Harden .ssh security and templatize shell configs

2026-04-07 00:47:41 +01:00
parent 349529662a
commit 8b6c56b300
4 changed files with 87 additions and 117 deletions
@@ -2,6 +2,10 @@
 .conan/data
 .conan2/p/**
 .conan/data/**
+.ssh
+.ssh/**
+id_*
+*.ppk
 {{ if eq .chezmoi.os "windows" }}
 install_wsl_plugins.sh
 {{ else }}
@@ -9,7 +9,6 @@ case $- in
 esac

 # don't put duplicate lines or lines starting with space in the history.
-# See bash(1) for more options
 HISTCONTROL=ignoreboth

 # append to the history file, don't overwrite it
@@ -23,10 +22,6 @@ HISTFILESIZE=2000
 # update the values of LINES and COLUMNS.
 shopt -s checkwinsize

-# If set, the pattern "**" used in a pathname expansion context will
-# match all files and zero or more directories and subdirectories.
-#shopt -s globstar
-
 # make less more friendly for non-text input files, see lesspipe(1)
 [ -x /usr/bin/lesspipe ] && eval "$(SHELL=/bin/sh lesspipe)"

@@ -40,19 +35,11 @@ case "$TERM" in
    xterm-color|*-256color) color_prompt=yes;;
 esac

-# uncomment for a colored prompt, if the terminal has the capability; turned
-# off by default to not distract the user: the focus in a terminal window
-# should be on the output of commands, not on the prompt
-#force_color_prompt=yes
-
 if [ -n "$force_color_prompt" ]; then
    if [ -x /usr/bin/tput ] && tput setaf 1 >&/dev/null; then
-	# We have color support; assume it's compliant with Ecma-48
-	# (ISO/IEC-6429). (Lack of such support is extremely rare, and such
-	# a case would tend to support setf rather than setaf.)
-	color_prompt=yes
+        color_prompt=yes
    else
-	color_prompt=
+        color_prompt=
    fi
 fi

@@ -76,38 +63,24 @@ esac
 if [ -x /usr/bin/dircolors ]; then
    test -r ~/.dircolors && eval "$(dircolors -b ~/.dircolors)" || eval "$(dircolors -b)"    
    alias ls='ls --color=auto'
-    #alias dir='dir --color=auto'
-    #alias vdir='vdir --color=auto'
-
    alias grep='grep --color=auto'
    alias fgrep='fgrep --color=auto'
    alias egrep='egrep --color=auto'
 fi

-# colored GCC warnings and errors
-#export GCC_COLORS='error=01;31:warning=01;35:note=01;36:caret=01;32:locus=01:quote=01'
-
 # some more ls aliases
 alias ll='ls -alF'
 alias la='ls -A'
 alias l='ls -CF'

-# Add an "alert" alias for long running commands.  Use like so:
-#   sleep 10; alert
+# Add an "alert" alias for long running commands.
 alias alert='notify-send --urgency=low -i "$([ $? = 0 ] && echo terminal || echo error)" "$(history|tail -n1|sed -e '\''s/^\s*[0-9]\+\s*//;s/[;&|]\s*alert$//'\'')"'

-# Alias definitions.
-# You may want to put all your additions into a separate file like
-# ~/.bash_aliases, instead of adding them here directly.
-# See /usr/share/doc/bash-doc/examples in the bash-doc package.
-
 if [ -f ~/.bash_aliases ]; then
    . ~/.bash_aliases
 fi

-# enable programmable completion features (you don't need to enable
-# this, if it's already enabled in /etc/bash.bashrc and /etc/profile
-# sources /etc/bash.bashrc).
+# enable programmable completion features
 if ! shopt -oq posix; then
  if [ -f /usr/share/bash-completion/bash_completion ]; then
    . /usr/share/bash-completion/bash_completion
@@ -115,14 +88,28 @@ if ! shopt -oq posix; then
    . /etc/bash_completion
  fi
 fi
+
 export PYENV_ROOT="$HOME/.pyenv"
 export PATH="$PYENV_ROOT/bin:$PATH"
 if command -v pyenv 1>/dev/null 2>&1; then
 eval "$(pyenv init --path)"
 fi
-export PYENV_ROOT="$HOME/.pyenv"
+
 export XDG_DATA_DIRS="/usr/local/share:/usr/share:${XDG_DATA_DIRS:-/usr/local/share:/usr/share}"
 alias ghostty="ghostty 2>/dev/null"

