yadm(1) | General Commands Manual | yadm(1) |
yadm - Yet Another Dotfiles Manager
yadm command [options]
yadm git-command-or-alias [options]
yadm init [-f] [-w dir]
yadm clone url [-f] [-w dir] [-b branch] [--bootstrap] [--no-bootstrap]
yadm config name [value]
yadm config [-e]
yadm list [-a]
yadm bootstrap
yadm encrypt
yadm decrypt [-l]
yadm alt
yadm perms
yadm enter [ command ]
yadm git-crypt [ options ]
yadm transcrypt [ options ]
yadm upgrade [-f]
yadm introspect category
yadm is a tool for managing a collection of files across multiple computers, using a shared Git repository. In addition, yadm provides a feature to select alternate versions of files for particular systems. Lastly, yadm supplies the ability to manage a subset of secure files, which are encrypted before they are included in the repository.
Dotfiles are managed by using standard git commands; add, commit, push, pull, etc.
The config command is not passed directly through. Instead use the gitconfig command (see below).
The repository is stored in $HOME/.local/share/yadm/repo.git. By default, $HOME will be used as the work-tree, but this can be overridden with the -w option. yadm can be forced to overwrite an existing repository by providing the -f option. If you want to use a branch other than the remote HEAD branch you can specify it using the -b option. By default yadm will ask the user if the bootstrap program should be run (if it exists). The options --bootstrap or --no-bootstrap will either force the bootstrap to be run, or prevent it from being run, without prompting the user.
Optionally, you can provide a command after "enter", and instead of invoking your shell, that command will be run with all of the Git variables exposed to the command's environment.
Emacs Tramp and Magit can manage files by using this configuration:
git-crypt enables transparent encryption and decryption of files in a git repository. You can read https://github.com/AGWA/git-crypt for details.
transcrypt enables transparent encryption and decryption of files in a git repository. You can read https://github.com/elasticdog/transcrypt for details.
Upgrading will attempt to de-initialize and re-initialize your submodules. If your submodules cannot be de-initialized, the upgrade will fail. The most common reason submodules will fail to de-initialize is because they have local modifications. If you are willing to lose the local modifications to those submodules, you can use the -f option with the "upgrade" command to force the de-initialization.
After running "yadm upgrade", you should run "yadm status" to review changes which have been staged, and commit them to your repository.
You can read https://yadm.io/docs/upgrade_from_2 for more information.
yadm supports a set of universal options that alter the paths it uses. The default paths are documented in the FILES section. Any path specified by these options must be fully qualified. If you always want to override one or more of these paths, it may be useful to create an alias for the yadm command. For example, the following alias could be used to override the repository directory.
The following is the full list of universal options. Each option should be followed by a path.
yadm uses a configuration file named $HOME/.config/yadm/config. This file uses the same format as git-config(1). Also, you can control the contents of the configuration file via the yadm config command (which works exactly like git-config). For example, to disable alternates you can run the command:
The following is the full list of supported configurations:
When managing a set of files across different systems, it can be useful to have an automated way of choosing an alternate version of a file for a different operating system, host, user, etc.
yadm will automatically create a symbolic link to the appropriate version of a file, when a valid suffix is appended to the filename. The suffix contains the conditions that must be met for that file to be used.
The suffix begins with "##", followed by any number of conditions separated by commas.
##<condition>[,<condition>,...]
Each condition is an attribute/value pair, separated by a period. Some conditions do not require a "value", and in that case, the period and value can be omitted. Most attributes can be abbreviated as a single letter.
<attribute>[.<value>]
These are the supported attributes, in the order of the weighted precedence:
NOTE: The OS for "Windows Subsystem for Linux" is reported as "WSL", even though uname identifies as "Linux".
You may use any number of conditions, in any order. An alternate will only be used if ALL conditions are valid. For all files managed by yadm's repository or listed in $HOME/.config/yadm/encrypt, if they match this naming convention, symbolic links will be created for the most appropriate version.
The "most appropriate" version is determined by calculating a score for each version of a file. A template is always scored higher than any symlink condition. The number of conditions is the next largest factor in scoring. Files with more conditions will always be favored. Any invalid condition will disqualify that file completely.
If you don't care to have all versions of alternates stored in the same directory as the generated symlink, you can place them in the $HOME/.config/yadm/alt directory. The generated symlink or processed template will be created using the same relative path.
