin/env"
+{{- end }}
+{{- if (lstat (joinPath .chezmoi.homeDir ".cargo/env")) }}
 . "$HOME/.cargo/env"
+{{- end }}
+cd ~
+{{- end }}
+
+{{- if eq .chezmoi.os "windows" }}
+# --- Windows Specifics ---
+# Add your windows-specific bash (git bash) tweaks here if any.
+{{- end }}

dot_zshrc.tmpl

@@ -1,11 +1,14 @@
-cd ~
+{{- if eq .chezmoi.os "linux" -}}
+# Instant prompt for Powerlevel10k
+if [[ -r "${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh" ]]; then
+  source "${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh"
+fi
 
-# if [[ -r "${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh" ]]; then
+# --- Homebrew Initialization ---
-#   source "${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh"
+if [ -f "/home/linuxbrew/.linuxbrew/bin/brew" ]; then
-# fi
-
-# --- Homebrew Initialization (Primary) ---
   eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
+fi
+{{- end }}
 
 VI_MODE_SET_CURSOR=true
 MODE_INDICATOR="%F{yellow}+%f"
@@ -43,26 +46,28 @@ HISTSIZE=10000
 SAVEHIST=10000
 HISTFILE=~/.zsh_history
 
-# # to customize prompt, run `p10k configure` or edit ~/.p10k.zsh.
+# to customize prompt, run `p10k configure` or edit ~/.p10k.zsh.
-# [[ ! -f ~/.p10k.zsh ]] || source ~/.p10k.zsh
+[[ ! -f ~/.p10k.zsh ]] || source ~/.p10k.zsh
 
 export PYENV_ROOT="$HOME/.pyenv"
 export JDK8_HOME="$HOME/.jdks/jdk-1.8"
-export JDK8_32_HOME="$HOME/.jdks/jdk-1.8-i586"
 export JDK21_HOME="$HOME/.jdks/jdk-21"
 export JDK25_HOME="$HOME/.jdks/jdk-25"
-export JAVA_HOME="$JDK25_HOME"
+export JAVA_HOME="$JDK21_HOME"
 export GROOVY_HOME="$HOME/devtools/groovy"
 export M2_HOME="$HOME/devtools/maven"
 export NODE_ENV=development
-export GDK_BACKEND=x11
 
-# PATH Configuration (Homebrew and Local Bin prioritized)
+{{- if eq .chezmoi.os "linux" }}
-export PATH="$HOME/.local/bin:$PATH:$JAVA_HOME/bin:$M2_HOME/bin:$GROOVY_HOME/bin:$PYENV_ROOT/bin:$HOME/.npm-global/bin:/snap/bin"
+export GDK_BACKEND=x11
+export PNPM_HOME="$HOME/.local/share/pnpm"
+export PATH="$PNPM_HOME:$HOME/.local/bin:$PATH:$JAVA_HOME/bin:$M2_HOME/bin:$GROOVY_HOME/bin:$PYENV_ROOT/bin:$HOME/.npm-global/bin:/snap/bin"
+{{- else }}
+export PATH="$JAVA_HOME/bin:$M2_HOME/bin:$GROOVY_HOME/bin:$PYENV_ROOT/bin:$HOME/.npm-global/bin:/snap/bin:$HOME/.local/bin:/usr/local/bin:/usr/bin"
+{{- end }}
 
 typeset -g POWERLEVEL9K_INSTANT_PROMPT=quiet
-export ZSH="/home/riz/.oh-my-zsh"
+export ZSH="$HOME/.oh-my-zsh"
-# ZSH_THEME="powerlevel10k/powerlevel10k"
 
 plugins=(
   git
@@ -70,17 +75,24 @@ plugins=(
   zsh-autosuggestions
   zsh-history-substring-search
   zsh-completions
+  {{- if eq .chezmoi.os "linux" }}
   fzf-tab
+  {{- end }}
   zsh-syntax-highlighting
 )
 
+{{- if eq .chezmoi.os "linux" }}
 # fzf-tab settings
 zstyle ':fzf-tab:complete:cd:*' fzf-preview 'eza -1 --color=always $realpath'
 zstyle ':fzf-tab:complete:*' fzf-flags --color=fg:1,fg+:2 --height=50%
 zstyle ':completion:*:descriptions' format '[%d]'
 zstyle ':completion:*' list-colors ${(s.:.)LS_COLORS}
+{{- end }}
 
+if command -v fzf >/dev/null 2>&1; then
   source <(fzf --zsh)
+fi
+
 export FZF_DEFAULT_OPTS="--height 40% --layout=reverse --border --preview 'bat --style=numbers --color=always --line-range :500 {}'"
 export FZF_CTRL_T_OPTS="--preview 'bat --style=numbers --color=always --line-range :500 {}'" 
 export FZF_ALT_C_OPTS="--preview 'eza --tree --icons --color=always {} | head -200'"
@@ -94,31 +106,32 @@ alias code="/mnt/c/Users/reazul.ashraf/AppData/Local/Programs/Microsoft\ VS\ Cod
 alias pbcopy='xclip -selection clipboard'
 alias pbpaste='xclip -selection clipboard -o'
 
