yadm/yadm.1

." vim: set spell so=8:
.TH yadm 1 "25 October 2017" "1.12.0"
.SH NAME
yadm \- Yet Another Dotfiles Manager
.SH SYNOPSIS
.B yadm
.I command
.RI [ options ]

.B yadm
.I git-command-or-alias
.RI [ options ]

.B yadm
init
.RB [ -f ]
.RB [ -w
.IR directory ]

.B yadm
.RI clone " url
.RB [ -f ]
.RB [ -w
.IR directory ]
.RB [ --bootstrap ]
.RB [ --no-bootstrap ]

.B yadm
.RI config " name
.RI [ value ]

.B yadm
config
.RB [ -e ]

.B yadm
list
.RB [ -a ]

.BR yadm " bootstrap

.BR yadm " encrypt

.BR yadm " enter

.BR yadm " decrypt
.RB [ -l ]

.BR yadm " alt

.BR yadm " perms

.BR yadm " introspect
.I category
.SH DESCRIPTION
.B yadm
is a tool for managing a collection of files across multiple computers,
using a shared Git repository.
In addition,
.B yadm
provides a feature to select alternate versions of files
based on the operating system or host name.
Lastly,
.B yadm
supplies the ability to manage a subset of secure files, which are
encrypted before they are included in the repository.
.SH COMMANDS
.TP
.IR git-command " or " git-alias
Any command not internally handled by
.B yadm
is passed through to
.BR git (1).
Git commands or aliases are invoked with the
.B yadm
managed repository.
The working directory for Git commands will be the configured
.IR work-tree " (usually
.IR $HOME ).

Dotfiles are managed by using standard
.B git
commands;
.IR add ,
.IR commit ,
.IR push ,
.IR pull ,
etc.

.RI The " config
command is not passed directly through.
Instead use the
.I gitconfig
command (see below).
.TP
.B alt
Create symbolic links and process Jinja templates for any managed files
matching the naming rules described in the ALTERNATES and JINJA sections. It is
usually unnecessary to run this command, as
.B yadm
automatically processes alternates by default.
This automatic behavior can be disabled by setting the configuration
.I yadm.auto-alt
to "false".
.TP
.B bootstrap
Execute
.I $HOME/.yadm/bootstrap
if it exists.
.TP
.BI clone " url
Clone a remote repository for tracking dotfiles.
After the contents of the remote repository have been fetched, a "merge" of
.I origin/master
is attempted.
If there are conflicting files already present in the
.IR work-tree ,
this merge will fail and instead a "reset" of
.I origin/master
will be done, followed by a "stash". This "stash" operation will preserve the
original data.

You can review the stashed conflicts by running the command

.RS
.RS
yadm stash show -p
.RE

from within your
.I $HOME
directory. If you want to restore the stashed data, you can run

.RS
yadm stash apply
.RE
or
.RS
yadm stash pop
.RE

The repository is stored in
.IR $HOME/.yadm/repo.git .
By default,
.I $HOME
will be used as the
.IR work-tree ,
but this can be overridden with the
.BR -w " option.
.B yadm
can be forced to overwrite an existing repository by providing the
.BR -f " option.
By default
.B yadm
will ask the user if the bootstrap program should be run (if it exists). The
options
.BR --bootstrap " or " --no-bootstrap
will either force the bootstrap to be run, or prevent it from being run,
without prompting the user.
.RE
.TP
.B config
This command manages configurations for
.BR yadm .
This command works exactly they way
.BR git-config (1)
does.
See the CONFIGURATION section for more details.
.TP
.B decrypt
Decrypt all files stored in
.IR $HOME/.yadm/files.gpg .
Files decrypted will be relative to the configured
.IR work-tree " (usually
.IR $HOME ).
Using the
.B -l
option will list the files stored without extracting them.
.TP
.B encrypt
Encrypt all files matching the patterns found in
.IR $HOME/.yadm/encrypt .
See the ENCRYPTION section for more details.
.TP
.B enter
Run a sub-shell with all Git variables set. Exit the sub-shell the same way you
leave your normal shell (usually with the "exit" command). This sub-shell can
be used to easily interact with your
.B yadm
repository using "git" commands. This could be useful if you are using a tool
which uses Git directly. For example, Emacs Tramp and Magit can manage files by
using this configuration:
.RS
    (add-to-list 'tramp-methods
         '("yadm"
           (tramp-login-program "yadm")
           (tramp-login-args (("enter")))
           (tramp-remote-shell "/bin/sh")
           (tramp-remote-shell-args ("-c"))))
.RE
.TP
.B gitconfig
Pass options to the
.B git config
command. Since
.B yadm
already uses the
.I config
command to manage its own configurations,
this command is provided as a way to change configurations of the repository managed by
.BR yadm .
One useful case might be to configure the repository so untracked files are shown in status commands.
.B yadm
initially configures its repository so that untracked files are not shown.
If you wish use the default Git behavior (to show untracked files and directories), you can remove this configuration.