Alternate linking may best be demonstrated by example. Assume the following files are managed by yadm's repository:
- $HOME/path/example.txt##default
- $HOME/path/example.txt##class.Work
- $HOME/path/example.txt##os.Darwin
- $HOME/path/example.txt##os.Darwin,hostname.host1
- $HOME/path/example.txt##os.Darwin,hostname.host2
- $HOME/path/example.txt##os.Linux
- $HOME/path/example.txt##os.Linux,hostname.host1
- $HOME/path/example.txt##os.Linux,hostname.host2
If running on a Macbook named "host2", yadm will create a symbolic link which looks like this:
$HOME/path/example.txt -> $HOME/path/example.txt##os.Darwin,hostname.host2
However, on another Mackbook named "host3", yadm will create a symbolic link which looks like this:
$HOME/path/example.txt -> $HOME/path/example.txt##os.Darwin
Since the hostname doesn't match any of the managed files, the more generic version is chosen.
If running on a Linux server named "host4", the link will be:
$HOME/path/example.txt -> $HOME/path/example.txt##os.Linux
If running on a Solaris server, the link will use the default version:
$HOME/path/example.txt -> $HOME/path/example.txt##default
If running on a system, with class set to "Work", the link will be:
$HOME/path/example.txt -> $HOME/path/example.txt##class.Work
If no "##default" version exists and no files have valid conditions, then no link will be created.
Links are also created for directories named this way, as long as they have at least one yadm managed file within them (at the top level).
yadm will automatically create these links by default. This can be disabled using the yadm.auto-alt configuration. Even if disabled, links can be manually created by running yadm alt.
Class is a special value which is stored locally on each host (inside the local repository). To use alternate symlinks using class, you must set the value of class using the configuration local.class. This is set like any other yadm configuration with the yadm config command. The following sets the class to be "Work".
yadm config local.class Work
Similarly, the values of architecture, os, hostname, and user can be manually overridden using the configuration options local.arch, local.os, local.hostname, and local.user.
If a template condition is defined in an alternate file's "##" suffix, and the necessary dependencies for the template are available, then the file will be processed to create or overwrite files.
Supported template processors:
<% yadm config mysection.myconfig %>
To use the ESH template processor, specify the value of "esh"
NOTE: Specifying "j2" as the processor will attempt to use j2cli or envtpl, whichever is available.
If the template processor specified is available, templates will be processed to create or overwrite files.
During processing, the following variables are available in the template:
Default Jinja or ESH Description
------------- ------------- ----------------------------
yadm.arch YADM_ARCH uname -m
yadm.class YADM_CLASS Last locally defined class
yadm.classes YADM_CLASSES All classes
yadm.distro YADM_DISTRO lsb_release -si
yadm.distro_family YADM_DISTRO_FAMILY ID_LIKE from /etc/os-release
yadm.hostname YADM_HOSTNAME uname -n (without domain)
yadm.os YADM_OS uname -s
yadm.source YADM_SOURCE Template filename
yadm.user YADM_USER id -u -n
env.VAR Environment variable VAR
NOTE: The OS for "Windows Subsystem for Linux" is reported as "WSL", even though uname identifies as "Linux".
NOTE: If lsb_release is not available, DISTRO will be the ID specified in /etc/os-release.
Examples:
whatever##template with the following content
{% if yadm.user == "harvey" %}
config={{yadm.class}}-{{yadm.os}}
{% else %}
config=dev-whatever
{% include "whatever.extra" %}
{% endif %}
would output a file named whatever with the following content if the user is "harvey":
config=work-Linux
and the following otherwise (if whatever.extra contains admin=false):
config=dev-whatever
admin=false
An equivalent Jinja template named whatever##template.j2 would look like:
{% if YADM_USER == 'harvey' -%}
config={{YADM_CLASS}}-{{YADM_OS}}
{% else -%}
config=dev-whatever
{% include 'whatever.extra' %}
{% endif -%}
An equivalent ESH templated named whatever##template.esh would look like:
<% if [ "$YADM_USER" = "harvey" ]; then -%>
config=<%= $YADM_CLASS %>-<%= $YADM_OS %>
<% else -%>
config=dev-whatever
<%+ whatever.extra %>
<% fi -%>
It can be useful to manage confidential files, like SSH or GPG keys, across multiple systems. However, doing so would put plain text data into a Git repository, which often resides on a public system. yadm can make it easy to encrypt and decrypt a set of files so the encrypted version can be maintained in the Git repository. This feature will only work if a supported tool is available. Both gpg(1) and openssl(1) are supported. gpg is used by default, but openssl can be configured with the yadm.cipher configuration.
