@sebastienrousseau/dotfiles 0.2.481 → 0.2.499

package/scripts/secrets/encrypt-ssh-key.sh

@@ -1,42 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-KEY_PATH="${1:-$HOME/.ssh/id_ed25519}"
-OUT_FILE="${2:-$HOME/.config/chezmoi/encrypted_id_ed25519.age}"
-KEYRING_DIR="$HOME/.config/chezmoi"
-AGE_KEY="$KEYRING_DIR/key.txt"
-
-if [ ! -f "$KEY_PATH" ]; then
-  echo "SSH key not found: $KEY_PATH"
-  exit 1
-fi
-
-if [ ! -f "$AGE_KEY" ]; then
-  echo "Age identity not found: $AGE_KEY"
-  echo "Run: dot secrets-init"
-  exit 1
-fi
-
-if ! command -v age >/dev/null; then
-  echo "age not found. Install it first."
-  exit 1
-fi
-
-recipient="$(age-keygen -y "$AGE_KEY")"
-mkdir -p "$(dirname "$OUT_FILE")"
-
-if [ -f "$OUT_FILE" ]; then
-  echo "Encrypted file already exists: $OUT_FILE"
-  exit 0
-fi
-
-age -R <(printf "%s" "$recipient") -o "$OUT_FILE" "$KEY_PATH"
-chmod 600 "$OUT_FILE"
-
-cat <<MSG
-Encrypted SSH key written to:
-  $OUT_FILE
-
-This file is local only. If you want to track it in dotfiles, run:
-  chezmoi add --encrypt $OUT_FILE
-MSG

package/scripts/security/backup.sh

@@ -1,17 +0,0 @@
-#!/bin/sh
-set -e
-
-BACKUP_DIR="${DOTFILES_BACKUP_DIR:-$HOME/.backups}"
-SRC_DIR="${DOTFILES_BACKUP_SRC:-$HOME}"
-STAMP=$(date +%Y%m%d-%H%M%S)
-OUT="$BACKUP_DIR/dotfiles-backup-$STAMP.tgz"
-
-mkdir -p "$BACKUP_DIR"
-
-if ! tar --exclude="$HOME/.cache" --exclude="$HOME/.local/share/Trash" -czf "$OUT" "$SRC_DIR"; then
-  echo "[ERROR] Backup failed!" >&2
-  rm -f "$OUT"
-  exit 1
-fi
-
-echo "Backup written to: $OUT"

package/scripts/security/dns-doh.sh

@@ -1,29 +0,0 @@
-#!/bin/sh
-set -e
-
-if [ "${DOTFILES_DOH:-}" != "1" ]; then
-  echo "DoH script is disabled by default."
-  echo "Re-run with DOTFILES_DOH=1 to apply."
-  exit 1
-fi
-
-case "$(uname -s)" in
-  Linux)
-    if command -v resolvectl >/dev/null; then
-      echo "Enabling DNS-over-HTTPS with systemd-resolved (Cloudflare)..."
-      sudo resolvectl dns-over-https on
-      sudo resolvectl dns 1.1.1.1 1.0.0.1
-    else
-      echo "systemd-resolved not detected."
-      exit 1
-    fi
-    ;;
-  Darwin)
-    echo "Configure DoH in your browser (system-wide DoH requires profiles)."
-    exit 0
-    ;;
-  *)
-    echo "Unsupported OS for DoH config."
-    exit 1
-    ;;
-esac

package/scripts/security/encryption-check.sh

@@ -1,39 +0,0 @@
-#!/bin/sh
-set -e
-
-case "$(uname -s)" in
-  Darwin)
-    if command -v fdesetup >/dev/null; then
-      status=$(fdesetup status || true)
-      echo "$status"
-      echo "$status" | grep -qi "FileVault is On" && exit 0
-      echo "Warning: FileVault appears to be off."
-      exit 1
-    else
-      echo "fdesetup not found."
-      exit 1
-    fi
-    ;;
-  Linux)
-    if command -v lsblk >/dev/null; then
-      lsblk_output=$(lsblk -f)
-      if command -v rg >/dev/null; then
-        if echo "$lsblk_output" | rg -i "crypto|luks" >/dev/null; then
-          echo "Encrypted block device detected (LUKS)."
-          exit 0
-        fi
-      else
-        if echo "$lsblk_output" | grep -Ei "crypto|luks" >/dev/null; then
-          echo "Encrypted block device detected (LUKS)."
-          exit 0
-        fi
-      fi
-      echo "Warning: No LUKS/crypto volume detected."
-      exit 1
-    fi
-    ;;
-  *)
-    echo "Unsupported OS for encryption check."
-    exit 1
-    ;;
-esac

