Add mkzensical build wrapper script

- Document xstow usage for systems lacking GNU Stow
- Add SPDX headers to .stowrc for license compliance
- Add REUSE specification compliance notes to README

.stowrc

@@ -1,3 +1,6 @@
---dir=pkgs
+# SPDX-FileCopyrightText: 2025 Kris Lamoureux <kris@lamoureux.io>
+# SPDX-License-Identifier: 0BSD
+
 --target=$HOME
---verbose
+--no-folding
+--verbose=2

README.md

@@ -5,23 +5,61 @@ SPDX-License-Identifier: 0BSD
 
 ## Dotfiles
 
-Use GNU Stow to slow down your home directory listings with my
+Use GNU Stow (or xstow) to slow down your home directory listings with my
 [accumulated sludge](https://web.archive.org/web/20141205101508/https://plus.google.com/+RobPikeTheHuman/posts/R58WgWwN9jp).
 
 ### Setup
 
-1.  Clone into a subdirectory of `$HOME` and change into it
+1.  Create the `~/.local` directory (if it doesn't already exist)
 
-        git clone https://git.krislamo.org/kris/dotfiles.git ~/.dotfiles && \
+        mkdir -p ~/.local
-        cd ~/.dotfiles
 
-2.  List available configuration packages
+2.  Clone the repository
 
-        basename -a pkgs/*/
+        git clone https://git.krislamo.org/kris/dotfiles.git ~/.local/dotfiles
 
-3.  Dry run `stow` with `-n` against configuration sets and verify output before
+3.  Navigate to the repository's directory
-    running
 
-        stow -n $(basename -a pkgs/*/)
+        cd ~/.local/dotfiles
 
-    - Use `-nvv` for more verbose output.
+4.  Dry run `stow` with `-n` against configuration sets and verify, e.g.,
+
+        stow -n vim
+
+### Using xstow
+
+On systems without GNU Stow, you can build and use `xstow` as an alternative for
+managing symlinks. Build a statically linked binary using
+[xstow-builder](https://git.krislamo.org/kris/xstow-builder), then copy it to
+`~/.local/bin/` on your target system. You need to specify the target directory
+`-t` because `xstow` does not use the `.stowrc` file.
+
+#### Bootstrapping
+
+If you copy `xstow` to `~/.local/bin` before stowing the `bash` package, you'll
+hit a bootstrapping problem. You need `xstow` in your `$PATH` to easily use it,
+but you need the updated `.bashrc` (from the `bash` package) to add
+`~/.local/bin` to your `$PATH` in the first place. To break this cycle, invoke
+`xstow` directly with its full path for the initial setup.
+
+1.  Place the `xstow` binary at `~/.local/bin/xstow`
+2.  Sideline your `.bashrc` file
+
+        cp ~/.bashrc ~/.bashrc.bak
+
+3.  Inside the repository, dry run `xstow` ( `-n` ) using the full path
+
+        ~/.local/bin/xstow -t "$HOME" -v 2 -n bash
+
+    - Remove `-n` only once you are sure it will work as intended
+    - After stowing the `bash` package, start a new shell or source `.bashrc`
+
+### Licensing
+
+This project follows the [REUSE](https://reuse.software) specification.
+
+Efforts have been made to include SPDX license headers and a LICENSES directory
+with the appropriate licenses, since not all configurations in these dotfiles
+are original.
+
+Please ensure that the repository passes the `reuse lint` check.

bash/.bash_aliases

@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: 2019-2022, 2025 Kris Lamoureux <kris@lamoureux.io>
+# SPDX-FileCopyrightText: 2019-2022, 2025-2026 Kris Lamoureux <kris@lamoureux.io>
 # SPDX-License-Identifier: 0BSD
 
 # shellcheck shell=bash
@@ -11,8 +11,13 @@ alias 'otheralias'='vim ~/.other_aliases && . ~/.bash_aliases'
 alias 'viewalias'='view ~/.bash_aliases'
 alias 'refreshalias'='source ~/.bash_aliases'
 
+# File management
+alias put='mv --update=none-fail --verbose'
+alias copy='cp --update=none-fail --verbose'
+alias mv='mv -i'
+
 # SSH management
-alias 'fssh'='ssh-add && ssh -A'
+alias 'fssh'='ssh-add && ssh -A -S none'
 alias 'editssh'='vim ~/.ssh/config'
 
 # Edit hosts file
@@ -77,20 +82,20 @@ alias 'signhist'='git rebase --exec "git commit -S --amend --no-edit -n"'
 alias 'signhistnew'='git rebase --exec "git commit -S --amend --date '\''`date -R`'\'' --no-edit -n"'
 
 function gd() {
-  git diff HEAD~$1
+	git diff "HEAD~$1"
 }
 
 function rebase() {
-  git rebase -i HEAD~$1
+	git rebase -i "HEAD~$1"
 }
 
 function delcommit() {
-  git reset --hard HEAD~$1
+	git reset --hard "HEAD~$1"
 }
 
