@sebastienrousseau/dotfiles 0.2.499 → 0.2.501

package/scripts/dot/commands/restore.sh

@@ -0,0 +1,231 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# dot restore - Restore dotfiles from backup or previous state
+# Usage: dot restore [--list|-l|--latest|-L|<backup-id>]
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../lib/utils.sh
+source "$SCRIPT_DIR/../lib/utils.sh"
+# shellcheck source=../lib/log.sh
+source "$SCRIPT_DIR/../lib/log.sh"
+
+DOTFILES_DIR="${DOTFILES_DIR:-$HOME/.dotfiles}"
+BACKUP_DIR="${XDG_DATA_HOME:-$HOME/.local/share}/dotfiles/backups"
+CHEZMOI_SOURCE="${HOME}/.local/share/chezmoi"
+
+ui_init
+
+usage() {
+  echo "Usage: dot restore [OPTIONS]"
+  echo ""
+  echo "Options:"
+  echo "  --list, -l       List available backups"
+  echo "  --latest, -L     Restore from latest backup"
+  echo "  --git, -g <ref>  Restore from git ref (commit, tag, branch)"
+  echo "  --diff, -d <ref> Show diff between current and ref"
+  echo "  --dry-run, -n    Show what would be restored"
+  echo "  -h, --help       Show this help"
+  echo ""
+  echo "Examples:"
+  echo "  dot restore --list"
+  echo "  dot restore --latest"
+  echo "  dot restore --git HEAD~1"
+  echo "  dot restore --git v0.2.470"
+}
+
+list_backups() {
+  if [[ ! -d "$BACKUP_DIR" ]]; then
+    log_warn "No backups found at $BACKUP_DIR"
+    return 1
+  fi
+
+  ui_header "Available Backups"
+  echo "─────────────────────────────────────────"
+
+  while IFS= read -r backup; do
+    echo "  $backup"
+  done < <(list_backup_names)
+
+  echo ""
+  echo ""
+  ui_header "Git History (last 10)"
+  echo "─────────────────────────────────────────"
+
+  if [[ -d "$DOTFILES_DIR/.git" ]]; then
+    git -C "$DOTFILES_DIR" log --oneline -10
+  elif [[ -d "$CHEZMOI_SOURCE/.git" ]]; then
+    git -C "$CHEZMOI_SOURCE" log --oneline -10
+  fi
+}
+
+restore_from_git() {
+  local ref="$1"
+  local dry_run="${2:-false}"
+  local source_dir
+
+  if [[ -d "$DOTFILES_DIR/.git" ]]; then
+    source_dir="$DOTFILES_DIR"
+  elif [[ -d "$CHEZMOI_SOURCE/.git" ]]; then
+    source_dir="$CHEZMOI_SOURCE"
+  else
+    log_error "No git repository found"
+    return 1
+  fi
+
+  log_info "Restoring from git ref: $ref"
+
+  if $dry_run; then
+    log_info "Dry run - showing changes:"
+    git -C "$source_dir" diff "$ref" --stat
+    return 0
+  fi
+
+  # Create backup first
+  create_backup
+
+  # Restore
+  git -C "$source_dir" checkout "$ref" -- .
+  log_success "Restored from $ref"
+
+  # Re-apply chezmoi
+  if has_command chezmoi; then
+    log_info "Re-applying chezmoi..."
