From efca8921090fd7c13de39d30e7fae3c9bb014f03 Mon Sep 17 00:00:00 2001
From: Nic O'Connor <nic.oconnor@gmail.com>
Date: Sun, 12 Jul 2026 04:40:14 -0400
Subject: [PATCH] zsh/: source ~/.zshrc.local for per-machine secrets
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

~/.zshrc is managed and overwritten on every bootstrap, so there was
nowhere to put a machine-local key. The managed rc now sources
~/.zshrc.local last (so it can override anything) and bootstrap never
touches that file. zshrc.local.example documents the variables modules
look for: GITEA_KEY, LITELLM_KEY, OP_SERVICE_ACCOUNT_TOKEN.

Secrets stay out of the repo — zsh/zshrc is shared config applied to
every box.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 zsh/zshrc               |  5 +++++
 zsh/zshrc.local.example | 26 ++++++++++++++++++++++++++
 2 files changed, 31 insertions(+)
 create mode 100644 zsh/zshrc.local.example

diff --git a/zsh/zshrc b/zsh/zshrc
index 9e505ff..7d0509a 100644
--- a/zsh/zshrc
+++ b/zsh/zshrc
@@ -33,3 +33,8 @@ HISTSIZE=10000
 SAVEHIST=10000
 setopt SHARE_HISTORY
 setopt HIST_IGNORE_DUPS
+
+# Per-machine customizations (secrets, keys, local overrides) live in
+# ~/.zshrc.local, which bootstrap never touches. See zsh/zshrc.local.example
+# for the variables modules look for. Loaded last so it can override anything.
+[ -f "$HOME/.zshrc.local" ] && source "$HOME/.zshrc.local"
diff --git a/zsh/zshrc.local.example b/zsh/zshrc.local.example
new file mode 100644
index 0000000..c8cfbd8
--- /dev/null
+++ b/zsh/zshrc.local.example
@@ -0,0 +1,26 @@
+# ~/.zshrc.local — per-machine customizations. Copy this file to
+# ~/.zshrc.local and fill in what this box needs. It is sourced at the end
+# of the managed ~/.zshrc, is never overwritten by bootstrap, and never
+# lives in the repo — this is the ONLY place to put secrets.
+#
+#   cp zsh/zshrc.local.example ~/.zshrc.local && chmod 600 ~/.zshrc.local
+
+# --- Gitea -------------------------------------------------------------
+# Personal access token for git.nic-oconnor.com (API/CLI use; HTTPS git
+# auth itself goes through credential.helper store, see git/).
+# export GITEA_KEY=...
+
+# --- covert-gpt LiteLLM gateway -----------------------------------------
+# LITELLM_KEY is normally exported by mcp-config's sync hook from
+# ~/.config/mcp-sync/key — run mcp-config/install.sh once instead of
+# setting it here. Only set it here on a box without mcp-sync:
+# export LITELLM_KEY=sk-...
+
+# --- 1Password CLI -------------------------------------------------------
+# Service-account token for non-interactive `op read` / `op run`.
+# export OP_SERVICE_ACCOUNT_TOKEN=ops_...
+
+# --- Anything else -------------------------------------------------------
+# Aliases, PATH additions, kubeconfig defaults, etc. This file loads last,
+# so it can override anything the managed zshrc sets.
+# export KUBECONFIG="$HOME/.kube/homelab.yaml"