.RS
.RS
yadm gitconfig --unset status.showUntrackedFiles
.RE
.RE
.TP
.B help
Print a summary of
.BR yadm " commands.
.TP
.B init
Initialize a new, empty repository for tracking dotfiles.
The repository is stored in
.IR $HOME/.yadm/repo.git .
By default,
.I $HOME
will be used as the
.IR work-tree ,
but this can be overridden with the
.BR -w " option.
.B yadm
can be forced to overwrite an existing repository by providing the
.BR -f " option.
.TP
.B list
Print a list of files managed by
.BR yadm .
.RB The " -a
option will cause all managed files to be listed.
Otherwise, the list will only include files from the current directory or below.
.TP
.BI introspect " category
Report internal
.B yadm
data. Supported categories are
.IR commands ,
.IR configs ,
.IR repo,
and
.IR switches .
The purpose of introspection is to support command line completion.
.TP
.B perms
Update permissions as described in the PERMISSIONS section.
It is usually unnecessary to run this command, as
.B yadm
automatically processes permissions by default.
This automatic behavior can be disabled by setting the configuration
.I yadm.auto-perms
to "false".
.TP
.B version
Print the version of
.BR yadm .
.SH OPTIONS

.B yadm
supports a set of universal options that alter the paths it uses.
The default paths are documented in the FILES section.
Any path specified by these options must be fully qualified.
If you always want to override one or more of these paths, it may be useful to create an alias for the
.B yadm
command.
For example, the following alias could be used to override the repository directory.

.RS
alias yadm='yadm --yadm-repo /alternate/path/to/repo'
.RE

The following is the full list of universal options.
Each option should be followed by a fully qualified path.
.TP
.B -Y,--yadm-dir
Override the
.B yadm
directory.
.B yadm
stores its data relative to this directory.
.TP
.B --yadm-repo
Override the location of the
.B yadm
repository.
.TP
.B --yadm-config
Override the location of the
.B yadm
configuration file.
.TP
.B --yadm-encrypt
Override the location of the
.B yadm
encryption configuration.
.TP
.B --yadm-archive
Override the location of the
.B yadm
encrypted files archive.
.TP
.B --yadm-bootstrap
Override the location of the
.B yadm
bootstrap program.
.SH CONFIGURATION
.B yadm
uses a configuration file named
.IR $HOME/.yadm/config .
This file uses the same format as
.BR git-config (1).
Also, you can control the contents of the configuration file
via the
.B yadm config
command (which works exactly like
.BR git-config ).
For example, to disable alternates you can run the command:

