dotfiles

Shell, editor and terminal configuration, the tools that go with them, and
szecret, an age-based secret manager whose store lives elsewhere.

History restarts here. What came before was not written to be read by
anyone else, and carried machine names, addresses and an encrypted secret
store; it is kept privately instead. What is left is meant to be safe on
any machine, including one whose owner is not me: see CLAUDE.md for the
rule it is written to.

1 files changed, 70 insertions, 0 deletions

diff --git a/link/ssh.sh b/link/ssh.sh
new file mode 100755
index 0000000..62efb52
--- /dev/null
+++ b/link/ssh.sh
@@ -0,0 +1,70 @@
+#!/bin/bash
+
+# ssh client config. Dry run by default; pass `yes` to apply.
+
+set -euo pipefail
+
+# shellcheck source-path=SCRIPTDIR
+# shellcheck source=lib.sh
+source "$(dirname "$0")/lib.sh" "$@"
+
+# ~/.ssh/config itself is the entry point: it reads ~/.config/ssh/config-fleet
+# first, if another layer has linked one in, then this host's
+# ~/.config/ssh/config-local -- see config/ssh/entry. Only the file is linked;
+# ~/.ssh stays a real directory, because what else lives in it (keys,
+# known_hosts, control and agent sockets) is this host's own.
+#
+# Each step below is skipped, loudly, rather than forced, because link() starts
+# with `rm -rf`:
+#   - a symlinked ~/.ssh. On the Macs it once pointed into iCloud Drive, a
+#     single directory shared by two machines, so replacing a file in it on one
+#     deleted it on the other.
+#   - a real ~/.ssh/config holding anything but `Include ~/.config/ssh/config`,
+#     the one line each host was given by hand on 2026-09-07, before this file
+#     was linked. Anything else is host-specific and belongs in config-local;
+#     move it there first.
+ssh_dir="$HOME/.ssh"
+if [[ -L "$ssh_dir" ]]
+then
+  red "$ssh_dir is a symlink to $(readlink "$ssh_dir"); skipping ssh links -- make it a real local directory first"
+  exit 0
+fi
+
+if [[ -z "${is_dry_run}" && ! -d "$ssh_dir" ]]
+then
+  install -d -m 700 "$ssh_dir"
+fi
+
+ssh_config_extra=""
+if [[ -f "$ssh_dir/config" && ! -L "$ssh_dir/config" ]]
+then
+  ssh_config_extra="$(grep -vE '^[[:space:]]*(#|$)' "$ssh_dir/config" \
+    | grep -vxF 'Include ~/.config/ssh/config' || true)"
+fi
+if [[ -n "$ssh_config_extra" ]]
+then
+  red "$ssh_dir/config has host-specific lines; move them to ~/.config/ssh/config-local, then re-run"
+else
+  link "$config_dir/ssh/entry" "$ssh_dir/config"
+fi
+
+# Links this repo made while host blocks and their key pins were tracked here,
+# now that another layer owns them: only a dangling link in ~/.config/ssh that
+# points into this repo's config/ssh is removed -- never a real file, and never
+# a link someone else made. Compared as real paths: the link holds whatever
+# spelling this repo had when it was made, which on a machine whose checkout is
+# reached through a symlink is not this run's.
+ssh_repo_dir="$(realpath "$config_dir/ssh")"
+for stale in "$xdg_config_dir"/ssh/*
+do
+  if [[ -L "$stale" && ! -e "$stale" ]] \
+    && [[ "$(realpath "$(dirname "$(readlink "$stale")")" 2>/dev/null)" == "$ssh_repo_dir" ]]
+  then
+    if [[ -n "${is_dry_run}" ]]
+    then
+      yellow "$stale is a dangling link into this repo and will be removed"
+    else
+      rm "$stale"
+    fi
+  fi
+done