To use this feature, a list of patterns must be created and saved as $HOME/.config/yadm/encrypt. This list of patterns should be relative to the configured work-tree (usually $HOME). For example:
Standard filename expansions (*, ?, [) are supported. If you have Bash version 4, you may use "**" to match all subdirectories. Other shell expansions like brace and tilde are not supported. Spaces in paths are supported, and should not be quoted. If a directory is specified, its contents will be included, but not recursively. Paths beginning with a "!" will be excluded.
The yadm encrypt command will find all files matching the patterns, and prompt for a password. Once a password has confirmed, the matching files will be encrypted and saved as $HOME/.local/share/yadm/archive. The "encrypt" and "archive" files should be added to the yadm repository so they are available across multiple systems.
To decrypt these files later, or on another system run yadm decrypt and provide the correct password. After files are decrypted, permissions are automatically updated as described in the PERMISSIONS section.
Symmetric encryption is used by default, but asymmetric encryption may be enabled using the yadm.gpg-recipient configuration.
NOTE: It is recommended that you use a private repository when keeping confidential files, even though they are encrypted.
Patterns found in $HOME/.config/yadm/encrypt are automatically added to the repository's info/exclude file every time yadm encrypt is run. This is to prevent accidentally committing sensitive data to the repository. This can be disabled using the yadm.auto-exclude configuration.
Using transcrypt or git-crypt
A completely separate option for encrypting data is to install and use transcrypt or git-crypt. Once installed, you can use these tools by running yadm transcrypt or yadm git-crypt. These tools enables transparent encryption and decryption of files in a git repository. See the following web sites for more information:
- https://github.com/elasticdog/transcrypt
- https://github.com/AGWA/git-crypt
When files are checked out of a Git repository, their initial permissions are dependent upon the user's umask. Because of this, yadm will automatically update the permissions of some file paths. The "group" and "others" permissions will be removed from the following files:
- $HOME/.local/share/yadm/archive
- All files matching patterns in $HOME/.config/yadm/encrypt
- The SSH directory and files, .ssh/*
- The GPG directory and files, .gnupg/*
yadm will automatically update permissions by default. This can be disabled using the yadm.auto-perms configuration. Even if disabled, permissions can be manually updated by running yadm perms. The .ssh directory processing can be disabled using the yadm.ssh-perms configuration. The .gnupg directory processing can be disabled using the yadm.gpg-perms configuration.
When cloning a repo which includes data in a .ssh or .gnupg directory, if those directories do not exist at the time of cloning, yadm will create the directories with mask 0700 prior to merging the fetched data into the work-tree.
When running a Git command and .ssh or .gnupg directories do not exist, yadm will create those directories with mask 0700 prior to running the Git command. This can be disabled using the yadm.auto-private-dirs configuration.
For every command yadm supports, a program can be provided to run before or after that command. These are referred to as "hooks". yadm looks for hooks in the directory $HOME/.config/yadm/hooks. Each hook is named using a prefix of pre_ or post_, followed by the command which should trigger the hook. For example, to create a hook which is run after every yadm pull command, create a hook named post_pull. Hooks must have the executable file permission set.
If a pre_ hook is defined, and the hook terminates with a non-zero exit status, yadm will refuse to run the yadm command. For example, if a pre_commit hook is defined, but that command ends with a non-zero exit status, the yadm commit will never be run. This allows one to "short-circuit" any operation using a pre_ hook.
Hooks have the following environment variables available to them at runtime:
All of yadm's configurations are relative to the "yadm directory". yadm uses the "XDG Base Directory Specification" to determine this directory. If the environment variable $XDG_CONFIG_HOME is defined as a fully qualified path, this directory will be $XDG_CONFIG_HOME/yadm. Otherwise it will be $HOME/.config/yadm.
Similarly, yadm's data files are relative to the "yadm data directory". yadm uses the "XDG Base Directory Specification" to determine this directory. If the environment variable $XDG_DATA_HOME is defined as a fully qualified path, this directory will be $XDG_DATA_HOME/yadm. Otherwise it will be $HOME/.local/share/yadm.
The following are the default paths yadm uses for its own data. Most of these paths can be altered using universal options. See the OPTIONS section for details.
Report issues or create pull requests at GitHub:
https://github.com/TheLocehiliosan/yadm/issues
Tim Byrne <sultan@locehilios.com>
git(1), gpg(1) openssl(1) transcrypt(1) git-crypt(1)
https://yadm.io/
23 January 2023 | 3.2.2 |