My dotfiles These are my dotfiles. There are many of them, but those are mine. :)

---

pwendok is a utility repository to store my dotfiles and other text-based utilities for when, two times a year, I clean my machines and do a clean install.

The content of my dotfiles are compiled from my personal experience & from many places on the web, and the structure of this repo is based on this article from Lars Kappert.

pwendok/setup

Commands to run after a fresh install. Note: the following list (and the whole content of this repo) is useful for me, but feel free to dig into it, I hope some of my tools can help you too!

1. Configure sys prefs & Finder prefs (remap capslock to ctrl)
2. Install Dank Mono font (stored in Dropbox)
3. Clone this repo to ~/.pwendok: cd && git clone https://github.com/leny/pwendok.git ./.pwendok && cd .pwendok
4. System setup: launch source install.sh (the script ask for reboot at the end).
5. Clone & deploy ssh keys from repo.

f.lux settings

I note here my f.lux settings because it takes me weeks to find the good settings for my eyes / liferythm. If you don't know f.lux, go get a look, and try it. Your eyes will thanks you.

• wake up time: 09:00 (please, don't judge me ;))
• day temp: sunlite (5500K)
• late temp: fluorescent (4200K)
• night temp: tungsten (2700K)

git commit signing

git commit signing is handled by 1password, so you need to install the 1password CLI tool to make it work.

To distinguish already-signed commits from unsigned ones (%G? reports G instead of N), configure the allowed signers file:

git config --global gpg.ssh.allowedSignersFile ~/.config/git/allowed_signers

Unsigned commits from agents

Long-running CLI agents (claude, codex) can block on the 1Password unlock prompt when nobody is at the machine. To avoid this:

• The claude and codex fish functions (fish/functions/claude.fish, fish/functions/codex.fish) disable commit.gpgsign/tag.gpgSign for that process tree only, via GIT_CONFIG_COUNT/GIT_CONFIG_KEY_*/GIT_CONFIG_VALUE_*. Commits made outside these wrappers are still signed as usual.
• Agents never push. Before pushing, resign any unsigned commits with git sign (bin/git-sign) — it rewrites (git rebase -f -S) the unsigned commits in your local, unpushed history. Rewriting SHAs is harmless since nothing was published yet.
• A pre-push hook (git/template/hooks/pre-push) blocks pushing unsigned commits as a safety net. It's installed automatically in new repos via init.templateDir (see below), or in an existing repo with git sign --install-hook. Bypass it with git push --no-verify.

Typical usage:

git sign              # resign unsigned commits since the first unsigned one
git sign --dry-run    # preview the plan without rewriting anything
git sign --list-backups   # list refs/git-sign/backup/* safety refs
git sign --help        # full option list

templateDir setup

init.templateDir (set in git/config, symlinked to ~/.config/git/config) points at ~/.config/git/template, whose hooks/pre-push gets copied into every future git init/git clone. No action needed once the dotfiles are linked — just make sure ~/.config/git points at this repo's git/ directory.

---

TODO

• Migrate the dotfiles handling to GNU Stow.
• Automate installation of Amazon Q
  • Fix slow startup of fish instance
• Do a bit of cleanup in listed packages & apps

---

dotfiles' logo by Joel Glovier