@sebastienrousseau/dotfiles 0.2.468 → 0.2.481

package/docs/TASK.md

@@ -0,0 +1,99 @@
+# Debugging Universal Config
+
+... [Completed Phases 2-16 Unchanged] ...
+
+# Phase 16: Final Release Verification
+- [x] **Benchmark**: Verify startup <20ms <!-- id: 84 -->
+- [x] **Templates**: Verify syntax validity <!-- id: 85 -->
+- [x] **PR Update**: Set final title and description <!-- id: 86 -->
+
+# Phase 17: Structural Optimizations
+- [x] **Semantic Organization**: Rename `dot_config/dotfiles` to `dot_config/shell` <!-- id: 87 -->
+- [x] **Script Installation**: Move `bin` to `dot_local/bin` <!-- id: 88 -->
+- [x] **Cleanup**: Remove `Makefile` and `package.json` <!-- id: 89 -->
+- [x] **Segregation**: Split install scripts by OS <!-- id: 90 -->
+- [x] **Verify Structure**: Ensure templates render correctly <!-- id: 91 -->
+- [x] **Update Documentation**: Overhaul `README.md` for accuracy, logic, and modern tool examples <!-- id: 92 -->
+- [x] **Component READMEs**: Verified and updated `go`, `archives`, `cd`, `gcloud`, `mkdir`, `modern`. <!-- id: 105 -->
+
+# Phase 18: Component Documentation Polish
+- [x] **Aliases**: Update `aliases/README.md` with `chezmoi` usage <!-- id: 93 -->
+- [x] **Functions**: Update `functions/README.md` removing legacy install steps <!-- id: 94 -->
+- [x] **Paths**: Update `paths/README.md` correcting filenames and logic <!-- id: 95 -->
+- [x] **Cleanup**: Fix broken HTML artifacts in alias READMEs (Deep Clean) <!-- id: 96 -->
+- [x] **Cleanup**: Fix broken HTML artifacts in alias READMEs (Deep Clean) <!-- id: 96 -->
+
+# Phase 19: Toolchain Expansion
+- [x] **Kubernetes**: Add `kubectl`, `helm`, `k9s` aliases <!-- id: 97 -->
+- [x] **IaC**: Add `terraform`, `ansible` aliases <!-- id: 98 -->
+- [x] **Languages**: Add `go`, `yarn`, `uv` aliases <!-- id: 99 -->
+- [x] **Diagnostics**: Add `jq`, `yq`, `nc` aliases <!-- id: 100 -->
+
+# Phase 20: Intelligent Assistance
+- [x] **AI**: Add `gh copilot` / AI aliases <!-- id: 101 -->
+- [x] **Smart Help**: Create `dothelp` function <!-- id: 102 -->
+
+# Phase 22: Automated Testing
+- [x] **Docker CI**: Add Linux container install test <!-- id: 103 -->
+- [x] **Integration**: Verify aliases load correctly <!-- id: 104 -->
+# Phase 92: Legal & Licensing
+- [x] **FOSSology**: Add license scanning aliases (`scan-licenses`) <!-- id: 111 -->
+- [x] **Headers**: Add copyright header automation (`add-headers`) <!-- id: 112 -->
+- [x] **CLA**: Add CLA check aliases (`check-cla`) <!-- id: 113 -->
+- [x] **Notice**: Add attribution generation (`gen-notice`) <!-- id: 114 -->
+
+# Pull Request (v0.2.480)
+- [x] Commit and push changes <!-- id: 17 -->
+- [x] Update Pull Request (Completed via gh CLI) <!-- id: 18 -->
+- [x] **Verify PR Content**: Confirmed title and description on GitHub <!-- id: 67 -->
+
+# Phase 23: Enterprise Core & Security (The Trust Layer)
+- [x] **SLSA & SBOM**: Create release workflow for provenance/SBOM <!-- id: 116 -->
+- [x] **Signing**: Add aliases for Git GPG/SSH signing configuration (`enable-signing`) <!-- id: 117 -->
+- [x] **Immutability**: Create script to lock/unlock critical files (`lock-configs`) <!-- id: 118 -->
+
+# Phase 27: Self-Healing & Diagnostics
+- [x] **Health Checks**: Create `dot doctor` script (`scripts/diagnostics/doctor.sh`) <!-- id: 121 -->
+- [x] **Drift Detection**: Add `dot drift` alias for `chezmoi verify` <!-- id: 122 -->
+- [x] **Auto-Repair**: Add `dot heal` alias for interactive repair <!-- id: 123 -->
+
+# Phase 51: Regulatory Compliance
+- [x] **SOC2/ISO**: Create `COMPLIANCE.md` mapping controls to dotfiles features <!-- id: 124 -->
+- [x] **Privacy Mode**: Create `privacy-mode` alias (telemetry disabling) <!-- id: 125 -->
+- [x] **Audit**: Create `dot audit` alias to view compliance logs <!-- id: 126 -->
+
+# Phase 54: macOS Deep Integration
+- [x] **Defaults**: Create `run_onchange_darwin_defaults.sh.tmpl` for system hardening <!-- id: 127 -->
