envkit

Your dotfiles in git, your secrets in the OS keychain — on macOS and Linux.

envkit backs up the files that configure your machine to a git repository you control, and keeps the secrets inside them out of that repository entirely.

What makes it different

Most dotfile tools symlink your home files into a repo. That couples the machine to the repo: delete the repo and your shell breaks. And they have no answer for secrets, so people either commit tokens or maintain a pile of manual steps.

envkit takes a different stance.

Decoupled, not symlinked. Your ~/.zshrc stays a real file. The repository is a backup you push to and pull from. If it vanishes, your machine keeps working.

Secrets never touch git. Declare which values are secret and envkit moves them into the OS keychain, leaving a placeholder in the repo. Your shell fetches them at startup.

One store, many machines. Per-OS layers give your Mac its .zshrc and your Linux box its .bashrc from the same store, while sharing .gitconfig.

No magic sync. Two explicit directions — backup and load — so envkit never guesses which side should win.

Where to start

New to it? Getting started takes you from nothing to a backed-up machine. Then Secrets, which is the part most tools get wrong.

Already running it and want a specific answer? Try the command reference or how it works.