.RS
yadm config yadm.auto-alt false
.RE

The following is the full list of supported configurations:
.TP
.B yadm.auto-alt
Disable the automatic linking described in the section ALTERNATES.
If disabled, you may still run
.B yadm alt
manually to create the alternate links.
This feature is enabled by default.
.TP
.B yadm.auto-perms
Disable the automatic permission changes described in the section PERMISSIONS.
If disabled, you may still run
.B yadm perms
manually to update permissions.
This feature is enabled by default.
.TP
.B yadm.auto-private-dirs
Disable the automatic creating of private directories described in the section PERMISSIONS.
.TP
.B yadm.ssh-perms
Disable the permission changes to
.IR $HOME/.ssh/* .
This feature is enabled by default.
.TP
.B yadm.gpg-perms
Disable the permission changes to
.IR $HOME/.gnupg/* .
This feature is enabled by default.
.TP
.B yadm.gpg-recipient
Asymmetrically encrypt files with a gpg public/private key pair.
Provide a "key ID" to specify which public key to encrypt with.
The key must exist in your public keyrings.
If left blank or not provided, symmetric encryption is used instead.
If set to "ASK", gpg will interactively ask for recipients.
See the ENCRYPTION section for more details.
This feature is disabled by default.
.TP
.B yadm.gpg-program
Specify an alternate program to use instead of "gpg".
By default, the first "gpg" found in $PATH is used.
.TP
.B yadm.git-program
Specify an alternate program to use instead of "git".
By default, the first "git" found in $PATH is used.
.TP
.B yadm.cygwin-copy
If set to "true", for Cygwin hosts, alternate files will be copies instead of
symbolic links. This might be desirable, because non-Cygwin software may not
properly interpret Cygwin symlinks.

.RE
These last four "local" configurations are not stored in the
.IR $HOME/.yadm/config,
they are stored in the local repository.

.TP
.B local.class
Specify a CLASS for the purpose of symlinking alternate files.
By default, no CLASS will be matched.
.TP
.B local.os
Override the OS for the purpose of symlinking alternate files.
.TP
.B local.hostname
Override the HOSTNAME for the purpose of symlinking alternate files.
.TP
.B local.user
Override the USER for the purpose of symlinking alternate files.
.SH ALTERNATES
When managing a set of files across different systems, it can be useful to have
an automated way of choosing an alternate version of a file for a different
operating system, host, or user.
.B yadm
implements a feature which will automatically create a symbolic link to
the appropriate version of a file, as long as you follow a specific naming
convention.
.B yadm
can detect files with names ending in any of the following:

  ##
  ##CLASS
  ##CLASS.OS
  ##CLASS.OS.HOSTNAME
  ##CLASS.OS.HOSTNAME.USER
  ##OS
  ##OS.HOSTNAME
  ##OS.HOSTNAME.USER

If there are any files managed by
.BR yadm \'s
repository,
or listed in
.IR $HOME/.yadm/encrypt ,
which match this naming convention,
symbolic links will be created for the most appropriate version.
This may best be demonstrated by example. Assume the following files are managed by
.BR yadm \'s
repository:

  - $HOME/path/example.txt##
  - $HOME/path/example.txt##Work
  - $HOME/path/example.txt##Darwin
  - $HOME/path/example.txt##Darwin.host1
  - $HOME/path/example.txt##Darwin.host2
  - $HOME/path/example.txt##Linux
  - $HOME/path/example.txt##Linux.host1
  - $HOME/path/example.txt##Linux.host2

If running on a Macbook named "host2",
.B yadm
will create a symbolic link which looks like this:

.IR $HOME/path/example.txt " -> " $HOME/path/example.txt##Darwin.host2

However, on another Mackbook named "host3",
.B yadm
will create a symbolic link which looks like this:

.IR $HOME/path/example.txt " -> " $HOME/path/example.txt##Darwin

Since the hostname doesn't match any of the managed files, the more generic version is chosen.

If running on a Linux server named "host4", the link will be:

.IR $HOME/path/example.txt " -> " $HOME/path/example.txt##Linux

If running on a Solaris server, the link use the default "##" version:

.IR $HOME/path/example.txt " -> " $HOME/path/example.txt##

If running on a system, with CLASS set to "Work", the link will be:

.IR $HOME/path/example.txt " -> " $HOME/path/example.txt##WORK

If no "##" version exists and no files match the current CLASS/OS/HOSTNAME/USER, then no link will be created.