+- [x] **Brewfile**: Enforce strict bundle verification <!-- id: 128 -->
+
+# Phase 59: Font Typography
+- [x] **Nerd Fonts**: Create `run_onchange_install_fonts.sh.tmpl` to install JetBrainsMono/Symbols <!-- id: 129 -->
+- [x] **Fontconfig**: Create `dot_config/fontconfig/fonts.conf.tmpl` for Linux rendering <!-- id: 130 -->
+- [x] **Aliases**: Add `update-fonts` alias <!-- id: 131 -->
+
+# Phase 26: OS Bundling & Compliance
+- [x] **XDG**: Audit and enforce XDG Base Directory variables <!-- id: 132 -->
+- [x] **Vendor Hooks**: Implement `/etc/dotfiles/defaults.d` sourcing in shell init <!-- id: 133 -->
+- [x] **Bundling**: Create `scripts/core/package.sh` to generate release artifacts (.tar.gz, .deb structure) <!-- id: 134 -->
+
+# Phase 24: The Universal Installer (Zero-Dependency)
+- [x] **Installer**: Create `install.sh` (Zero-dep, TUI-like bootstrap) <!-- id: 135 -->
+- [x] **Teleport**: Create `scripts/ops/teleport.sh` to push config to remote hosts <!-- id: 136 -->
+- [x] **Aliases**: Add `dot install` and `dot teleport` aliases <!-- id: 137 -->
+
+# Post-Release Hotfixes
+- [x] **Codacy**: Fix linting in `detect-collisions.py` (Round 1) <!-- id: 106 -->
+- [x] **Codacy**: Fix linting in `modern.aliases.sh`, `pipx.paths.sh`, and `detect-collisions.py` (Round 2) <!-- id: 120 -->
+- [x] **Roadmap**: Rewrite full 100-phase roadmap <!-- id: 107 -->
+- [x] **Zinit**: Fix bootstrap and valid Zsh sourcing <!-- id: 108 -->
+- [x] **Vim**: Fix install script robustness <!-- id: 109 -->
+- [x] **Pipx**: Fix "space in path" warning via explicit XDG vars <!-- id: 110 -->
+- [x] **Aliases**: Removed broken `dotfiles_history` alias <!-- id: 115 -->
+- [x] **Security**: Full Phase 23 implementation (SLSA, Signing, Locks) <!-- id: 119 -->
+
+# Chezmoi Migration
+- [x] Verify `chezmoi` installation <!-- id: 12 -->
+- [x] Initialize `chezmoi` and create plan <!-- id: 13 -->
+- [x] Migrate key config files (`.zshrc`, etc.) to `chezmoi` <!-- id: 14 -->
+- [x] Create cross-platform templates (Mac/Linux/Windows) <!-- id: 15 -->
+- [x] Verify `chezmoi apply` locally <!-- id: 16 -->

package/docs/TESTING.md

@@ -0,0 +1,190 @@
+# Testing strategy
+
+## Overview
+
+This repository uses a multi-layer testing approach:
+- **Unit Tests**: Individual function validation
+- **Integration Tests**: System-wide behavior verification
+- **Performance Tests**: Resource efficiency benchmarks
+
+## Running tests
+
+### Quick start
+```bash
+# Run all unit tests
+./scripts/tests/framework/test_runner.sh
+
+# Run specific test suite
+./scripts/tests/framework/test_runner.sh extract
+
+# Run integration tests
+RUN_INTEGRATION=1 ./scripts/tests/framework/test_runner.sh
+
+# Run performance benchmarks
+./scripts/tests/performance/benchmark_runner.sh
+```
+
+## Test structure
+
+```
+scripts/tests/
+├── framework/           # Test framework
+│   ├── assertions.sh    # 15+ assertion functions
+│   ├── mocks.sh        # Mock utilities
+│   └── test_runner.sh  # Test executor
+├── unit/               # Unit tests
+├── integration/        # Integration tests
+└── performance/        # Benchmarks
+```
+
+## Writing tests
+
+### Test file template
+```bash
+#!/usr/bin/env bash
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/../framework/assertions.sh"
+
+# Source function under test
+source "$HOME/.dotfiles/.chezmoitemplates/functions/myfunction.sh"
+
+# Test cases
+test_start "function_basic_usage"
+assert_exit_code 0 "myfunction arg1"
+
+test_start "function_no_args"
+assert_exit_code 1 "myfunction"
+```
+
+### Available assertions
+
+| Function | Description |
+|----------|-------------|
+| `assert_equals expected actual [msg]` | Assert two values are equal |
+| `assert_not_equals unexpected actual [msg]` | Assert two values differ |
+| `assert_exit_code code command` | Assert command exits with code |
+| `assert_output_contains needle command` | Assert output contains string |
+| `assert_output_not_contains needle command` | Assert output lacks string |