package/scripts/security/enforce-policies.sh

@@ -1,339 +0,0 @@
-#!/usr/bin/env bash
-# Security Policy Enforcement Script
-# This script enforces security policies across the dotfiles repository
-
-set -euo pipefail
-
-# Script configuration
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-readonly SCRIPT_DIR
-REPO_ROOT="$(cd "${SCRIPT_DIR}/../.." && pwd)"
-readonly REPO_ROOT
-readonly POLICIES_DIR="${REPO_ROOT}/.github/security-policies"
-readonly LOG_FILE="${REPO_ROOT}/.security-audit.log"
-
-# Color codes for output (respect NO_COLOR: https://no-color.org)
-if [[ -z "${NO_COLOR:-}" ]] && [[ -t 1 ]]; then
-  readonly RED='\033[0;31m'
-  readonly GREEN='\033[0;32m'
-  readonly YELLOW='\033[1;33m'
-  readonly NC='\033[0m'
-else
-  readonly RED='' GREEN='' YELLOW='' NC=''
-fi
-
-# Logging function
-log() {
-  local level="$1"
-  shift
-  local message="$*"
-  local timestamp
-  timestamp=$(date -u '+%Y-%m-%d %H:%M:%S UTC')
-
-  echo "[${timestamp}] [${level}] ${message}" | tee -a "${LOG_FILE}"
-}
-
-# Error handling
-error_exit() {
-  log "ERROR" "$1"
-  exit 1
-}
-
-# Check if required tools are installed
-check_dependencies() {
-  log "INFO" "Checking dependencies..."
-
-  local missing_tools=()
-
-  # Required tools
-  local tools=("opa" "gitleaks" "shellcheck" "grep" "find")
-
-  for tool in "${tools[@]}"; do
-    if ! command -v "$tool" &>/dev/null; then
-      missing_tools+=("$tool")
-    fi
-  done
-
-  if [[ ${#missing_tools[@]} -gt 0 ]]; then
-    error_exit "Missing required tools: ${missing_tools[*]}"
-  fi
-
-  log "INFO" "All dependencies satisfied"
-}
-
-# Scan for hardcoded secrets
-scan_secrets() {
-  log "INFO" "Scanning for hardcoded secrets..."
-
-  local violations=0
-
-  # Run gitleaks
-  if gitleaks detect --source="${REPO_ROOT}" --config="${REPO_ROOT}/config/gitleaks.toml" --no-git >/dev/null 2>&1; then
-    log "INFO" "✅ No secrets detected by gitleaks"
-  else
-    log "WARN" "❌ Potential secrets detected by gitleaks"
-    violations=$((violations + 1))
-  fi
-
-  # Manual pattern checks
-  local secret_patterns=(
-    'password\s*=\s*["\047][^"\047]*["\047]'
-    'token\s*=\s*["\047][^"\047]*["\047]'
-    'secret\s*=\s*["\047][^"\047]*["\047]'
-    'key\s*=\s*["\047][^"\047]*["\047]'
-    'AKIA[0-9A-Z]{16}' # AWS Access Key
-    '[0-9a-f]{32,}'    # Potential hash/token
-  )
-
-  for pattern in "${secret_patterns[@]}"; do
-    if grep -r -E -i "${pattern}" "${REPO_ROOT}" \
-      --exclude-dir=".git" \
-      --exclude="*.log" \
-      --exclude="enforce-policies.sh" \
-      --exclude="environment-template.env" >/dev/null 2>&1; then
-      log "WARN" "❌ Potential hardcoded credential pattern found: ${pattern}"
-      violations=$((violations + 1))
-    fi
-  done
-
-  if [[ $violations -eq 0 ]]; then
-    log "INFO" "✅ No hardcoded secrets detected"
-  fi
-
-  return $violations
-}
-
-# Check file permissions
-check_file_permissions() {
-  log "INFO" "Checking file permissions..."
-
-  local violations=0
-
-  # Check for overly permissive files
-  while IFS= read -r -d '' file; do
-    if [[ -f "$file" ]]; then
-      local perms
-      perms=$(stat -c %a "$file" 2>/dev/null || stat -f %A "$file")
-      if [[ $perms -gt 755 ]]; then
-        log "WARN" "❌ Overly permissive file: ${file} (${perms})"