-# --- Gold Standard Tool Mapping (Deduplicated & High Performance) ---
+# --- Gold Standard Tool Mapping ---
-# Homebrew provides these; aliases ensure they are used consistently.
+if command -v eza >/dev/null 2>&1; then
   alias ls='eza --icons --group-directories-first'
   alias la='eza --icons -la --group-directories-first --git'
   alias tree='eza --tree --icons'
-alias cat='bat'
+else
-alias find='fd'
+  alias ls='ls --color=auto'
-alias ff='fd'
+  alias la='ls -la'
-alias grep='rg'
+fi
-alias sed='sd'
+
-alias awk='choose'
+if command -v bat >/dev/null 2>&1; then alias cat='bat'; fi
-alias ps='procs'
+if command -v batcat >/dev/null 2>&1; then alias cat='batcat'; alias bat='batcat'; fi
-alias top='btm'
+if command -v fd >/dev/null 2>&1; then alias find='fd'; alias ff='fd'; fi
-alias curl='xh'
+if command -v rg >/dev/null 2>&1; then alias grep='rg'; fi
-alias zip='ouch'
+if command -v sd >/dev/null 2>&1; then alias sed='sd'; fi
-alias tar='ouch'
+if command -v choose >/dev/null 2>&1; then alias awk='choose'; fi
-alias diff='delta'
+if command -v procs >/dev/null 2>&1; then alias ps='procs'; fi
-alias tldr='tealdeer'
+if command -v btm >/dev/null 2>&1; then alias top='btm'; fi
-# --------------------------------------------------------------------
+if command -v xh >/dev/null 2>&1; then alias curl='xh'; fi
+if command -v ouch >/dev/null 2>&1; then alias zip='ouch'; alias tar='ouch'; fi
+if command -v delta >/dev/null 2>&1; then alias diff='delta'; fi
 
 # Navigation
 alias ..='cd ..'
 alias ...='cd ../..'
 alias ....='cd ../../..'
-alias .....='cd ../../../..'
 
 # Functions
 fcd() {
@@ -127,62 +140,27 @@ fcd() {
 }
 
 alias jdk8home="export JAVA_HOME=$JDK8_HOME"
-alias jdk8home32="export JAVA_HOME=$JDK8_32_HOME"
 alias jdk21home="export JAVA_HOME=$JDK21_HOME"
 alias jdk25home="export JAVA_HOME=$JDK25_HOME"
 
-java() {
-  $JAVA_HOME/bin/java $@
-}
-
 gsquash() {
   git reset --soft head~$(git rev-list --count head ^$1)
   echo "To complete then do, git push --force"
 }
 
-# Development Helpers
-dmvn() {
-    ws="/mnt/c/users/reazul.ashraf/workspace/uichannel-commission-bootstrap"
-    id="$(docker run -t -d -u root:root -v /home/riz/.m2:/volume/.m2 -w $ws -v $ws:$ws:rw,z -v $ws@tmp:$ws@tmp:rw,z maven:3-openjdk-8-slim cat)"        
-    docker exec -ti $id ls -alp $ws
-    docker kill $id
-}
-
-sonarscan() {
-  MAVEN_OPTS="-Dsonar.branch.name=$(git branch --show-current)" JAVA_HOME=$JDK21_HOME mvn org.sonarsource.scanner.maven:sonar-maven-plugin:RELEASE:sonar -DskipTests
-}
-
-# Environment Initializations
-eval "$(zoxide init --cmd z zsh)"
-
-# pnpm
-export PNPM_HOME="/home/riz/.local/share/pnpm"
-case ":$PATH:" in
-  *":$PNPM_HOME:"*) ;;
-  *) export PATH="$PNPM_HOME:$PATH" ;;
-esac
-
-export GOOGLE_CLOUD_PROJECT=inse-r-and-d
-export XDG_DATA_DIRS="/usr/local/share:/usr/share:${XDG_DATA_DIRS:-/usr/local/share:/usr/share}"
-alias ghostty="ghostty 2>/dev/null"
-alias gimp='GDK_BACKEND=x11 gimp'
-export PYTHONWARNINGS="ignore:Your system is avx2 capable:RuntimeWarning"
-
-# Cargo / Local Bin
-[ -f "$HOME/.local/bin/env" ] && . "$HOME/.local/bin/env"
-[ -f "$HOME/.cargo/env" ] && . "$HOME/.cargo/env"
-
-# Autosuggestions color (make it readable)
-export ZSH_AUTOSUGGEST_HIGHLIGHT_STYLE='fg=cyan'
-
 source $ZSH/oh-my-zsh.sh
 
-
+{{- if eq .chezmoi.os "linux" }}
 export STARSHIP_DEVICE_COLOR="orange"
 export STARSHIP_CONFIG=~/.config/starship_linux.toml
 eval "$(starship init zsh)"
-
-
 alias refresh-vpn='powershell.exe -ExecutionPolicy Bypass -File "C:\Users\reazul.ashraf\scripts\refresh_wsl_vpn.ps1"'
+{{- end }}
 
-export GEMINI_CLI_HOME="/mnt/c/Users/reazul.ashraf"
+eval "$(zoxide init --cmd z zsh)"
+
+# Autosuggestions color
+export ZSH_AUTOSUGGEST_HIGHLIGHT_STYLE='fg=cyan'
+
+# Start in ~
+cd ~

run_once_install_modules.ps1

@@ -1,12 +1,13 @@
 Write-Host "Checking for required PowerShell modules..."
 
 $modules = @(
+    "oh-my-posh",
     "posh-git",
     "Profiler",
     "PSFzf",
     "PSProfiler",
     "PSScriptAnalyzer",
-    "Terminal-Icons",
+    "Terminal-Icons"
 )
 
 foreach ($mod in $modules) {