+| `assert_output_matches pattern command` | Assert output matches regex |
+| `assert_file_exists path [msg]` | Assert file exists |
+| `assert_file_not_exists path [msg]` | Assert file doesn't exist |
+| `assert_dir_exists path [msg]` | Assert directory exists |
+| `assert_dir_not_exists path [msg]` | Assert directory doesn't exist |
+| `assert_true condition [msg]` | Assert condition is true |
+| `assert_false condition [msg]` | Assert condition is false |
+| `assert_empty value [msg]` | Assert string is empty |
+| `assert_not_empty value [msg]` | Assert string is not empty |
+| `assert_file_contains file needle [msg]` | Assert file contains text |
+
+### Mock utilities
+
+| Function | Description |
+|----------|-------------|
+| `mock_init` | Initialize mock environment |
+| `mock_command name output [exit_code]` | Create mock command |
+| `mock_command_spy name [output] [exit_code]` | Create mock that records calls |
+| `mock_get_calls name` | Get spy call history |
+| `mock_call_count name` | Get number of spy calls |
+| `mock_file content [filename]` | Create temp file with content |
+| `mock_dir [prefix]` | Create temp directory |
+| `mock_archive type [content]` | Create mock archive file |
+| `mock_env var_name value` | Set environment variable |
+| `mock_cleanup` | Clean up all mocks |
+
+## Coverage goals
+
+| Category | Target | Current |
+|----------|--------|---------|
+| Functions | >80% | ~85% |
+| Scripts | >70% | ~75% |
+| Integration | >90% | ~95% |
+
+## CI integration
+
+Tests run automatically on:
+- Every push to main
+- Every pull request
+- Weekly scheduled runs (Monday 6 AM UTC)
+
+### GitHub Actions example
+
+```yaml
+- name: Run Tests
+  run: |
+    chmod +x ./scripts/tests/framework/test_runner.sh
+    ./scripts/tests/framework/test_runner.sh
+
+- name: Run Integration Tests
+  run: |
+    RUN_INTEGRATION=1 ./scripts/tests/framework/test_runner.sh
+
+- name: Run Performance Benchmarks
+  run: |
+    ./scripts/tests/performance/benchmark_runner.sh
+```
+
+## Test categories
+
+### Unit Tests (`scripts/tests/unit/`)
+
+Test individual functions in isolation:
+
+- **test_extract.sh** - Archive extraction function
+- **test_backup.sh** - Backup creation function
+- **test_genpass.sh** - Password generation function
+- **test_rd.sh** - Directory removal function (with security tests)
+- **test_cd_aliases.sh** - Directory navigation aliases
+
+### Integration Tests (`scripts/tests/integration/`)
+
+Test complete workflows:
+
+- **test_install.sh** - Installation script validation
+
+### Performance Tests (`scripts/tests/performance/`)
+
+Measure resource efficiency:
+
+- **benchmark_runner.sh** - Shell startup and operation benchmarks
+- **stress_test.sh** - Load testing utilities
+
+## Environment variables
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `RUN_INTEGRATION` | `0` | Set to `1` to run integration tests |
+| `VERBOSE` | `0` | Set to `1` for verbose output |
+| `REPO_ROOT` | Auto-detected | Repository root directory |
+| `TESTS_DIR` | Auto-detected | Tests directory |
+
+## Best practices
+
+1. **Isolation**: Each test should be independent
+2. **Cleanup**: Use mocks that auto-cleanup via traps
+3. **No Sleep**: Avoid `sleep` or hardcoded delays
+4. **Descriptive Names**: Test names should describe what's being tested
+5. **Edge Cases**: Test error conditions, not just happy paths
+6. **Security**: Include tests for dangerous input rejection
+
+## Troubleshooting
+
+### Tests not found
+
+Ensure test files match the pattern `test_*.sh` and are executable:
+
+```bash
+chmod +x scripts/tests/unit/test_*.sh
+chmod +x scripts/tests/integration/test_*.sh
+```
+
+### Function not available
+
+If a test shows "function not available", verify the source file exists:
+
+```bash
+ls -la .chezmoitemplates/functions/
+```
+
+### Mock cleanup issues
+
+If mocks aren't cleaning up, ensure you're not running with `set -e` before mock operations that might fail.