-        violations=$((violations + 1))
-      fi
-    fi
-  done < <(find "${REPO_ROOT}" -type f -not -path "*/.git/*" -print0)
-
-  # Check for executable text files
-  local text_extensions=("md" "txt" "json" "yaml" "yml" "toml")
-
-  for ext in "${text_extensions[@]}"; do
-    while IFS= read -r -d '' file; do
-      if [[ -x "$file" ]]; then
-        log "WARN" "❌ Executable text file: ${file}"
-        violations=$((violations + 1))
-      fi
-    done < <(find "${REPO_ROOT}" -name "*.${ext}" -executable -not -path "*/.git/*" -print0)
-  done
-
-  if [[ $violations -eq 0 ]]; then
-    log "INFO" "✅ File permissions are appropriate"
-  fi
-
-  return $violations
-}
-
-# Validate shell scripts
-validate_shell_scripts() {
-  log "INFO" "Validating shell scripts..."
-
-  local violations=0
-
-  while IFS= read -r -d '' script; do
-    if ! shellcheck "$script" >/dev/null 2>&1; then
-      log "WARN" "❌ ShellCheck violations in: ${script}"
-      violations=$((violations + 1))
-    fi
-  done < <(find "${REPO_ROOT}" -name "*.sh" -not -path "*/.git/*" -print0)
-
-  if [[ $violations -eq 0 ]]; then
-    log "INFO" "✅ All shell scripts pass validation"
-  fi
-
-  return $violations
-}
-
-# Check environment variable usage
-check_environment_variables() {
-  log "INFO" "Checking environment variable usage..."
-
-  local violations=0
-
-  # Look for unprotected variable assignments
-  while IFS= read -r -d '' file; do
-    # Skip binary files and specific files
-    if file "$file" | grep -q "text" && [[ ! "$file" =~ \.(log|env)$ ]]; then
-      # Check for variables that should use default patterns
-      if grep -E '^[A-Z_]+=.+$' "$file" >/dev/null 2>&1; then
-        # Check if they use proper defaulting
-        if ! grep -E '\$\{[A-Z_]+:-[^}]*\}' "$file" >/dev/null 2>&1; then
-          local suspicious_vars
-          suspicious_vars=$(grep -E '^[A-Z_]+=.+$' "$file" | head -3)
-          if [[ -n "$suspicious_vars" ]]; then
-            log "WARN" "❌ Potential hardcoded variables in ${file}: ${suspicious_vars}"
-            violations=$((violations + 1))
-          fi
-        fi
-      fi
-    fi
-  done < <(find "${REPO_ROOT}" -type f -not -path "*/.git/*" -not -path "*/.github/security-policies/*" -print0)
-
-  if [[ $violations -eq 0 ]]; then
-    log "INFO" "✅ Environment variable usage is appropriate"
-  fi
-
-  return $violations
-}
-
-# Validate OPA policies
-validate_policies() {
-  log "INFO" "Validating OPA policies..."
-
-  if [[ ! -f "${POLICIES_DIR}/security.rego" ]]; then
-    log "WARN" "❌ Security policy file not found"
-    return 1
-  fi
-
-  if opa test "${POLICIES_DIR}" >/dev/null 2>&1; then
-    log "INFO" "✅ OPA policies are valid"
-    return 0
-  else
-    log "WARN" "❌ OPA policy validation failed"
-    return 1
-  fi
-}
-
-# Check for sensitive files
-check_sensitive_files() {
-  log "INFO" "Checking for sensitive files..."
-
-  local violations=0
-  local sensitive_patterns=(
-    "*.key"
-    "*.pem"
-    "*.p12"
-    "*.pfx"
-    "*.jks"
-    "*.keystore"
-    ".env"
-    ".env.*"
-    "credentials.json"
-    "service-account.json"
-    "id_rsa"
-    "id_dsa"
-    "id_ecdsa"
-    "id_ed25519"
-  )
-
-  for pattern in "${sensitive_patterns[@]}"; do
-    while IFS= read -r -d '' file; do
-      # Skip allowed files
