anvil
anvil is an interactive-by-default dotfiles manager for Linux (Arch-first). It clones a Git repo, links configs, optionally installs packages, decrypts age secrets, and audits personal hardening posture.
Why anvil
Section titled “Why anvil”| Need | How anvil helps |
|---|---|
| New machine setup | anvil init full-clones, scaffolds if needed, shows a plan, then applies |
| Day-to-day sync | anvil sync pulls and re-applies |
| Adopt existing files | anvil add ~/.zshrc journals, copies into the repo, links back |
| Preview safely | anvil apply --dry-run prints a plan; nothing is written |
| Recover mistakes | Durable backup journals; anvil undo, undo --list, undo --id |
| Arch packages | Official repos via pacman; AUR via a machine-local helper |
| Secrets | decrypt = "age" on link entries |
| Hardening | sysctl / sshd / ufw / home checks via doctor and apply --harden |
Unlike Stow (silent) or pure git wrappers, anvil is guided in a TTY and scriptable with -y, --dry-run and --force.
Production readiness
Section titled “Production readiness”Honest checklist for 0.1:
| Area | Ready? | Notes |
|---|---|---|
| Core link/apply/sync/init | Yes | Integration-tested dry-run and symlink apply |
| Manifest schema stability | No (pre-1.0) | May gain fields; unknown keys already rejected |
| Multi-distro packages | No | Arch pacman/AUR only |
| macOS / Windows | Partial | Unix symlinks; packages/harden are Linux-oriented |
| Prebuilt binaries / install.sh | No | Source install only |
| Shell completions | No | Planned |
Secrets without age CLI |
No | Shells out to age |
| Concurrent apply / multi-user | No | Single-user personal tool |
| Formal security audit | No | Review hooks and --force before untrusted repos |
Do not treat it as production-stable for untrusted third-party dots repos without reading hooks and package lists first.