.dotfiles

Security

Security

How dotfiles handles security and system modifications.

Core Principles

  • Opt-In Only — No hardening applies unless DOTFILES_* variables are set to 1.
  • Local Logging — All actions log to ~/.local/share/dotfiles.log. No telemetry.
  • No Hidden Sudo — Sudo requests only for package managers. Never cached indefinitely.

Hardening

Feature Env Var Action (macOS) Action (Linux)
Firewall DOTFILES_FIREWALL Enables socketfilterfw + Stealth Mode Configures UFW
Telemetry DOTFILES_TELEMETRY Disables Diagnostic plists Disables whoopsie/apport
DNS-over-HTTPS DOTFILES_DOH Browser-level settings Configures resolvectl
Idle Security DOTFILES_LOCK Sets screensaver idle time Sets GNOME/KDE idle-delay

Secrets

The dotfiles use age for encryption.

  • Initialization: dot secrets-init creates a key at ~/.config/chezmoi/key.txt.
  • Storage: Secrets are stored as .age encrypted files.
  • Protection: Private keys aren't committed to the repo.

SSH Certificates

Short-lived SSH certificates reduce the blast radius of key compromise.

  • Issue: dot ssh-cert issue [--ttl 16h] [--principal user]
  • Status: dot ssh-cert status — checks certificate validity and expiry
  • Revoke: dot ssh-cert revoke — revokes active certificates
  • Backends: step-ca (Smallstep) and local CA key (ssh-keygen)
  • Default TTL: 16 hours (override via SSH_CERT_TTL environment variable)
  • CA URL: Set SSH_CERT_CA_URL for step-ca integration

Reporting a Vulnerability

If you discover a security vulnerability, don't open a public issue. Follow the instructions in the Security Policy.