 # Docker shortcuts
 function inspect() {
-  docker inspect "$1" | less
+	docker inspect "$1" | less
 }
 
 # Color shift
@@ -103,9 +108,11 @@ alias 'socks'='screen -dm ssh -D 1337 -q -C -N'
 # sshuttle proxy
 #e.g. alias 'proxyhome'='proxy user hostdomain:22 192.168.1.0/24'
 function proxy() {
-  screen -dm sshuttle -v -r $1@$2 -x $2 ${@:2}; screen -r;
+	screen -dm sshuttle -v -r "$1@$2" -x "$2" "${@:2}"
+	screen -r
 }
 
 if [ -f ~/.other_aliases ]; then
-  source ~/.other_aliases
+	# shellcheck disable=SC1090
+	source ~/.other_aliases
 fi

bitwarden/.local/bin/bwexport

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: 2026 Kris Lamoureux <kris@lamoureux.io>
+# SPDX-License-Identifier: 0BSD
+
+set -o pipefail
+msg() {
+	printf '[%s]: %s\n' "$1" "$2"
+}
+
+for cmd in bw gpg gzip; do
+	if ! command -v "$cmd" >/dev/null; then
+		msg 'ERROR' "'$cmd' not found"
+		exit 1
+	fi
+done
+
+read -srp "Vault password: " bw_pw
+echo
+if ! bw_session="$(printf '%s' "$bw_pw" | bw unlock --raw 2>/dev/null)"; then
+	msg 'ERROR' "Couldn't unlock vault"
+	exit 1
+fi
+unset bw_pw
+read -srp "GPG passphrase: " gpg_pw
+echo
+read -srp "Confirm GPG passphrase: " gpg_pw2
+echo
+if [ "$gpg_pw" != "$gpg_pw2" ]; then
+	msg 'ERROR' "Passphrases don't match"
+	exit 1
+fi
+unset gpg_pw2
+
+bw_date="$(TZ='America/New_York' date +%Y%m%dT%H%M)"
+: "${BW_BACKUP:="./bw-export-$bw_date.json.gz.gpg"}"
+if [ -e "$BW_BACKUP" ]; then
+	msg 'ERROR' "Existing file at $BW_BACKUP"
+	exit 1
+fi
+if ! bw export --format json --raw --session "$bw_session" | gzip |
+	gpg --symmetric --cipher-algo AES256 --pinentry-mode loopback \
+		--passphrase-fd 3 --batch -q \
+		-o "$BW_BACKUP" 3<<<"$gpg_pw"; then
+	msg 'ERROR' "Export failed"
+	unset gpg_pw
+	exit 1
+fi
+unset gpg_pw
+bw lock --session "$bw_session" >/dev/null 2>&1
+unset bw_session
+msg 'INFO' "Exported to '$BW_BACKUP'"

docker/.local/bin/docker

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: 2025 Kris Lamoureux
+# SPDX-License-Identifier: 0BSD
+unset DOCKER_HOST
+exec /usr/bin/docker "$@"

docker/.local/bin/podman

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: 2025 Kris Lamoureux
+# SPDX-License-Identifier: 0BSD
+exec /usr/bin/docker --context podman "$@"

gotify/.local/bin/gotify

@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: 2025 Kris Lamoureux
+# SPDX-License-Identifier: GPL-3.0-or-later
+set -euo pipefail
+
+for cmd in curl jq; do
+	if ! command -v "$cmd" &>/dev/null; then
+		echo "[ERROR]: $cmd is required but can't be found"
+		exit 1
+	fi
+done
+
+USAGE="Usage: $0 [-v] <priority> <title> <message>"
+VERBOSE=0
+while getopts "hv" OPT; do
+	case "$OPT" in
+	h)
+		echo "$USAGE"
+		exit 0
+		;;
+	v)
+		VERBOSE=1
+		;;
+	*)
+		echo "$USAGE"
+		exit 1
+		;;
+	esac
+done
+shift $((OPTIND - 1))
+
+if [ $# -lt 3 ]; then
+	echo "[ERROR]: Missing required arguments"
+	echo "$USAGE"
+	exit 1
+fi
+
+if [ -z "${GOTIFY_URL:-}" ] || [ -z "${GOTIFY_TOKEN:-}" ]; then
+	if [ -d ~/.config/gotify ] && [ -f ~/.config/gotify/env ]; then
+		# shellcheck disable=SC1090
+		. ~/.config/gotify/env
+	fi
+fi
+
+if [ -z "${GOTIFY_URL:-}" ]; then
+	echo "[ERROR]: GOTIFY_URL environment variable is not set"
+	exit 1
+fi
+
+if [ -z "${GOTIFY_TOKEN:-}" ]; then
+	echo "[ERROR]: GOTIFY_TOKEN environment variable is not set"
+	exit 1
+fi
+
+PRIORITY="$1"
+TITLE="$2"
+MESSAGE="$3"
+
+if ! echo "$PRIORITY" | grep -qE '^[0-9]+$'; then
+	echo "[ERROR]: Priority must be a number, got: $PRIORITY"
+	exit 1
+fi
+
+if ! PAYLOAD=$(
+	jq -nc \
+		--argjson priority "$PRIORITY" \
+		--arg title "$TITLE" \
+		--arg message "$MESSAGE" \
+		'{title: $title, message: $message, priority: $priority}'
+); then
+	echo "[ERROR]: Error with input syntax"
+	exit 1
+fi
+
+if ! RESPONSE=$(
+	curl -sSf -X POST "$GOTIFY_URL/message" \
+		-H "X-Gotify-Key: $GOTIFY_TOKEN" \
+		-H "Content-Type: application/json" \
+		-d "$PAYLOAD"
+); then
+	echo "[ERROR]: Couldn't send message to $GOTIFY_URL"
+	echo "$RESPONSE"
+	exit 1
+fi
+
+if [ "$VERBOSE" -eq 1 ]; then
+	echo "$RESPONSE"
+fi
+
+exit 0

