Reference: Configuration Files

Source Repository

.chezmoiroot is defaults, so chezmoi's source state (data, templates, ignore rules) lives under ~/.dotfiles/defaults/. Repo tooling (mise.toml, scripts/, lib/) stays at the root.

User-Owned Configuration

.chezmoidata.toml Schema

An excerpt of defaults/.chezmoidata.toml:

dotfiles_version = "0.2.542"
profile = "laptop"

machine = ""

# Visual theme: family + mode, and the resolved palette name
theme = "maui-dark"
theme_family = "maui"
theme_mode = "auto" # auto, dark, or light

# Terminal settings
terminal_font_family = "JetBrainsMono Nerd Font"
terminal_font_size = 20
default_shell = "fish" # zsh, fish, or nu

# Git identity (should be set via chezmoi init prompts or local overrides)
name = ""
email = ""
signingkey = ""

# Feature flags (see 05-feature-flags.md)
[features]
alias_wrapper = false
dms = true
zellij = false
ai_theme_sync = true
linux_desktop = false
niri = false
# ... waybar, fuzzel, mako, foot, kanshi, touch, t2, surface, corral_gitea_mirror

[features.ai_theme_providers]
codex = true
claude = true
# ... gemini, agy, qwen, opencode

dotfiles_version is bumped by version-sync.sh at release time. The file also carries the install pins ([tools], [go_tools], [rust_tools], [tmux_plugins], [ai_tools]) and the alias settings ([aliases.buckets], [aliases.policy]). There is no [profiles] table: profile is a name that templates read as .profile.

.chezmoidata/hardware.toml Schema

# Defaults, used when no machine preset is selected
[hardware]
profile = "laptop"
scale = 1.0
hidpi = false
touchscreen = false
touchpad = true
max_refresh = 60
gpu = "integrated"
keyboard_layout = "us"
touchpad_accel = 0.0
touchpad_accel_profile = "adaptive"
output_name = ""
output_mode = ""

# Presets, selected by `machine = "<name>"`, with the same keys
[machines.macbook-t2]
scale = 2.0
hidpi = true
output_name = "eDP-1"
output_mode = "2560x1600@60"
# ...

Presets shipped: macbook-t2, surface-pro, geekom-a9. A preset replaces [hardware] as a whole (it is not merged key by key), and it carries no feature flags. Today only the Niri config template (defaults/dot_config/niri/config.kdl.tmpl) reads these values.

.theme-manifest/themes.toml Schema

Generated by dot theme rebuild (scripts/theme/rebuild-themes.sh). Do not edit manually.

[themes.<name>]
mode = "dark" | "light"
family = "<family-name>"
macos_accent = -1 .. 6     # -1=Graphite, 0=Red, 1=Orange, 2=Yellow, 3=Green, 4=Blue, 5=Purple, 6=Pink
wallpaper = "/absolute/path/to/wallpaper.heic"
source = "custom" | "system"

[themes.<name>.term]
bg, fg, cursor, cursor_text, sel_bg, sel_fg  # hex RGB
c0 .. c15                                    # 16 ANSI colors
grey0 .. grey11                              # grey ramp

[themes.<name>.ui]
accent, accent_text     # WCAG AAA enforced (7:1)
secondary, tertiary, text_muted
accent_on_surface, secondary_on_surface, tertiary_on_surface
error, warning, success, info
panel                   # 1.08-2.0 contrast vs bg
border
secondary_container, on_secondary_container, status_text

[themes.<name>.app]
nvim, nvim_style, lualine
gtk_theme, gtk_icon, gnome_shell, gnome_gtk
vscode, vscode_dark, vscode_light, vscode_icons
cat_wallpaper
starship_palette

The manifest is not chezmoi data: templates load it with include ".theme-manifest/themes.toml" | fromToml (see Template Variables). See Theme Engine concept for how values are derived.

~/.config/chezmoi/chezmoi.toml (Per-Host)

Written by chezmoi init from defaults/.chezmoi.toml.tmpl (on a terminal it prompts for the age identity and recipient, profile, theme and git identity), then edited by hand or by dot theme. An excerpt:

encryption = "age"
sourceDir = "~/.dotfiles"

[age]
    identity = "~/.config/chezmoi/key.txt"
    recipient = "age1..."

