noconnorandClaude Opus 5
1159197e4b
They act on 1Password, not on the environment, so the prefix now says so: opr (read), opc (create/update), opd (delete), opl (list), ops (refresh). No behavior change. Checked the new names don't collide with any command or oh-my-zsh alias, and verified opr/opl/ops against the real vault (values compared, not printed). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
59 lines
3.2 KiB
Plaintext
59 lines
3.2 KiB
Plaintext
# ~/.zshrc.local — per-machine customizations. Copy this file to
|
|
# ~/.zshrc.local and fill in what this box needs. It is sourced at the end
|
|
# of the managed ~/.zshrc, is never overwritten by bootstrap, and never
|
|
# lives in the repo. Secrets normally come from your 1Password vault instead
|
|
# (secrets/install.sh -> ~/.config/dotfiles/secrets.env); set one here only on
|
|
# a box without 1Password, or to override the vault's value on this machine.
|
|
#
|
|
# cp zsh/zshrc.local.example ~/.zshrc.local && chmod 600 ~/.zshrc.local
|
|
|
|
# --- Gitea -------------------------------------------------------------
|
|
# Personal access token for git.nic-oconnor.com (API/CLI use; HTTPS git
|
|
# auth itself goes through credential.helper store, see git/).
|
|
# export GITEA_KEY=...
|
|
|
|
# --- covert-gpt LiteLLM gateway -----------------------------------------
|
|
# LITELLM_KEY is normally exported by mcp-config's sync hook from
|
|
# ~/.config/mcp-sync/key — run mcp-config/install.sh once instead of
|
|
# setting it here. Only set it here on a box without mcp-sync:
|
|
# export LITELLM_KEY=sk-...
|
|
#
|
|
# Hermes Agent uses the same key and endpoint. The base_url is configured
|
|
# in ~/.hermes/config.yaml to point to your covert-gpt gateway
|
|
# (https://llm.covert-gpt.com). Run hermes setup or update config.yaml
|
|
# to set the default model (see ~/.hermes/config.yaml for available models).
|
|
|
|
# mcp-config/install.sh records the checkout it ran from, and the sync reads
|
|
# the config and skills from there — no download, no anonymous read of the repo.
|
|
# To point it at a DIFFERENT checkout (e.g. develop against a feature branch
|
|
# while ~/.dotfiles stays on main), set one variable:
|
|
# MCP_SYNC_REPO="$HOME/source/dotfiles"
|
|
#
|
|
# Only the bootstrap-managed checkout (~/.dotfiles) is ever `git pull`-ed by the
|
|
# hook, and only when clean — a tree you work in is read, never touched.
|
|
|
|
# --- 1Password -----------------------------------------------------------
|
|
# Nothing to set here. Do NOT loop over `op read` in this file: that ran on
|
|
# every shell. secrets/install.sh stores the service-account token in
|
|
# ~/.config/dotfiles/op.env and writes the vault's fields to secrets.env, which
|
|
# the managed ~/.zshrc loads. Use opr / opc / opd (see zsh/zshrc).
|
|
|
|
# --- Proxmox -------------------------------------------------------------
|
|
# One pair of credentials, several consumers: the proxmox MCP server
|
|
# (mcp-config/opencode.gateway.json) and the terraform layer in
|
|
# rke2-devops-airgap, whose Taskfile composes PROXMOX_VE_API_TOKEN from them.
|
|
# Unprefixed on purpose — these are Proxmox credentials, not MCP ones.
|
|
#
|
|
# secrets.env already exports them from your vault item, so these lines are
|
|
# only needed without 1Password. Never committed.
|
|
# export PROXMOX_TOKEN_ID="root@pam!terragrunt-proxmox"
|
|
# export PROXMOX_TOKEN_SECRET="00000000-0000-0000-0000-000000000000"
|
|
#
|
|
# The host and TLS setting are hardcoded per-server in the MCP config and read
|
|
# from variables.yaml by terraform, so there is nothing to export for them.
|
|
|
|
# --- Anything else -------------------------------------------------------
|
|
# Aliases, PATH additions, kubeconfig defaults, etc. This file loads last,
|
|
# so it can override anything the managed zshrc sets.
|
|
# export KUBECONFIG="$HOME/.kube/homelab.yaml"
|