mkzensical/.local/bin/mkzensical

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: 2026 Kris Lamoureux <kris@lamoureux.io>
+# SPDX-License-Identifier: 0BSD
+
+prog=${0##*/}
+
+err() {
+	printf '%s: %s\n' "$prog" "$1" >&2
+	logger -t "$prog" -p user.err "$1"
+	exit 1
+}
+
+usage() {
+	printf 'usage: %s [-z] <zensical_version> <repo_dir>\n' "$prog" >&2
+}
+
+selinux=0
+while getopts ':z' opt; do
+	case $opt in
+	z)
+		selinux=1
+		;;
+	*)
+		usage
+		exit 1
+		;;
+	esac
+done
+shift $((OPTIND - 1))
+
+if (($# != 2)); then
+	usage
+	exit 1
+fi
+
+tag=$1
+dir=$2
+
+if [[ ! $tag =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+	err "tag must be a version like 1.2.3 (got: $tag)"
+fi
+
+[[ ! -d $dir ]] && err "not a directory: $dir"
+cd "$dir" || err "failed to enter directory: $dir"
+git rev-parse --is-inside-work-tree &>/dev/null ||
+	err "not a git repository: $(pwd)"
+
+branch=$(git branch --show-current) || err "failed to get current branch"
+[[ -n $branch ]] || err "not on a branch"
+[[ $branch == main ]] || err "not on main branch: $branch"
+
+status=$(git status --porcelain) || err "git status failed at: $(pwd)"
+[[ -n $status ]] && err "working tree is dirty"
+
+old=$(git rev-parse HEAD) || err "git rev-parse failed at: $(pwd)"
+git pull -q --ff-only || err "failed to update repo"
+new=$(git rev-parse HEAD) || err "git rev-parse failed after pull at: $(pwd)"
+
+if [[ $old != "$new" || ! -d site ]]; then
+	docker_opts=(run --rm)
+	[[ $selinux -eq 1 ]] && docker_opts+=(--security-opt label=level:s0)
+	docker_opts+=(-v "$PWD:/docs" "zensical/zensical:$tag" build)
+	if ! docker "${docker_opts[@]}"; then
+		err "build failed"
+	fi
+fi
+
+[[ -d site ]] || err "build did not produce site directory"

tmux/.tmux.conf

@@ -0,0 +1,28 @@
+# SPDX-FileCopyrightText: 2026 Kris Lamoureux <kris@lamoureux.io>
+# SPDX-License-Identifier: 0BSD
+
+# prefix+r to reload
+bind r source-file ~/.tmux.conf \; display "Config reloaded!"
+
+# long history, 2k default
+set-option -g history-limit 100000
+
+# vi-style key bindings in copy mode, etc
+set-window-option -g mode-keys vi
+
+# Trying out mouse mode for now, use shift to bypass to local emulator
+bind-key m set-option -g mouse \; display "Mouse: #{?mouse,ON,OFF}"
+set -g mouse on
+set -g terminal-overrides 'xterm*:smcup@:rmcup@'
+
+# F12 to toggle whether tmux commands affect local or nested (remote) session
+bind -T root F12 \
+  set prefix None \;\
+  set key-table off \;\
+  refresh-client -S
+
+bind -T off F12 \
+  set -u prefix \;\
+  set -u key-table \;\
+  refresh-client -S
+

vim/.vimrc

@@ -18,3 +18,5 @@ if &term =~ '256color'
   set t_ut=
 endif
 
+" Use tabs in shell
+autocmd FileType sh setlocal tabstop=4 shiftwidth=4 noexpandtab