Workstation Config

I dislike either starting on a new computer or managing the configuration between to machines. I like my workstations to be consistent in how they operate. In addition I care greatly about security and I don't want to forget to set something up on one of the workstations and leave myself vulnerable. To solve this I follow the gitops practices for my own workstations.

I use Chezmoi and Ansible to manage my system config. Together those allow me to make my configuration declaritive which is a huge improvement over how I used to manage my system configs with bash scripts. The bash scripts always were out of date, they didn't work to really add to since they went through the whole setup process every time which could result in weird edge cases. In addition to all those downsides they were tedious to maintain and by the time I got a new machine they had to be rewritten.

With Chezmoi managing my dot files like my vim config or AGENTS.md its been so much easier to enforce. It has been nice to also have all my packages synced between my machines and the various managers like Python's UV and Nodes Volta managed as well by Ansible.

I do also care greatly about security and so all my systems have authentication around many processes all backed by hardware two factor via Yubikeys. (side note that I can't wait for the rust implementation of sudo to work with yubikeys) I do use a custom tool to inject secrets at runtime based on an environment file with just the name of the secret. The tool enumerates my various secret providers and fills in the secrets from those locations meaning agents or me never hold the secrets so the can't be leaked which is super helpful.