+{{- if eq .chezmoi.os "linux" }}
+# --- Linux/WSL Specifics ---
+{{- if (lstat (joinPath .chezmoi.homeDir ".local/bin/env")) }}
 . "$HOME/.local/bin/env"
+{{- end }}
+{{- if (lstat (joinPath .chezmoi.homeDir ".cargo/env")) }}
 . "$HOME/.cargo/env"
+{{- end }}
+cd ~
+{{- end }}
+
+{{- if eq .chezmoi.os "windows" }}
+# --- Windows Specifics ---
+# Add your windows-specific bash (git bash) tweaks here if any.
+{{- end }}
@@ -1,11 +1,14 @@
-cd ~
+{{- if eq .chezmoi.os "linux" -}}
+# Instant prompt for Powerlevel10k
+if [[ -r "${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh" ]]; then
+  source "${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh"
+fi

-# if [[ -r "${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh" ]]; then
-#   source "${XDG_CACHE_HOME:-$HOME/.cache}/p10k-instant-prompt-${(%):-%n}.zsh"
-# fi
-
-# --- Homebrew Initialization (Primary) ---
-eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
+# --- Homebrew Initialization ---
+if [ -f "/home/linuxbrew/.linuxbrew/bin/brew" ]; then
+  eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
+fi
+{{- end }}

 VI_MODE_SET_CURSOR=true
 MODE_INDICATOR="%F{yellow}+%f"
@@ -43,26 +46,28 @@ HISTSIZE=10000
 SAVEHIST=10000
 HISTFILE=~/.zsh_history

-# # to customize prompt, run `p10k configure` or edit ~/.p10k.zsh.
-# [[ ! -f ~/.p10k.zsh ]] || source ~/.p10k.zsh
+# to customize prompt, run `p10k configure` or edit ~/.p10k.zsh.
+[[ ! -f ~/.p10k.zsh ]] || source ~/.p10k.zsh

 export PYENV_ROOT="$HOME/.pyenv"
 export JDK8_HOME="$HOME/.jdks/jdk-1.8"
-export JDK8_32_HOME="$HOME/.jdks/jdk-1.8-i586"
 export JDK21_HOME="$HOME/.jdks/jdk-21"
 export JDK25_HOME="$HOME/.jdks/jdk-25"
-export JAVA_HOME="$JDK25_HOME"
+export JAVA_HOME="$JDK21_HOME"
 export GROOVY_HOME="$HOME/devtools/groovy"
 export M2_HOME="$HOME/devtools/maven"
 export NODE_ENV=development
-export GDK_BACKEND=x11

-# PATH Configuration (Homebrew and Local Bin prioritized)
-export PATH="$HOME/.local/bin:$PATH:$JAVA_HOME/bin:$M2_HOME/bin:$GROOVY_HOME/bin:$PYENV_ROOT/bin:$HOME/.npm-global/bin:/snap/bin"
+{{- if eq .chezmoi.os "linux" }}
+export GDK_BACKEND=x11
+export PNPM_HOME="$HOME/.local/share/pnpm"
+export PATH="$PNPM_HOME:$HOME/.local/bin:$PATH:$JAVA_HOME/bin:$M2_HOME/bin:$GROOVY_HOME/bin:$PYENV_ROOT/bin:$HOME/.npm-global/bin:/snap/bin"
+{{- else }}
+export PATH="$JAVA_HOME/bin:$M2_HOME/bin:$GROOVY_HOME/bin:$PYENV_ROOT/bin:$HOME/.npm-global/bin:/snap/bin:$HOME/.local/bin:/usr/local/bin:/usr/bin"
+{{- end }}