+    chezmoi apply
+  fi
+}
+
+show_diff() {
+  local ref="$1"
+  local source_dir
+
+  if [[ -d "$DOTFILES_DIR/.git" ]]; then
+    source_dir="$DOTFILES_DIR"
+  elif [[ -d "$CHEZMOI_SOURCE/.git" ]]; then
+    source_dir="$CHEZMOI_SOURCE"
+  else
+    log_error "No git repository found"
+    return 1
+  fi
+
+  git -C "$source_dir" diff "$ref"
+}
+
+create_backup() {
+  local backup_name
+  backup_name="backup-$(date +%Y%m%d_%H%M%S)"
+  local backup_path="$BACKUP_DIR/$backup_name"
+  local rel_path
+
+  mkdir -p "$backup_path"
+
+  log_info "Creating backup: $backup_name"
+
+  # Backup key config files
+  local files_to_backup=(
+    "$HOME/.zshrc"
+    "$HOME/.config/zsh"
+    "$HOME/.config/nvim"
+    "$HOME/.config/git"
+    "$HOME/.gitconfig"
+  )
+
+  for f in "${files_to_backup[@]}"; do
+    if [[ -e "$f" ]]; then
+      rel_path="${f#"$HOME"/}"
+      mkdir -p "$backup_path/$(dirname "$rel_path")"
+      cp -r "$f" "$backup_path/$rel_path" 2>/dev/null || true
+    fi
+  done
+
+  log_success "Backup created at $backup_path"
+}
+
+restore_latest() {
+  if [[ ! -d "$BACKUP_DIR" ]]; then
+    log_error "No backups found"
+    return 1
+  fi
+
+  local latest
+  latest=$(list_backup_names | head -1)
+
+  if [[ -z "$latest" ]]; then
+    log_error "No backups found"
+    return 1
+  fi
+
+  log_info "Restoring from: $latest"
+
+  local backup_path="$BACKUP_DIR/$latest"
+  local item rel_path target
+  while IFS= read -r -d '' item; do
+    rel_path="${item#"$backup_path"/}"
+    target="$HOME/$rel_path"
+    mkdir -p "$(dirname "$target")"
+    cp -r "$item" "$target"
+    log_success "Restored: $rel_path"
+  done < <(find "$backup_path" -mindepth 1 -maxdepth 1 -print0)
+}
+
+list_backup_names() {
+  local backup_path
+
+  shopt -s nullglob
+  for backup_path in "$BACKUP_DIR"/backup-*; do
+    [[ -d "$backup_path" ]] || continue
+    printf '%s\n' "${backup_path##*/}"
+  done | while IFS= read -r backup_name; do
+    printf '%s\t%s\n' "$(portable_mtime "$BACKUP_DIR/$backup_name")" "$backup_name"
+  done | sort -rn | cut -f2-
+  shopt -u nullglob
+}
+
+portable_mtime() {
+  if stat -c %Y "$1" >/dev/null 2>&1; then
+    stat -c %Y "$1"
+  else
+    stat -f %m "$1"
+  fi
+}
+
+# Parse arguments
+DRY_RUN=false
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    -l | --list)
+      list_backups
+      exit 0
+      ;;
+    --latest | -L)
+      restore_latest
+      exit 0
+      ;;
+    --git | -g)
+      restore_from_git "$2" "$DRY_RUN"
+      exit 0
+      ;;
+    --diff | -d)
+      show_diff "$2"
+      exit 0
+      ;;
+    --dry-run | -n)
+      DRY_RUN=true
+      shift
+      ;;
+    -h | --help)
+      usage
+      exit 0
+      ;;
+    *)
+      log_error "Unknown option: $1"
+      usage
+      exit 1
+      ;;
+  esac
+done
+
+# Default: show usage
+usage

package/scripts/dot/commands/secrets.sh

@@ -0,0 +1,223 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# Dotfiles CLI - Secrets/Env Commands
+# secrets-init, secrets, secrets-create, ssh-key, env load
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../lib/utils.sh
+source "$SCRIPT_DIR/../lib/utils.sh"
+# shellcheck source=../../lib/secrets_provider.sh
+source "$SCRIPT_DIR/../../lib/secrets_provider.sh"
+
+dot_ui_command_banner "Secrets" "${1:-}"
+
+dot_data_file() {
+  local src_dir