Links are also created for directories named this way, as long as they have at least one
.B yadm
managed file within them.

CLASS must be manually set using
.BR yadm\ config\ local.class\ <class> .
OS is determined by running
.BR uname\ -s ,
HOSTNAME by running
.BR hostname ,
and USER by running
.BR id\ -u\ -n .
.B yadm
will automatically create these links by default. This can be disabled using the
.I yadm.auto-alt
configuration.
Even if disabled, links can be manually created by running
.BR yadm\ alt .

It is possible to use "%" as a "wildcard" in place of CLASS, OS, HOSTNAME, or
USER. For example, The following file could be linked for any host when the
user is "harvey".

.IR $HOME/path/example.txt##%.%.harvey

CLASS is a special value which is stored locally on each host (inside the local
repository). To use alternate symlinks using CLASS, you must set the value of
class using the configuration
.BR local.class .
This is set like any other
.B yadm
configuration with the
.B yadm config
command. The following sets the CLASS to be "Work".

  yadm config local.class Work

Similarly, the values of OS, HOSTNAME, and USER can be manually overridden
using the configuration options
.BR local.os ,
.BR local.hostname ,
and
.BR local.user .

.SH JINJA
If the
.B envtpl
command is available,
.B Jinja
templates will also be processed to create or overwrite real files.
.B yadm
will treat files ending in

  ##yadm.j2

as Jinja templates. During processing, the following variables are set
according to the rules explained in the ALTERNATES section:

  YADM_CLASS
  YADM_OS
  YADM_HOSTNAME
  YADM_USER

In addition YADM_DISTRO is exposed as the value of
.I lsb_release -si
if
.B lsb_release
is locally available.

For example, a file named
.I whatever##yadm.j2
with the following content

  {% if YADM_USER == 'harvey' -%}
  config={{YADM_CLASS}}-{{ YADM_OS }}
  {% else -%}
  config=dev-whatever
  {% endif -%}

would output a file named
.I whatever
with the following content if the user is "harvey":

  config=work-Linux

and the following otherwise:

  config=dev-whatever

See http://jinja.pocoo.org/ for an overview of
.BR Jinja .

.SH ENCRYPTION
It can be useful to manage confidential files, like SSH or GPG keys, across
multiple systems. However, doing so would put plain text data into a Git
repository, which often resides on a public system.
.B yadm
implements a feature which can make it easy to encrypt and decrypt a set of
files so the encrypted version can be maintained in the Git repository.
This feature will only work if the
.BR gpg (1)
command is available.

To use this feature, a list of patterns must be created and saved as
.IR $HOME/.yadm/encrypt .
This list of patterns should be relative to the configured
.IR work-tree " (usually
.IR $HOME ).
For example:

.RS
    .ssh/*.key
    .gnupg/*.gpg
.RE

Standard filename expansions (*, ?, [) are supported. Other shell expansions
like brace and tilde are not supported. Spaces in paths are supported, and
should not be quoted. If a directory is specified, its contents will be
included, but not recursively. Paths beginning with a "!" will be excluded.

The
.B yadm encrypt
command will find all files matching the patterns, and prompt for a password. Once a
password has confirmed, the matching files will be encrypted and saved as
.IR $HOME/.yadm/files.gpg .
The patterns and files.gpg should be added to the
.B yadm
repository so they are available across multiple systems.

To decrypt these files later, or on another system run
.BR yadm\ decrypt
and provide the correct password.
After files are decrypted, permissions are automatically updated as described
in the PERMISSIONS section.

Symmetric encryption is used by default, but asymmetric encryption may be
enabled using the
.I yadm.gpg-recipient
configuration.