 typeset -g POWERLEVEL9K_INSTANT_PROMPT=quiet
-export ZSH="/home/riz/.oh-my-zsh"
-# ZSH_THEME="powerlevel10k/powerlevel10k"
+export ZSH="$HOME/.oh-my-zsh"

 plugins=(
  git
@@ -70,17 +75,24 @@ plugins=(
  zsh-autosuggestions
  zsh-history-substring-search
  zsh-completions
+  {{- if eq .chezmoi.os "linux" }}
  fzf-tab
+  {{- end }}
  zsh-syntax-highlighting
 )

+{{- if eq .chezmoi.os "linux" }}
 # fzf-tab settings
 zstyle ':fzf-tab:complete:cd:*' fzf-preview 'eza -1 --color=always $realpath'
 zstyle ':fzf-tab:complete:*' fzf-flags --color=fg:1,fg+:2 --height=50%
 zstyle ':completion:*:descriptions' format '[%d]'
 zstyle ':completion:*' list-colors ${(s.:.)LS_COLORS}
+{{- end }}
+
+if command -v fzf >/dev/null 2>&1; then
+  source <(fzf --zsh)
+fi

-source <(fzf --zsh)
 export FZF_DEFAULT_OPTS="--height 40% --layout=reverse --border --preview 'bat --style=numbers --color=always --line-range :500 {}'"
 export FZF_CTRL_T_OPTS="--preview 'bat --style=numbers --color=always --line-range :500 {}'" 
 export FZF_ALT_C_OPTS="--preview 'eza --tree --icons --color=always {} | head -200'"
@@ -94,31 +106,32 @@ alias code="/mnt/c/Users/reazul.ashraf/AppData/Local/Programs/Microsoft\ VS\ Cod
 alias pbcopy='xclip -selection clipboard'
 alias pbpaste='xclip -selection clipboard -o'

-# --- Gold Standard Tool Mapping (Deduplicated & High Performance) ---
-# Homebrew provides these; aliases ensure they are used consistently.
-alias ls='eza --icons --group-directories-first'
-alias la='eza --icons -la --group-directories-first --git'
-alias tree='eza --tree --icons'
-alias cat='bat'
-alias find='fd'
-alias ff='fd'
-alias grep='rg'
-alias sed='sd'
-alias awk='choose'
-alias ps='procs'
-alias top='btm'
-alias curl='xh'
-alias zip='ouch'
-alias tar='ouch'
-alias diff='delta'
-alias tldr='tealdeer'
-# --------------------------------------------------------------------
+# --- Gold Standard Tool Mapping ---
+if command -v eza >/dev/null 2>&1; then
+  alias ls='eza --icons --group-directories-first'
+  alias la='eza --icons -la --group-directories-first --git'
+  alias tree='eza --tree --icons'
+else
+  alias ls='ls --color=auto'
+  alias la='ls -la'
+fi
+
+if command -v bat >/dev/null 2>&1; then alias cat='bat'; fi
+if command -v batcat >/dev/null 2>&1; then alias cat='batcat'; alias bat='batcat'; fi
+if command -v fd >/dev/null 2>&1; then alias find='fd'; alias ff='fd'; fi
+if command -v rg >/dev/null 2>&1; then alias grep='rg'; fi
+if command -v sd >/dev/null 2>&1; then alias sed='sd'; fi
+if command -v choose >/dev/null 2>&1; then alias awk='choose'; fi
+if command -v procs >/dev/null 2>&1; then alias ps='procs'; fi
+if command -v btm >/dev/null 2>&1; then alias top='btm'; fi
+if command -v xh >/dev/null 2>&1; then alias curl='xh'; fi
+if command -v ouch >/dev/null 2>&1; then alias zip='ouch'; alias tar='ouch'; fi
+if command -v delta >/dev/null 2>&1; then alias diff='delta'; fi

