.chezmoi.toml.tmpl

{{- /* Profile-driven machine configuration for chezmoi
     Profile is selected interactively during chezmoi init, or via:
       DOTFILES_PROFILE=arch chezmoi init
       chezmoi init --promptChoice profile=arch
     Auto-detects from distro if non-interactive.
*/ -}}

{{- /* Load profiles from single source of truth */ -}}
{{- $profiles := (include ".chezmoidata/profiles.yaml" | fromYaml).profiles -}}

{{- /* Detect distribution and map to default profile */ -}}
{{- $distro := "unknown" -}}
{{- $defaultProfile := "" -}}
{{- if eq .chezmoi.os "darwin" -}}
{{-   $distro = "macos" -}}
{{-   $defaultProfile = "macos-work" -}}
{{- else if stat "/run/ostree-booted" -}}
{{-   $distro = "silverblue" -}}
{{-   $defaultProfile = "silverblue" -}}
{{- else if stat "/etc/arch-release" -}}
{{-   $distro = "arch" -}}
{{-   $defaultProfile = "arch-desktop" -}}
{{- else if stat "/etc/debian_version" -}}
{{-   $distro = "debian" -}}
{{-   $defaultProfile = "debian-server" -}}
{{- end -}}

{{- /* Resolve profile: env var > interactive prompt > auto-detect */ -}}
{{- $envProfile := env "DOTFILES_PROFILE" -}}
{{- $profile := "" -}}
{{- if ne $envProfile "" -}}
{{-   $profile = $envProfile -}}
{{- else -}}
{{-   $choices := keys $profiles | sortAlpha -}}
{{-   writeToStdout "\nAvailable profiles:\n" -}}
{{-   range $name := $choices -}}
{{-     $p := index $profiles $name -}}
{{-     writeToStdout (printf "  %-20s %s\n" $name $p.desc) -}}
{{-   end -}}
{{-   writeToStdout "\n" -}}
{{-   $profile = promptChoiceOnce . "profile" "Machine profile" $choices $defaultProfile -}}
{{- end -}}

{{- /* Read profile properties from profiles.yaml */ -}}
{{- $profileData := index $profiles $profile -}}
{{- $tags := $profileData.tags -}}
{{- $wantsDecrypt := or (get $profileData "decrypt") false -}}
{{- $work := or (get $profileData "work") false -}}
{{- $de := "" -}}
{{- if hasKey $profileData "de" -}}{{- $de = $profileData.de -}}
{{- end -}}

{{- /* Enable encryption when the profile declares it. The run_before decrypt
     script ensures the key exists (via env var, 1Password, or manual placement)
     before chezmoi processes any encrypted files. */ -}}

{{ if $wantsDecrypt -}}
encryption = "age"
{{ end }}
[data]
    distro = "{{ $distro }}"
    profile = "{{ $profile }}"
    tags = "{{ $tags }}"
    work = {{ $work }}
    decrypt = {{ $wantsDecrypt }}
    de = "{{ $de }}"
{{ if $wantsDecrypt }}
[age]
    identity = "~/.config/chezmoi/age-key.txt"
    recipients = [
        "{{ include ".age-public-key" | trim }}",
        "{{ include ".age-public-key-work" | trim }}",
    ]
{{- end }}