-      if [[ ! "$file" =~ (environment-template\.env|\.pub$) ]]; then
-        log "WARN" "❌ Sensitive file detected: ${file}"
-        violations=$((violations + 1))
-      fi
-    done < <(find "${REPO_ROOT}" -name "${pattern}" -not -path "*/.git/*" -print0)
-  done
-
-  if [[ $violations -eq 0 ]]; then
-    log "INFO" "✅ No sensitive files detected"
-  fi
-
-  return $violations
-}
-
-# Generate security report
-generate_report() {
-  local total_violations="$1"
-  local report_file="${REPO_ROOT}/security-report.md"
-
-  log "INFO" "Generating security report..."
-
-  cat >"${report_file}" <<EOF
-# Security Policy Enforcement Report
-
-**Generated:** $(date -u '+%Y-%m-%d %H:%M:%S UTC')
-**Repository:** $(basename "${REPO_ROOT}")
-**Total Violations:** ${total_violations}
-
-## Security Checks Performed
-
-- ✅ Secrets scanning (gitleaks + manual patterns)
-- ✅ File permissions validation
-- ✅ Shell script analysis (shellcheck)
-- ✅ Environment variable usage check
-- ✅ OPA policy validation
-- ✅ Sensitive files detection
-
-## Security Score
-
-$(if [[ $total_violations -eq 0 ]]; then echo "🟢 **PASSED** - No security violations detected"; else echo "🔴 **FAILED** - ${total_violations} violations detected"; fi)
-
-## Recommendations
-
-1. Review any flagged violations in the audit log
-2. Update hardcoded values to use environment variables
-3. Ensure proper file permissions (644 for files, 755 for executables)
-4. Use the provided environment template for configuration
-5. Run this script regularly as part of your development workflow
-
-## Next Steps
-
-- Fix any identified violations
-- Run \`scripts/security/enforce-policies.sh\` again to verify fixes
-- Consider setting up automated policy enforcement in CI/CD
-
----
-*This report was generated by the automated security policy enforcement system.*
-EOF
-
-  log "INFO" "Security report generated: ${report_file}"
-}
-
-# Main execution
-main() {
-  log "INFO" "Starting security policy enforcement..."
-
-  # Initialize log file
-  echo "# Security Audit Log - $(date -u '+%Y-%m-%d %H:%M:%S UTC')" >"${LOG_FILE}"
-
-  check_dependencies
-
-  local total_violations=0
-
-  # Run all checks
-  scan_secrets || total_violations=$((total_violations + $?))
-  check_file_permissions || total_violations=$((total_violations + $?))
-  validate_shell_scripts || total_violations=$((total_violations + $?))
-  check_environment_variables || total_violations=$((total_violations + $?))
-  validate_policies || total_violations=$((total_violations + 1))
-  check_sensitive_files || total_violations=$((total_violations + $?))
-
-  # Generate report
-  generate_report "$total_violations"
-
-  # Final result
-  if [[ $total_violations -eq 0 ]]; then
-    echo -e "${GREEN}✅ All security checks passed!${NC}"
-    log "INFO" "Security policy enforcement completed successfully"
-    exit 0
-  else
-    echo -e "${RED}❌ Security policy enforcement failed with ${total_violations} violations${NC}"
-    echo -e "${YELLOW}📋 Check ${LOG_FILE} for details${NC}"
-    echo -e "${YELLOW}📋 Review security-report.md for summary${NC}"
-    log "ERROR" "Security policy enforcement failed with ${total_violations} violations"
-    exit 1
-  fi
-}
-
-# Script entry point
-if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
-  main "$@"
-fi