[data]
profile           = "laptop"
theme             = "maui-dark"
git_name          = "Your Name"
git_email         = "you@example.com"
git_signingkey    = "~/.ssh/id_ed25519"
git_signingformat = "ssh"
machine           = "surface-pro"   # added by hand: selects [machines.surface-pro]

Fields here override same-named fields in .chezmoidata.toml at render time. Per-host feature flags go under [data.features].

~/.dotfiles/mise.toml (Pinned Versions)

Strict versions for working on the repo itself (separate from the user's own mise config). An excerpt:

[settings]
lockfile = true

[tools]
node = "24.14.0"
rust = "1.95.0"
go = "1.26.10"
bun = "1.3.10"
starship = "1.24.2"
sops = "3.13.3"
# ...

~/.config/mise/conf.d/00-dotfiles.toml (Managed)

The base layer, deployed by chezmoi and loaded first, so it has the lowest precedence. ~/.config/mise/config.toml is deliberately not managed: mise use -g and mise upgrade write their version pins there, and those pins override this file.

[settings]
minimum_release_age = "0s"  # explicit: unset falls back to mise's own age gate
auto_install = true
activate_aggressive = true
# mise's own GitHub API calls; the token is never exported
github.credential_command = "gh auth token"

[tools]
node = "24"
python = ["3.12", "3.11", "3.14"]
go = "latest"
# ... more tools

[env]
MISE_EXPERIMENTAL = "1"
DOT_BUILD_ROOT = "{{ xdg_cache_home }}/dot/builds"
GOCACHE = "{{ env.DOT_BUILD_ROOT }}/go-cache"
PIP_CACHE_DIR = "{{ env.DOT_BUILD_ROOT }}/pip-cache"
UV_CACHE_DIR = "{{ env.DOT_BUILD_ROOT }}/uv-cache"
ZIG_LOCAL_CACHE_DIR = "{{ env.DOT_BUILD_ROOT }}/zig-cache"
ZIG_GLOBAL_CACHE_DIR = "{{ env.DOT_BUILD_ROOT }}/zig-global-cache"

[env] never holds a GitHub token: every process mise launches inherits it, including untrusted build and test commands.

~/.cargo/config.toml (Managed)

[build]
jobs = -1
incremental = true
# target-dir is deliberately not set: one shared target directory makes
# concurrent builds across projects wait on Cargo's lock
rustc-wrapper = "sccache"   # only when sccache is installed

~/.config/git/allowed_signers

Template: defaults/dot_config/git/allowed_signers.tmpl

Lists SSH public keys git trusts for signed commits, one per line (principal keytype key):

jane.doe@example.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI...

dot_config/dotfiles/mcp-policy.json and mcp-registry.json

MCP policy and registry, both under defaults/dot_config/dotfiles/. See MCP Policy reference. Excerpts:

{
  "policyVersion": "2026.03",
  "defaultProfile": "strict-local",
  "profiles": {
    "strict-local": {
      "allowedLaunchers": ["npx", "node", "uvx"],
      "trustedTransports": ["stdio", "http"],
      "requireRegistryEntry": true
    },
    "enterprise-remote": {}
  }
}

{
  "registryVersion": "2026.03",
  "servers": {
    "git": {
      "transport": "stdio",
      "launcher": "${HOME}/.local/share/dot-mcp/python/git/venv/bin/mcp-server-git",
      "package": "mcp-server-git==2026.8.18",
      "verification": "hash-pinned-package"
    }
  }
}

dot mcp list prints the registry; dot mcp check checks the setup against the policy.

dot_config/dotfiles/agent-card.json

Agent Card (A2A). An excerpt of defaults/dot_config/dotfiles/agent-card.json as shipped:

{
  "specVersion": "0.3",
  "name": "dotfiles-agent",
  "defaultProfile": "ask",
  "protocols": ["mcp", "a2a"],
  "profiles": ["ask", "plan", "apply", "audit"]
}

The shipped card's version field lags the release (it still names 0.2.501), and several entrypoints (dot agent conformance, dot agent a2a-card) use pre-ADR-020 spellings; dot agent card show and dot agent card check are the declared ones.

Log Files

Cache Files

Ignored Files

Untracked files in the source directory (e.g. editor swap files) are ignored via defaults/.chezmoiignore.tmpl, for example:

.DS_Store
**/.DS_Store
*.swp
**/*.swp
_build
_build/**

See Also

• Environment Reference
• Template Variables
• Feature Flags
• First Install Tutorial