feat(dotfiles): document macos setup and secure secrets

home/.chezmoiignore

@@ -46,4 +46,7 @@ bin/audio/synth-power-prompt.sh
 
 # Wine-based Adobe DNG conversion with GNU date
 bin/video/cr3todng.sh
+{{ else -}}
+# Homebrew dependencies are only managed on macOS.
+.brewfile
 {{ end -}}

home/bin/frc-photo-checklist.py

@@ -7,6 +7,7 @@ import datetime as dt
 import re
 import operator
 import os
+import shlex
 import sys
 import tbapy
 from todoist_api_python.api import TodoistAPI
@@ -105,7 +106,7 @@ configParser.read_string(configString)
 
 # Load needed credentials
 tbaKey = configParser.get('Settings', 'TBAKey')
-todoistToken = configParser.get('Settings', 'TodoistToken')
+todoistToken = shlex.split(configParser.get('Settings', 'TodoistToken'))[0]
 
 # Setup Todoist
 api = TodoistAPI(todoistToken)

home/dot_Brewfile

@@ -0,0 +1,21 @@
+# Shared command-line tools
+brew "chezmoi"
+brew "git"
+brew "emacs"
+brew "python"
+brew "jq"
+
+# Password-store secrets used by chezmoi templates
+brew "pass"
+brew "gnupg"
+
+# Web browser
+cask "brave-browser"
+
+# Terminal and font used by the shared Alacritty configuration
+cask "alacritty"
+cask "font-inconsolata"
+
+# Optional tools for audio conversion and local AI
+# brew "ffmpeg"
+# brew "ollama"

home/dot_config/private_settings.conf.tmpl

@@ -0,0 +1,5 @@
+# Single-quote values and escape embedded single quotes without changing backslashes.
+computer='{{ .chezmoi.hostname | replace "'" "'\\''" }}'
+activation_bytes='{{ pass "self-host/token/audible-activation-bytes" | replace "'" "'\\''" }}'
+AQUAAI_KEY='{{ pass "self-host/token/aquaai" | replace "'" "'\\''" }}'
+TodoistToken='{{ pass "self-host/token/todoist" | replace "'" "'\\''" }}'

home/dot_config/settings.conf.tmpl

@@ -1,4 +0,0 @@
-computer={{ .chezmoi.hostname }}
-activation_bytes={{ pass "self-host/token/audible-activation-bytes" }}
-AQUAAI_KEY={{ pass "self-host/token/aquaai" }}
-TodoistToken={{ pass "self-host/token/todoist" }}