+  src_dir="$(require_source_dir)"
+  printf "%s\n" "$src_dir/.chezmoidata.toml"
+}
+
+dot_load_secrets_policy_env() {
+  local data_file provider auto_load
+  data_file="$(dot_data_file)"
+  [[ -f "$data_file" ]] || return 0
+
+  provider="$(awk -F'=' '
+    /^\[secrets\.policy\]/ {in_policy=1; next}
+    /^\[/ {if (in_policy) exit}
+    in_policy && $1 ~ /provider/ {
+      gsub(/["[:space:]]/, "", $2); print $2; exit
+    }
+  ' "$data_file")"
+  auto_load="$(awk -F'=' '
+    /^\[secrets\.policy\]/ {in_policy=1; next}
+    /^\[/ {if (in_policy) exit}
+    in_policy && $1 ~ /auto_load/ {
+      gsub(/[[:space:]]/, "", $2); print $2; exit
+    }
+  ' "$data_file")"
+
+  if [[ -n "$provider" && -z "${DOTFILES_SECRETS_PROVIDER:-}" ]]; then
+    export DOTFILES_SECRETS_PROVIDER="$provider"
+  fi
+  if [[ -n "$auto_load" && -z "${DOTFILES_SECRETS_AUTO_LOAD:-}" ]]; then
+    if [[ "$auto_load" == "true" ]]; then
+      export DOTFILES_SECRETS_AUTO_LOAD=1
+    else
+      export DOTFILES_SECRETS_AUTO_LOAD=0
+    fi
+  fi
+}
+
+dot_load_secrets_policy_env
+
+cmd_secrets_init() {
+  local src_dir
+  src_dir="$(resolve_source_dir)"
+
+  if [ -n "$src_dir" ] && [ -f "$src_dir/scripts/secrets/age-init.sh" ]; then
+    exec bash "$src_dir/scripts/secrets/age-init.sh" "$@"
+  fi
+
+  local secrets_dir="$HOME/.config/chezmoi"
+  local key_file="$secrets_dir/key.txt"
+
+  mkdir -p "$secrets_dir"
+
+  if [ -f "$key_file" ]; then
+    ui_info "Age key already exists: $key_file"
+    exit 0
+  fi
+
+  if ! has_command age-keygen; then
+    die "age-keygen not found. Install 'age' first."
+  fi
+
+  age-keygen -o "$key_file"
+  chmod 600 "$key_file"
+  ui_ok "Age key created" "$key_file"
+  ui_header "Public key"
+  age-keygen -y "$key_file"
+}
+
+cmd_secrets_edit() {
+  local secrets_dir="$HOME/.config/chezmoi"
+  local key_file="$secrets_dir/key.txt"
+
+  if [ ! -f "$key_file" ]; then
+    die "No age key found. Run: dot secrets-init"
+  fi
+
+  exec chezmoi edit --apply "$HOME/.config/chezmoi/encrypted_secrets.age"
+}
+
+cmd_secrets_create() {
+  run_script "scripts/secrets/create-secrets-file.sh" "Secrets creation script" "$@"
+}
+
+cmd_ssh_key() {
+  run_script "scripts/secrets/encrypt-ssh-key.sh" "SSH key encryption script" "$@"
+}
+
+cmd_ssh_cert() {
+  run_script "scripts/security/ssh-cert.sh" "SSH cert script" "$@"
+}
+
+cmd_secrets_provider() {
+  local provider
+  provider="$(dot_secrets_provider)"
+  ui_info "Provider" "$provider"
+}
+
+cmd_secrets_set() {
+  local key="${1:-}" value="${2:-}"
+  [[ -n "$key" ]] || die "Usage: dot secrets set <KEY> [VALUE]"
+
+  if [[ -z "$value" ]]; then
+    read -r -s -p "Value for $key: " value
+    echo ""
+  fi
+  [[ -n "$value" ]] || die "Empty value refused for key: $key"
+
+  dot_secrets_set "$key" "$value" || die "Failed to store key: $key"
+  ui_ok "Stored" "$key"
+}
+
+cmd_secrets_get() {
+  local key="${1:-}" raw="${2:-}"
+  [[ -n "$key" ]] || die "Usage: dot secrets get <KEY> [--raw]"
+  local value
+  value="$(dot_secrets_get "$key" || true)"
+  [[ -n "$value" ]] || die "Secret not found: $key"
+  if [[ "$raw" == "--raw" ]]; then
+    printf "%s\n" "$value"
+  else
+    ui_ok "$key" "***"
+  fi
+}
+
+cmd_secrets_list() {
+  local any=0
+  while IFS= read -r key; do
+    any=1
+    printf "%s\n" "$key"
+  done < <(dot_secrets_index_list)
