Which dotfiles managers are supported?

Four managers, each with a full comparison card: GNU Stow (symlink farm, beginner-friendly), bare-git (no extra binary, files live at real $HOME paths), chezmoi (templating + encrypted secrets via age/gpg), and Dotbot (Python bootstrap with YAML config). The cards list pros, cons, difficulty level, whether symlinks are used, and whether an external binary is required.

Is the install script idempotent and does it back up existing files?

Yes — running install.sh twice produces the same end-state. Existing files at target paths are handled per your chosen backup mode: 'bak' (default) moves them to *.bak. , 'skip' leaves them in place and skips the link, or 'overwrite' removes them. The script uses `set -euo pipefail`, creates parent directories, and uses `ln -sfn` so re-running is safe.

What's in the generated .gitignore?

A secret-safe default: SSH private keys (~/.ssh/id_*), cloud credentials (~/.aws/credentials, ~/.kube/config, ~/.config/gh/hosts.yml), .env files, GnuPG dir, shell histories, password-store, Docker registry tokens, and *.pem/*.key/*.p12 patterns — plus OS junk (.DS_Store, Thumbs.db) and editor swap files. Manager-specific notes are appended (e.g. chezmoi ignores .chezmoi.toml local config).

Which dotfiles can I track?

Twelve common configs are in the catalog: .bashrc, .zshrc, .vimrc, .config/nvim (directory), .tmux.conf, .gitconfig, .gitignore_global, .ssh/config (flagged for secret risk), .config/starship.toml, .editorconfig, .profile, and .inputrc. Each has a default repo filename and starter content. You can tick exactly the ones you want.

What extra features does this tool have versus copying someone's repo?

(1) Manager comparison cards (Stow / bare-git / chezmoi / Dotbot) with pros, cons, difficulty. (2) Catalog of 12 common dotfiles with secret-risk flags. (3) Repo tree diagram for the chosen manager. (4) Idempotent install.sh with three backup modes. (5) OS detection guards (macOS / Linux / Windows). (6) Optional brew/apt package-install stub. (7) Secret-safe .gitignore (~25 patterns). (8) 'Never commit these' checklist with severity (critical/warn). (9) Generated README with manager rationale + repo layout. (10) Dotbot YAML config generator. (11) chezmoi .chezmoi.toml.tmpl generator. (12) Config validation (e.g. flags bare-git + ssh/config as risky). (13) History (localStorage, last 20). (14) Shareable URL with full config encoded. 100% client-side — nothing uploaded, no ads.

Developer Runs in your browser

Dotfiles Manager Generator

Scaffold a dotfiles repo + idempotent install script. Pick the configs to track (.bashrc, .vimrc, .gitconfig, .tmux.conf, ssh config, …), choose a manager (GNU Stow / bare-git / chezmoi / Dotbot) with a full comparison table, and get a repo tree, README, idempotent install.sh that backs up existing files, and a secret-safe .gitignore with a 'never commit these' checklist. 100% client-side.

100% Private Works Offline Instant

Manager

Pros

+ Tiny, ubiquitous, in most package managers
+ Trivial mental model: dir per package
+ Per-package roll-back (just `stow -D pkg`)

Cons

– No templating — config is literal
– Symlink conflicts require manual resolve
– No secrets support

Repo options

Repo name

GitHub username (for README clone URL)

Backup mode

OS detection (macOS/Linux)Brew/apt package stub

Selected

Files

Directories

Secret-risk

Gitignore patterns

Repo structure

dotfiles/
├── bashrc/
│   └── bashrc
├── zshrc/
│   └── zshrc
├── vimrc/
│   └── vimrc
├── gitconfig/
│   └── gitconfig
├── tmux.conf/
│   └── tmux.conf
├── install.sh
├── .gitignore
└── README.md

install.shidempotent

#!/usr/bin/env bash
#
# dotfiles — install script (generated by UnQTools Dotfiles Manager)
# Manager: GNU Stow
# Idempotent — safe to re-run. Existing files are backed up.
set -euo pipefail

REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
TIMESTAMP="$(date +%Y%m%d-%H%M%S)"

# ── Helpers ────────────────────────────────────────────────────
backup_file() {
  local target="$1"
  if [ -e "$target" ] && [ ! -L "$target" ]; then
    mv "$target" "$target.bak.$TIMESTAMP"
    echo "  Backed up $target → $target.bak.$TIMESTAMP"
  fi
}

link() {
  local src="$1" dst="$2"
  backup_file "$dst" || return 0
  mkdir -p "$(dirname "$dst")"
  ln -sfn "$src" "$dst"
  echo "  Linked $dst → $src"
}

# ── OS detection ───────────────────────────────────────────────
OS="unknown"
case "$(uname -s)" in
  Darwin*) OS="macOS" ;;
  Linux*)  OS="Linux" ;;
  CYGWIN*|MINGW*|MSYS*) OS="Windows" ;;
esac
echo "Detected OS: $OS"

