Skip to content

🔧 Chezmoi Variables

The dotfiles repository provides several variables that can be used in templates and scripts.

User Information

  • firstname / lastname / name — Your name (prompted on first run).
  • username — System username (prompted on first run).
  • email — Your email address (prompted on first run).
  • githubUsername — Your GitHub username (auto-detected from email or git remote).

Environment Detection

  • codespaces — Running in GitHub Codespaces (true / false).
  • devcontainer — Running in a dev container (true / false).
  • wsl — Running in Windows Subsystem for Linux (true / false).
  • ci — Running in CI environment (true / false).
  • installType — Installation mode (light or full).

Hardware tokens

  • useYubiKey — When true, the SSH config is wired for a hardware-backed FIDO2 key (~/.ssh/id_ed25519_sk) and the 1Password SSH agent include is skipped. Defaults to false to preserve the existing 1Password flow. See yubikey.md for the provisioning workflow.

GitHub Copilot CLI

  • opCopilotEnvironmentId — The 1Password Environment ID that holds the COPILOT_GITHUB_TOKEN (and optional GH_TOKEN) variables. Used by the copilot-ssh / copilot_ssh helper to forward the tokens to headless servers over SSH. This is a non-secret identifier (useless without authenticating to 1Password), so a shared default is hardcoded in .chezmoi.yaml.tmpl. Override it per-machine by setting opCopilotEnvironmentId in your local chezmoi config or at the interactive init prompt. Exported to your shell as OP_COPILOT_ENVIRONMENT_ID. See copilot-cli.md.
  • copilotSshHost — The SSH host used by the Windows Terminal "Copilot SSH" profile that runs the copilot-ssh PowerShell helper. Defaults to svlazdev.<privateDomain> when privateDomain is set, otherwise svlazdev. Override it per-machine by setting copilotSshHost in your local chezmoi config or at the interactive init prompt.

1Password shell plugins

  • opShellPlugins — CLIs wrapped by a 1Password shell plugin so they authenticate with biometrics instead of a token on disk. Defaults to ["gh", "copilot"]. Accepts either a YAML list or a comma-separated string in your local chezmoi config (the string form is trimmed, de-duplicated and sorted). Not prompted. Each entry still needs a one-off op plugin init <cli>, and the wrappers are skipped entirely on WSL, where shell plugins are unsupported. See 1password-shell-plugins.md.

Git commit signing

  • gitSigningKey — The SSH public key used to sign Git commits when the 1Password SSH agent drives signing. Works on WSL, native Windows and macOS; the platform-specific signer binary is auto-detected. Two defaults ship: a work key, used when isWork is true, and the repository owner's personal key for every other machine. Both are public keys — the personal one is already published at https://github.com/DevSecNinja.keys — so they are safe to ship in the repo. Override it per-machine by setting gitSigningKey in your local chezmoi config to your own key — copy it from the 1Password app, item → â‹® → Configure Commit Signing → Copy Snippet. An empty value falls back to the work/personal default, as does a value that still equals one of the shipped defaults (so a config written by an earlier chezmoi init never pins the wrong one). Ignored when useYubiKey is true, since the YubiKey flow derives its key from ~/.ssh/id_*_sk*.pub instead. See git-signing.md.
  • opSshSignProgram — Explicit path to the 1Password SSH signer binary. Empty by default, which auto-detects per platform (op-ssh-sign-wsl.exe in WSL, op-ssh-sign.exe on Windows, op-ssh-sign on macOS). Set it for a non-standard install, or on Linux where there is no standard path. When no signer is found, signing stays off rather than breaking every git commit.
  • opSshVault — 1Password vault the SSH agent offers keys from, written to %LOCALAPPDATA%\1Password\config\ssh\agent.toml on Windows. Defaults to Microsoft when isWork is true and Private otherwise; as with gitSigningKey, a value that still equals one of the shipped defaults is re-picked, so only a differently-named vault counts as an override. See git-signing.md.

Windows Enterprise (Windows and WSL)

  • isEntraIDJoined — Device is Entra ID (Azure AD) joined.
  • isIntuneJoined — Device is Intune (MDM) enrolled.
  • isEntraRegistered — Device is Entra ID registered / workplace joined.
  • isADDomainJoined — Device is Active Directory domain joined.
  • entraIDTenantName — Entra ID tenant name (for example, Microsoft).
  • entraIDTenantId — Entra ID tenant ID (GUID).
  • isWork — Device is joined to a *Microsoft tenant.

Shell Environment Variables

These variables are also exposed as environment variables in your shell:

  • PowerShell: $env:CHEZMOI_* (for example, $env:CHEZMOI_IS_ENTRA_ID_JOINED, $env:CHEZMOI_ENTRA_ID_TENANT_NAME).
  • Bash / Zsh: $CHEZMOI_* (for example, $CHEZMOI_IS_ENTRA_ID_JOINED, $CHEZMOI_ENTRA_ID_TENANT_NAME).
  • Fish: $CHEZMOI_* (for example, $CHEZMOI_IS_ENTRA_ID_JOINED, $CHEZMOI_ENTRA_ID_TENANT_NAME).

Additionally, when set, opCopilotEnvironmentId is exported as OP_COPILOT_ENVIRONMENT_ID (PowerShell: $env:OP_COPILOT_ENVIRONMENT_ID).