package/docs/TOOLS.md

@@ -0,0 +1,146 @@
+# Tools
+
+These are the main tools and CLI conveniences included with Dotfiles.
+
+## Core
+
+| Tool | Description |
+|------|-------------|
+| Zsh | Shell |
+| Starship | Cross-shell prompt |
+| tmux | Terminal multiplexer |
+| Neovim | Modern Vim-based editor |
+
+## Search and navigation
+
+| Tool | Description |
+|------|-------------|
+| fzf | Fuzzy finder |
+| zoxide | Smart directory jumping |
+| ripgrep | Fast text search |
+| fd | Developer-friendly find |
+| bat | Cat with syntax highlighting |
+| eza | Modern ls replacement |
+| lsd | LSDeluxe file listing |
+| duf | Disk usage utility |
+| ncdu | NCurses disk usage |
+| htop | Process viewer |
+| btop | Resource monitor |
+
+## Terminal
+
+| Tool | Description |
+|------|-------------|
+| WezTerm | GPU-accelerated terminal |
+| Alacritty | Fast terminal |
+| Kitty | Feature-rich terminal |
+| Ghostty | Native terminal |
+| fastfetch | System info |
+| figlet | ASCII banners |
+| lolcat | Rainbow output |
+| cowsay | ASCII cow messages |
+| cmatrix | Matrix screensaver |
+| pipes | Pipe screensaver |
+| atuin | Shell history sync |
+| yazi | Terminal file manager |
+
+## Git
+
+| Tool | Description |
+|------|-------------|
+| git | Version control |
+| lazygit | Terminal UI for Git |
+| delta | Syntax-highlighted diffs |
+| gh | GitHub CLI |
+| glab | GitLab CLI |
+
+## AI CLI Tools
+
+| Tool | NPM Package | Description |
+|------|-------------|-------------|
+| claude | @anthropic-ai/claude-code | Anthropic Claude CLI |
+| gemini | @google/gemini-cli | Google Gemini CLI |
+| sgpt | shell-gpt | OpenAI-compatible CLI (Shell GPT) |
+| ollama | ollama | Local LLM runtime and CLI |
+| codex | @openai/codex | OpenAI Codex CLI |
+| opencode | opencode-ai | OpenCode AI assistant |
+| droid | @factory/cli | Factory AI Droid |
+| aider | aider-chat | Git-native AI pair programming |
+
+
+## Data processing
+
+
+| Tool | Description |
+|------|-------------|
+| jq | JSON processor |
+| yq | YAML processor |
+| hexyl | Hex viewer |
+
+## Kubernetes
+
+| Tool | Description |
+|------|-------------|
+| kubectl | Kubernetes CLI |
+| kubectx | Context switcher |
+| kubens | Namespace switcher |
+| k9s | Kubernetes TUI |
+| stern | Multi-pod log tailer |
+| kube-linter | Manifest linter |
+| kubesec | Security scanner |
+| minikube | Local Kubernetes |
+| helm | Package manager |
+
+## Database CLIs
+
+| Tool | Description |
+|------|-------------|
+| psql | PostgreSQL CLI |
+| mycli | MySQL CLI with autocomplete |
+| sqlite3 | SQLite CLI |
+| redis-cli | Redis CLI |
+| mongosh | MongoDB Shell |
+
+## Security
+
+| Tool | Description |
+|------|-------------|
+| age | Modern encryption |
+| gnupg | OpenPGP implementation |
+
+## Developer tools
+
+- Git helpers and sane defaults
+- Project templates (`dot new`)
+- Sandbox preview (`dot sandbox`)
+- Benchmarking (`dot benchmark`)
+- Lua tooling (`luacheck`, `stylua`, `luarocks`, `lua/luajit`)
+
+## Security features
+
+- Firewall hardening
+- Telemetry disable
+- DNS-over-HTTPS (Linux)
+- Lock-screen enforcement
+- Encryption checks
+
+## Aliases
+
+Aliases live in category directories under:
+
+```
+~/.dotfiles/.chezmoitemplates/aliases/<category>/<name>.aliases.sh
+```
+
+Apply changes with:
+
+```bash
+chezmoi apply
+```
+
+## Make it yours
+
+- Wallpaper sync/rotate scripts
+- Cursor and icon theming helpers (Linux)
+- Lock screen icon helper (Linux)
+- GRUB theme / boot logo helpers (Linux)

package/docs/TROUBLESHOOTING.md

@@ -0,0 +1,112 @@
+# Troubleshooting
+
+Quick checks for common issues.
+
