Workflows

Day-to-day

anvil sync                 # pull + apply
anvil status
anvil doctor

Adopt a new config

anvil add ~/.config/kitty
cd ~/.dotfiles
git add -A && git commit -m "add kitty"

add refuses a path that is already a symlink into this repo. The destination is journaled before the move, so anvil undo can restore it if linking fails.

Undo a bad apply

anvil undo --list          # id, status, entry count
anvil undo                 # latest active journal (confirm)
anvil undo --id <id>       # a specific journal

Secrets with age

# encrypt into the repo (example)
age -r <recipient> -o secrets/npmrc.age ~/.npmrc

# anvil.toml
# { src = "secrets/npmrc.age", dest = "~/.npmrc", mode = "600", decrypt = "age" }

# ~/.config/anvil/config.toml
# age_identity = "~/.config/age/key.txt"

anvil apply -y

Requires the age CLI on PATH.

Packages (Arch)

packages.pacman always uses pacman. packages.aur uses a machine-local helper that is never stored in anvil.toml.

Helper	How it is chosen	Install argv
auto (default)	First of paru, yay on PATH. Never auto-picks anzen.	paru/yay -S --needed
paru / yay	CLI --aur-helper or aur_helper in local config	-S --needed (plus --noconfirm with -y)
anzen	Only when you choose it (GPL-3; anvil execs the binary, never links it)	anzen install (plus --noconfirm with -y). Never --skipreview / --ask; review stays interactive.

[profiles.base]
packages.pacman = ["ufw", "fail2ban", "age"]
packages.aur = ["some-aur-package"]

~/.config/anvil/config.toml

# aur_helper = "paru"

anvil apply --packages -y
anvil apply --packages --aur-helper anzen   # review cannot be skipped

Hardening

anvil doctor
anvil apply --harden --dry-run
anvil apply --harden -y          # check; enforce only if mode = "enforce"