# ~/.zshrc.local — per-machine customizations. Copy this file to
# ~/.zshrc.local and fill in what this box needs. It is sourced at the end
# of the managed ~/.zshrc, is never overwritten by bootstrap, and never
# lives in the repo. Secrets normally come from your 1Password vault instead
# (secrets/install.sh -> ~/.config/dotfiles/secrets.env); set one here only on
# a box without 1Password, or to override the vault's value on this machine.
#
#   cp zsh/zshrc.local.example ~/.zshrc.local && chmod 600 ~/.zshrc.local

# --- Gitea -------------------------------------------------------------
# Personal access token for git.nic-oconnor.com (API/CLI use; HTTPS git
# auth itself goes through credential.helper store, see git/).
# export GITEA_KEY=...

# --- covert-gpt LiteLLM gateway -----------------------------------------
# LITELLM_KEY is normally exported by mcp-config's sync hook from
# ~/.config/mcp-sync/key — run mcp-config/install.sh once instead of
# setting it here. Only set it here on a box without mcp-sync:
# export LITELLM_KEY=sk-...
#
# Hermes Agent uses the same key and endpoint. The base_url is configured
# in ~/.hermes/config.yaml to point to your covert-gpt gateway
# (https://llm.covert-gpt.com). Run hermes setup or update config.yaml
# to set the default model (see ~/.hermes/config.yaml for available models).

# mcp-config/install.sh records the checkout it ran from, and the sync reads
# the config and skills from there — no download, no anonymous read of the repo.
# To point it at a DIFFERENT checkout (e.g. develop against a feature branch
# while ~/.dotfiles stays on main), set one variable:
# MCP_SYNC_REPO="$HOME/source/dotfiles"
#
# Only the bootstrap-managed checkout (~/.dotfiles) is ever `git pull`-ed by the
# hook, and only when clean — a tree you work in is read, never touched.

# --- 1Password -----------------------------------------------------------
# Nothing to set here. Do NOT loop over `op read` in this file: that ran on
# every shell. secrets/install.sh stores the service-account token in
# ~/.config/dotfiles/op.env and writes the vault's fields to secrets.env, which
# the managed ~/.zshrc loads. Use opr / opc / opd (see zsh/zshrc).

# --- Proxmox -------------------------------------------------------------
# One pair of credentials, several consumers: the proxmox MCP server
# (mcp-config/opencode.gateway.json) and the terraform layer in
# rke2-devops-airgap, whose Taskfile composes PROXMOX_VE_API_TOKEN from them.
# Unprefixed on purpose — these are Proxmox credentials, not MCP ones.
#
# secrets.env already exports them from your vault item, so these lines are
# only needed without 1Password. Never committed.
# export PROXMOX_TOKEN_ID="root@pam!terragrunt-proxmox"
# export PROXMOX_TOKEN_SECRET="00000000-0000-0000-0000-000000000000"
#
# The host and TLS setting are hardcoded per-server in the MCP config and read
# from variables.yaml by terraform, so there is nothing to export for them.

# --- Anything else -------------------------------------------------------
# Aliases, PATH additions, kubeconfig defaults, etc. This file loads last,
# so it can override anything the managed zshrc sets.
# export KUBECONFIG="$HOME/.kube/homelab.yaml"