+## Install and update
+
+**Problem:** Install script fails immediately
+- Verify that `git` and `curl` are installed.
+- Check internet connectivity.
+- Try running with verbose output: `bash -x install.sh`
+
+**Problem:** Chezmoi apply fails
+- Re-run `chezmoi apply` to re-sync state.
+- Check for merge conflicts: `chezmoi diff`
+- If hooks fail, check `~/.local/share/dotfiles.log` for details.
+
+**Problem:** Packages fail to install
+- macOS: Verify Homebrew is installed and up to date (`brew update`)
+- Linux: Run `sudo apt-get update` first
+- Verify you have sufficient permissions
+
+## Shell startup
+
+**Problem:** Shell is slow to start
+- Run `dot benchmark` to measure startup time
+- Profile with `zsh -x` to trace startup
+- Check for slow plugins or large history files
+
+**Problem:** Aliases or functions not available
+- Run `chezmoi apply` to regenerate config files
+- Source your shell config: `source ~/.zshrc`
+- Verify the relevant tool is installed
+
+**Problem:** Shell crashes on startup
+- Temporarily move `~/.zshrc` and retry to isolate the fault
+- Check for syntax errors: `zsh -n ~/.zshrc`
+- Review recent changes: `chezmoi diff`
+
+## Secrets and encryption
+
+**Problem:** Encrypted files fail to decrypt
+- Confirm `~/.config/chezmoi/key.txt` exists.
+- Verify the key matches the one used for encryption.
+- Re-initialize with `dot secrets-init` if needed.
+
+**Problem:** Age encryption not working
+- Verify `age` is installed: `command -v age`
+- Check key permissions: `ls -la ~/.config/chezmoi/key.txt` (should be 600)
+
+## Neovim
+
+**Problem:** Plugins fail to load
+- Run `:checkhealth` in Neovim
+- Update plugins: `:Lazy sync`
+- Check for missing dependencies (node, python, etc.)
+
+**Problem:** LSP not working
+- Install required language servers
+- Check `:LspInfo` for status
+- Review `:LspLog` for errors
+
+## Git
+
+**Problem:** Git aliases not working
+- Check if Git config is applied: `git config --list`
+- Re-apply dotfiles: `chezmoi apply`
+
+**Problem:** Delta (diff pager) not showing colors
+- Verify `delta` is installed
+- Confirm your terminal supports 256 colors
+
+## Kubernetes tools
+
+**Problem:** kubectl context issues
+- List contexts: `kubectl config get-contexts`
+- Switch context: `kubectx <context-name>`
+- Check kubeconfig: `echo $KUBECONFIG`
+
+**Problem:** Minikube won't start
+- Verify Docker is running
+- Try: `minikube delete && minikube start`
+- Check logs: `minikube logs`
+
+## Performance
+
+**Problem:** High memory usage
+- Look for runaway processes: `htop` or `btop`
+- Review shell history size in atuin config
+- Disable unused plugins
+
+## Advanced Troubleshooting
+
+### WSL2 and Nix Integration Issues
+
+For complex WSL2 edge cases, Nix integration problems, and recovery procedures, see the comprehensive guide:
+**[WSL2 & Nix Troubleshooting Guide](WSL2_NIX_TROUBLESHOOTING.md)**
+
+This guide covers:
+- WSL2 filesystem and networking edge cases
+- Nix installation and flake management issues
+- Complete system recovery procedures
+- Performance optimization for WSL2/Nix environments
+- Cross-platform migration scenarios
+
+## Still stuck
+
+Open an issue with:
+- OS + version
+- Output of `dot doctor` (if available)
+- Relevant log snippets from `~/.local/share/dotfiles.log`
+- Steps to reproduce the issue
+- For WSL2/Nix issues: Include diagnostic report from the advanced guide

package/docs/UTILS.md

@@ -0,0 +1,105 @@
+# Discover utilities
+
+These utilities are available through aliases, functions, and the `dot` CLI. The collection stays small and practical on purpose.