 # Navigation
 alias ..='cd ..'
 alias ...='cd ../..'
 alias ....='cd ../../..'
-alias .....='cd ../../../..'

 # Functions
 fcd() {
@@ -127,62 +140,27 @@ fcd() {
 }

 alias jdk8home="export JAVA_HOME=$JDK8_HOME"
-alias jdk8home32="export JAVA_HOME=$JDK8_32_HOME"
 alias jdk21home="export JAVA_HOME=$JDK21_HOME"
 alias jdk25home="export JAVA_HOME=$JDK25_HOME"

-java() {
-  $JAVA_HOME/bin/java $@
-}
-
 gsquash() {
  git reset --soft head~$(git rev-list --count head ^$1)
  echo "To complete then do, git push --force"
 }

-# Development Helpers
-dmvn() {
-    ws="/mnt/c/users/reazul.ashraf/workspace/uichannel-commission-bootstrap"
-    id="$(docker run -t -d -u root:root -v /home/riz/.m2:/volume/.m2 -w $ws -v $ws:$ws:rw,z -v $ws@tmp:$ws@tmp:rw,z maven:3-openjdk-8-slim cat)"        
-    docker exec -ti $id ls -alp $ws
-    docker kill $id
-}
-
-sonarscan() {
-  MAVEN_OPTS="-Dsonar.branch.name=$(git branch --show-current)" JAVA_HOME=$JDK21_HOME mvn org.sonarsource.scanner.maven:sonar-maven-plugin:RELEASE:sonar -DskipTests
-}
-
-# Environment Initializations
-eval "$(zoxide init --cmd z zsh)"
-
-# pnpm
-export PNPM_HOME="/home/riz/.local/share/pnpm"
-case ":$PATH:" in
-  *":$PNPM_HOME:"*) ;;
-  *) export PATH="$PNPM_HOME:$PATH" ;;
-esac
-
-export GOOGLE_CLOUD_PROJECT=inse-r-and-d
-export XDG_DATA_DIRS="/usr/local/share:/usr/share:${XDG_DATA_DIRS:-/usr/local/share:/usr/share}"
-alias ghostty="ghostty 2>/dev/null"
-alias gimp='GDK_BACKEND=x11 gimp'
-export PYTHONWARNINGS="ignore:Your system is avx2 capable:RuntimeWarning"
-
-# Cargo / Local Bin
-[ -f "$HOME/.local/bin/env" ] && . "$HOME/.local/bin/env"
-[ -f "$HOME/.cargo/env" ] && . "$HOME/.cargo/env"
-
-# Autosuggestions color (make it readable)
-export ZSH_AUTOSUGGEST_HIGHLIGHT_STYLE='fg=cyan'
-
 source $ZSH/oh-my-zsh.sh

-
+{{- if eq .chezmoi.os "linux" }}
 export STARSHIP_DEVICE_COLOR="orange"
 export STARSHIP_CONFIG=~/.config/starship_linux.toml
 eval "$(starship init zsh)"
-
-
 alias refresh-vpn='powershell.exe -ExecutionPolicy Bypass -File "C:\Users\reazul.ashraf\scripts\refresh_wsl_vpn.ps1"'
+{{- end }}

-export GEMINI_CLI_HOME="/mnt/c/Users/reazul.ashraf"
+eval "$(zoxide init --cmd z zsh)"
+
+# Autosuggestions color
+export ZSH_AUTOSUGGEST_HIGHLIGHT_STYLE='fg=cyan'
+
+# Start in ~
+cd ~
@@ -1,12 +1,13 @@
 Write-Host "Checking for required PowerShell modules..."

 $modules = @(
+    "oh-my-posh",
    "posh-git",
    "Profiler",
    "PSFzf",
    "PSProfiler",
    "PSScriptAnalyzer",
-    "Terminal-Icons",
+    "Terminal-Icons"
 )

 foreach ($mod in $modules) {