package/scripts/security/firewall.sh

@@ -1,34 +0,0 @@
-#!/bin/sh
-set -e
-
-if [ "${DOTFILES_FIREWALL:-}" != "1" ]; then
-  echo "Firewall script is disabled by default."
-  echo "Re-run with DOTFILES_FIREWALL=1 to apply."
-  exit 1
-fi
-
-case "$(uname -s)" in
-  Darwin)
-    echo "Enabling macOS firewall..."
-    sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
-    sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setallowsigned on
-    sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setallowsignedapp on
-    sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on
-    ;;
-  Linux)
-    if command -v ufw >/dev/null; then
-      echo "Enabling UFW..."
-      sudo ufw default deny incoming
-      sudo ufw default allow outgoing
-      sudo ufw allow OpenSSH
-      sudo ufw --force enable
-    else
-      echo "ufw not installed. Install ufw and re-run."
-      exit 1
-    fi
-    ;;
-  *)
-    echo "Unsupported OS for firewall setup."
-    exit 1
-    ;;
-esac

package/scripts/security/lock-configs.sh

@@ -1,57 +0,0 @@
-#!/usr/bin/env bash
-# MIT License
-# Copyright (c) 2026 Sebastien Rousseau
-# See LICENSE file for details.
-
-# Script: lock-configs.sh
-# Description: Toggles immutability flags on critical configuration files.
-# Usage: lock-configs [lock|unlock]
-
-set -e
-
-ACTION="${1:-lock}"
-CRITICAL_FILES=(
-  "$HOME/.zshrc"
-  "$HOME/.bashrc"
-  "$HOME/.profile"
-)
-
-# Determine OS command for immutability
-if [[ "$OSTYPE" == "darwin"* ]]; then
-  LOCK_CMD="chflags uchg"
-  UNLOCK_CMD="chflags nouchg"
-  CHECK_CMD="ls -lO"
-else
-  # Linux (requires root usually, but we'll try)
-  if command -v chattr >/dev/null; then
-    LOCK_CMD="sudo chattr +i"
-    UNLOCK_CMD="sudo chattr -i"
-    CHECK_CMD="lsattr"
-  else
-    echo " 'chattr' not found. Cannot set immutability on Linux without it."
-    exit 1
-  fi
-fi
-
-if [[ "$ACTION" == "lock" ]]; then
-  echo " Locking critical configuration files..."
-  CMD="$LOCK_CMD"
-elif [[ "$ACTION" == "unlock" ]]; then
-  echo " Unlocking critical configuration files..."
-  CMD="$UNLOCK_CMD"
-else
-  echo "Usage: $0 [lock|unlock]"
-  exit 1
-fi
-
-for file in "${CRITICAL_FILES[@]}"; do
-  if [[ -f "$file" ]]; then
-    echo "Processing: $file"
-    $CMD "$file" || echo "️ Failed to modify flags for $file (permission denied?)"
-  fi
-done
-
-echo "Done. Environment state:"
-for file in "${CRITICAL_FILES[@]}"; do
-  [[ -f "$file" ]] && $CHECK_CMD "$file"
-done

package/scripts/security/lock-screen.sh

@@ -1,33 +0,0 @@
-#!/bin/sh
-set -e
-
-if [ "${DOTFILES_LOCK:-}" != "1" ]; then
-  echo "Lock screen script is disabled by default."
-  echo "Re-run with DOTFILES_LOCK=1 to apply."
-  exit 1
-fi
-
-case "$(uname -s)" in
-  Linux)
-    if command -v gsettings >/dev/null; then
-      echo "Enabling screen lock and idle timeout..."
-      gsettings set org.gnome.desktop.screensaver lock-enabled true || true
-      gsettings set org.gnome.desktop.session idle-delay 300 || true
-      gsettings set org.gnome.desktop.screensaver lock-delay 0 || true
-    else
-      echo "gsettings not found."
-      exit 1
-    fi
-    ;;
-  Darwin)
-    echo "Enabling lock on sleep and screensaver (macOS)..."
-    defaults write com.apple.screensaver askForPassword -int 1 || true
-    defaults write com.apple.screensaver askForPasswordDelay -int 0 || true
-    # 5-minute idle timeout
-    defaults -currentHost write com.apple.screensaver idleTime -int 300 || true
-    ;;
-  *)
-    echo "Unsupported OS for lock screen hardening."
-    exit 1
-    ;;
-esac