+  if [[ "$any" -eq 0 ]]; then
+    ui_warn "No secrets indexed" "use: dot secrets set <KEY> <VALUE>"
+  fi
+}
+
+cmd_env_load() {
+  local bucket="${1:-ai}" data_file key value count=0
+  data_file="$(dot_data_file)"
+  [[ -f "$data_file" ]] || die "Missing data file: $data_file"
+
+  while IFS= read -r key; do
+    value="$(dot_secrets_get "$key" || true)"
+    if [[ -n "$value" ]]; then
+      # shell-safe export lines intended for: eval "$(dot env load <bucket>)"
+      printf "export %s=%q\n" "$key" "$value"
+      count=$((count + 1))
+    fi
+  done < <(dot_secrets_bucket_keys "$data_file" "$bucket")
+
+  if [[ "$count" -eq 0 ]]; then
+    die "No secrets loaded for bucket: $bucket"
+  fi
+}
+
+cmd_secrets_load() {
+  cmd_env_load "${1:-ai}"
+}
+
+# Dispatch
+top="${1:-}"
+case "$top" in
+  secrets-init)
+    shift
+    cmd_secrets_init "$@"
+    ;;
+  secrets)
+    shift || true
+    sub="${1:-edit}"
+    if [[ $# -gt 0 ]]; then shift; fi
+    case "$sub" in
+      edit) cmd_secrets_edit "$@" ;;
+      set) cmd_secrets_set "$@" ;;
+      get) cmd_secrets_get "$@" ;;
+      list) cmd_secrets_list "$@" ;;
+      load) cmd_secrets_load "$@" ;;
+      provider) cmd_secrets_provider "$@" ;;
+      *)
+        die "Usage: dot secrets [edit|set|get|list|load|provider]"
+        ;;
+    esac
+    ;;
+  secrets-create)
+    shift
+    cmd_secrets_create "$@"
+    ;;
+  ssh-key)
+    shift
+    cmd_ssh_key "$@"
+    ;;
+  ssh-cert)
+    shift
+    cmd_ssh_cert "$@"
+    ;;
+  env)
+    shift || true
+    sub="${1:-load}"
+    if [[ $# -gt 0 ]]; then shift; fi
+    case "$sub" in
+      load) cmd_env_load "$@" ;;
+      *) die "Usage: dot env load <bucket>" ;;
+    esac
+    ;;
+  *)
+    echo "Unknown secrets command: ${1:-}" >&2
+    exit 1
+    ;;
+esac

package/scripts/dot/commands/security.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# Dotfiles CLI - Security Commands
+# backup, encrypt-check, firewall, telemetry, dns-doh, lock-screen, usb-safety
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../lib/utils.sh
+source "$SCRIPT_DIR/../lib/utils.sh"
+
+dot_ui_command_banner "Security" "${1:-}"
+
+cmd_backup() {
+  run_script "scripts/security/backup.sh" "Backup script" "$@"
+}
+
+cmd_encrypt_check() {
+  run_script "scripts/security/encryption-check.sh" "Encryption check script" "$@"
+}
+
+cmd_firewall() {
+  run_script "scripts/security/firewall.sh" "Firewall script" "$@"
+}
+
+cmd_telemetry() {
+  run_script "scripts/security/telemetry-kill.sh" "Telemetry script" "$@"
+}
+
+cmd_dns_doh() {
+  run_script "scripts/security/dns-doh.sh" "DNS DoH script" "$@"
+}
+
+cmd_lock_screen() {
+  run_script "scripts/security/lock-screen.sh" "Lock screen script" "$@"
+}
+
+cmd_usb_safety() {
+  run_script "scripts/security/usb-safety.sh" "USB safety script" "$@"
+}
+
+# Dispatch
+case "${1:-}" in
+  backup)
+    shift
+    cmd_backup "$@"
+    ;;
+  encrypt-check)
+    shift
+    cmd_encrypt_check "$@"
+    ;;
+  firewall)
+    shift
+    cmd_firewall "$@"
+    ;;
+  telemetry)
+    shift
+    cmd_telemetry "$@"
+    ;;
+  dns-doh)
+    shift
+    cmd_dns_doh "$@"
+    ;;
+  lock-screen)
+    shift
+    cmd_lock_screen "$@"
+    ;;
+  usb-safety)
+    shift
+    cmd_usb_safety "$@"
+    ;;
+  *)
+    echo "Unknown security command: ${1:-}" >&2
+    exit 1
+    ;;
+esac