+
+## Dot CLI
+
+The `dot` command is your primary interface for managing dotfiles. Run `dot --version` to check the installed version.
+
+### Core commands
+
+| Command | Description |
+|---------|-------------|
+| `dot apply` | Apply dotfiles (chezmoi apply) |
+| `dot sync` | Alias of apply |
+| `dot update` | Pull latest changes and apply |
+| `dot add <file>` | Add a file to chezmoi source |
+| `dot diff` | Show local changes (excludes scripts) |
+| `dot status` | Show configuration drift |
+| `dot cd` | Print source directory path |
+| `dot edit` | Open source in your editor |
+
+### Diagnostics
+
+| Command | Description |
+|---------|-------------|
+| `dot doctor` | Run system health checks |
+| `dot drift` | Detailed configuration drift dashboard |
+| `dot history` | Analyse shell history |
+| `dot benchmark` | Measure shell startup time |
+
+### Tools
+
+| Command | Description |
+|---------|-------------|
+| `dot tools` | Show tools documentation |
+| `dot tools install` | Enter Nix development shell |
+| `dot new <lang> <name>` | Scaffold a project (python/go/node) |
+| `dot sandbox` | Launch Docker sandbox preview |
+| `dot log-rotate` | Rotate `~/.local/share/dotfiles.log` |
+
+## Git
+
+You can use these shorthand aliases for everyday Git operations:
+
+- `g`, `ga`, `gco`, `gst`, `gl`, `gll`, and related aliases
+- `lg` shows a graph log; `lgui` opens `lazygit` (if installed)
+- `gh` aliases in `~/.config/gh/config.yml`
+
+## Docker
+
+These Docker aliases help you manage containers and images:
+
+- `dco` for `docker compose`
+- `dps`, `dpsa` for container listing
+- `dexec`, `denter` for container shells
+- `dlogsf`, `dl` for following logs
+- `dprune`, `dprunea` for system cleanup
+- `dbx`, `dbxbuild` for buildx operations
+- `lzd` for lazydocker TUI
+
+## Search
+
+You can search and navigate your filesystem with:
+
+- `rg` (ripgrep), `fd` (find)
+- `z <dir>` (zoxide jump)
+
+## Text
+
+- `jq` for JSON
+- `bat` for quick file previews
+
+## Terminal
+
+- `banner` for quick figlet-style banners
+- `rainbow` for lolcat-style output
+- `emoji` for an emoji picker (copies to clipboard)
+- `pipes` for a terminal screensaver
+- `cmatrix` wrapper with defaults
+
+## Network
+
+You can debug HTTP requests with:
+
+- `curlheader`, `curlstatus`, `curltime`, `httpdebug`
+
+## Appearance
+
+- `dot theme` to switch terminal themes (dark/light)
+- `dot wallpaper` to apply a wallpaper
+- `dot fonts` to install Nerd Fonts
+
+## Security (opt-in)
+
+- `dot backup` to create a compressed backup
+- `dot encrypt-check` to check disk encryption status
+- `dot firewall` to apply firewall hardening
+- `dot telemetry` to disable telemetry
+- `dot dns-doh` to enable DNS-over-HTTPS
+- `dot lock-screen` to enforce lock screen idle settings
+- `dot usb-safety` to disable automount for removable media
+
+## Fonts
+
+- `~/.dotfiles/scripts/fonts/patch-fonts.sh` to patch a font with Nerd Fonts