# ── Install ───────────────────────────────────────────────────
echo "Installing ${cfg.repoName} via ${getManager(cfg.manager).label}..."
echo "→ .bashrc"
stow --target="$HOME" --restow "bashrc" 2>/dev/null || echo "  (stow bashrc failed — check conflicts)"
echo "→ .zshrc"
stow --target="$HOME" --restow "zshrc" 2>/dev/null || echo "  (stow zshrc failed — check conflicts)"
echo "→ .vimrc"
stow --target="$HOME" --restow "vimrc" 2>/dev/null || echo "  (stow vimrc failed — check conflicts)"
echo "→ .gitconfig"
stow --target="$HOME" --restow "gitconfig" 2>/dev/null || echo "  (stow gitconfig failed — check conflicts)"
echo "→ .tmux.conf"
stow --target="$HOME" --restow "tmux.conf" 2>/dev/null || echo "  (stow tmux.conf failed — check conflicts)"

echo "Done. Restart your shell or run: exec $SHELL"

.gitignore (secret-safe)

# .gitignore — generated by UnQTools Dotfiles Manager
# Secret-safe by default. Review and adjust as needed.

# ── OS junk ──
.DS_Store
Thumbs.db
desktop.ini

# ── Editor / IDE ──
.vscode/
.idea/
*.swp
*.swo
*~

# ── Secrets (never commit these) ──
.ssh/id_*
.ssh/*.pem
.ssh/known_hosts
.ssh/authorized_keys
.gnupg/
.aws/credentials
.aws/config
.config/gh/hosts.yml
.netrc
.env
.env.*
*.pem
*.key
*.p12
*.pfx
.zsh_history
.bash_history
.python_history
.node_repl_history
.local/share/password-store/
.config/spotify/Users/*/user.prefs
.docker/config.json
.kube/config
.terraform.d/credentials.tfrc.json

# ── Manager-specific ──
*.bak.*

README.md

# dotfiles

> Dotfiles managed with **GNU Stow** (Symlink farm — each package dir maps to $HOME).

## Why GNU Stow?

**Pros**
- Tiny, ubiquitous, in most package managers
- Trivial mental model: dir per package
- Per-package roll-back (just `stow -D pkg`)

**Cons**
- No templating — config is literal
- Symlink conflicts require manual resolve
- No secrets support

Difficulty: beginner-friendly.

## Tracked dotfiles
- `.bashrc` — Bash config
- `.zshrc` — Zsh config
- `.vimrc` — Vim config
- `.gitconfig` — Git config
- `.tmux.conf` — tmux config

## Install on a new machine

```bash
git clone https://github.com/you/dotfiles.git
cd dotfiles
./install.sh
```

The install script is **idempotent** — running it twice produces the same
state. Existing files are backed up to `*.bak.<timestamp>`.

## Repo layout

```
dotfiles/
├── bashrc/
│   └── bashrc
├── zshrc/
│   └── zshrc
├── vimrc/
│   └── vimrc
├── gitconfig/
│   └── gitconfig
├── tmux.conf/
│   └── tmux.conf
├── install.sh
├── .gitignore
└── README.md
```

## Never commit these

See `.gitignore` — secrets are excluded by default. If you genuinely need
to track sensitive files, use [git-crypt](https://github.com/AGWA/git-crypt)
or [age](https://github.com/FiloSottile/age) (chezmoi supports age natively).

## License

MIT — see [LICENSE](./LICENSE).

Never commit these

SSH private keys (~/.ssh/id_*)

Allows anyone to impersonate you on every server the key grants access to

critical

AWS / GCP / Azure credentials (~/.aws/credentials, ~/.kube/config)

Cloud account takeover — can cost thousands in crypto mining

critical

.netrc (HTTP basic-auth credentials)

Plaintext credentials for FTP/HTTP services

critical

.env files

App secrets, DB passwords, API tokens

critical

GnuPG dir (~/.gnupg)

Private keys + keyring

critical

Shell history (.bash_history, .zsh_history)

May contain tokens typed in commands, file paths revealing structure

warn

Git credentials (~/.config/gh/hosts.yml)

GitHub OAuth tokens

critical

password-store (~/.local/share/password-store)

Encrypted password vault — still don't expose

critical

.docker/config.json

Registry auth tokens

critical

Privacy: All scaffolding runs locally. The generated .gitignore is designed to keep your secrets out of git. History is stored in localStorage on this device only.

How to use

Enter your input in the tool above.
Adjust any options to your preference.
Use the Copy or Download buttons to save the result.
Everything happens locally — your data never leaves your browser.

All tools

Dotfiles Manager Generator

Manager

Dotfiles to track

Repo options

Repo structure

install.shidempotent

.gitignore (secret-safe)

README.md

Never commit these

How to use

Manager

Dotfiles to track

Repo options

Repo structure

install.shidempotent

.gitignore (secret-safe)

README.md

Never commit these