.BR NOTE :
It is recommended that you use a private repository when keeping confidential
files, even though they are encrypted.
.SH PERMISSIONS
When files are checked out of a Git repository, their initial permissions are
dependent upon the user's umask. Because of this,
.B yadm
will automatically update the permissions of some file paths. The "group" and
"others" permissions will be removed from the following files:

.RI - " $HOME/.yadm/files.gpg

- All files matching patterns in
.I $HOME/.yadm/encrypt

- The SSH directory and files,
.I .ssh/*

- The GPG directory and files,
.I .gnupg/*

.B yadm
will automatically update permissions by default. This can be disabled using the
.I yadm.auto-perms
configuration. Even if disabled, permissions can be manually updated by running
.BR yadm\ perms .
The
.I .ssh
directory processing can be disabled using the
.I yadm.ssh-perms
configuration. The
.I .gnupg
directory processing can be disabled using the
.I yadm.gpg-perms
configuration.

When cloning a repo which includes data in a
.IR .ssh " or " .gnupg
directory, if those directories do not exist at the time of cloning,
.B yadm
will create the directories with mask 0700 prior to merging the fetched data
into the work-tree.

When running a Git command and
.IR .ssh " or " .gnupg
directories do not exist,
.B yadm
will create those directories with mask 0700 prior to running the Git command.
This can be disabled using the
.I yadm.auto-private-dirs
configuration.
.SH HOOKS
For every command
.B yadm
supports, a program can be provided to run before or after that command. These
are referred to as "hooks".
.B yadm
looks for
hooks in the directory
.IR $HOME/.yadm/hooks .
Each hook is named using a prefix of
.I pre_
or
.IR post_ ,
followed by the command which should trigger the hook. For
example, to create a hook which is run after every
.I yadm pull
command, create a hook named
.IR post_pull.
Hooks must have the executable file permission set.

If a
.I pre_
hook is defined, and the hook terminates with a non-zero exit status,
.B yadm
will refuse to run the
.B yadm
command. For example, if a
.I pre_commit
hook is defined, but that command ends with a non-zero exit status, the
.I yadm commit
will never be run. This allows one to "short-circuit" any operation using a
.I pre_
hook.

Hooks have the following environment variables available to them at runtime:
.TP
.B YADM_HOOK_COMMAND
The command which triggered the hook
.TP
.B YADM_HOOK_EXIT
The exit status of the
.B yadm
command
.TP
.B YADM_HOOK_FULL_COMMAND
The
.B yadm
command with all command line arguments
.TP
.B YADM_HOOK_REPO
The path to the
.B yadm
repository
.TP
.B YADM_HOOK_WORK
The path to the work-tree
.SH FILES
The following are the default paths
.B yadm
uses for its own data.
These paths can be altered using universal options.
See the OPTIONS section for details.
.TP
.I $HOME/.yadm
The
.B yadm
directory. By default, all data
.B yadm
stores is relative to this directory.
.TP
.I $YADM_DIR/config
Configuration file for
.BR yadm .
.TP
.I $YADM_DIR/repo.git
Git repository used by
.BR yadm .
.TP
.I $YADM_DIR/encrypt
List of globs used for encrypt/decrypt
.TP
.I $YADM_DIR/files.gpg
All files encrypted with
.B yadm encrypt
are stored in this file.
.SH EXAMPLES
.TP
.B yadm init
Create an empty repo for managing files
.TP
.B yadm add .bash_profile ; yadm commit
Add
.I .bash_profile
to the Git index and create a new commit
.TP
.B yadm remote add origin <url>
Add a remote origin to an existing repository
.TP
.B yadm push -u origin master
Initial push of master to origin
.TP
.B echo ".ssh/*.key" >> $HOME/.yadm/encrypt
Add a new pattern to the list of encrypted files
.TP
.B yadm encrypt ; yadm add ~/.yadm/files.gpg ; yadm commit
Commit a new set of encrypted files
.SH REPORTING BUGS
Report issues or create pull requests at GitHub:

https://github.com/TheLocehiliosan/yadm/issues
.SH AUTHOR
Tim Byrne <sultan@locehilios.com>
.SH SEE ALSO

.BR git (1),
.BR gpg (1)

https://thelocehiliosan.github.io/yadm/