Configuration map

Read this map before editing a live file

Find a setting below, edit its repository source, then preview and apply. For example:

Locate and preview Neovim configuration

chezmoi source-path ~/.config/nvim/init.lua
chezmoi diff ~/.config/nvim/init.lua

The first command identifies ownership; the second shows pending changes without applying them.

Wide diagrams scroll horizontally. Focus the figure to use arrow keys.

After applying, reload the app or open a new shell. Private runtime state—tokens, caches, databases, and sessions—stays separate from managed settings.

Source-to-target families

Family	Authoritative sources	Rendered or installer target	Separate state and handbook
Chezmoi identity/data	templates, data	$HOME/.config/chezmoi and rendered templates	Machine data controls templates; inspect with chezmoi data.
Shells	zprofile, bash profile, zshrc, bashrc, profile, inputrc, Fish	.config/fish/conf.d, .zprofile, .bash_profile, .zshrc, .bashrc, .profile, .inputrc	Environment/history/plugins; guide.
Terminals	Ghostty, tmux, iTerm	Ghostty config, .tmux.conf, iTerm preferences	SSH terminfo, tmux server, clipboard access.
Search/directories	ripgrep, Git ignore	ripgrep and Git config dirs	Project-local ignore files remain effective.
Git & SSH	gitconfig, SSH config	.gitconfig, .ssh/config	Keys, known hosts, private config.d, server policy.
Neovim	init.lua	.config/nvim/init.lua	lazy.nvim, Mason packages, LSP, Treesitter.
VS Code & Cursor	VS Code settings, Cursor settings, Cursor harness	config dirs, native User links, .cursor/	Extensions, Remote-SSH, GUI reload, MCP JSON, CLI merge, My Machines worker. See Cursor.
Agents	Codex, Claude, Cursor, OpenCode, Pi	.codex, .claude, .cursor, OpenCode, Pi dirs	Plugin caches, MCP processes, auth; guides.
Local helpers	bin helpers	.local/bin	Process/browser/desktop permission and task/archive state; durable work.
Desktop/launchd	AeroSpace, LaunchAgents	.aerospace.toml, Library/LaunchAgents	Loaded jobs and running applications.
Lifecycle hooks	run_onchange sources	Executed by chezmoi during apply	Installer results and generated state have their own boundaries.

dot_ becomes a leading dot; .tmpl renders using machine data. create_ files are write-once inputs: their reconciler preserves runtime-owned sections.

SSH agent forwarding policy

The managed SSH config reads ~/.ssh/config.d/* before its Host * defaults. Keep destination trust decisions in an uncommitted file rather than changing the shared template. For example, allow only buildbox to use the local agent:

Create a private forwarding policy

mkdir -p ~/.ssh/config.d
chmod 700 ~/.ssh ~/.ssh/config.d
${EDITOR:-vi} ~/.ssh/config.d/forwarding
chmod 600 ~/.ssh/config.d/forwarding

Put this in ~/.ssh/config.d/forwarding:

# Trusted destinations.
Host buildbox
    ForwardAgent yes

# Disable forwarding for every other destination.
Host *
    ForwardAgent no

OpenSSH uses the first obtained value for an option, so the named host’s yes and the private catch-all no take effect before the template’s current global ForwardAgent yes. If $HOME is shared over NFS, this file is shared too, so the policy applies on every machine using that home. Different machine policies require a genuinely host-local overlay/include or host-selected rules such as Match exec; this configuration does not create that isolation automatically. Any matching ForwardAgent setting from an earlier config.d file can also win, so check the effective value after changing includes. Agent forwarding lets a remote host use your local agent while the connection is open; enable it only for hosts you trust. See the OpenSSH ssh_config reference.

Check the resolved value without connecting:

Verify the host policy

ssh -G buildbox | grep '^forwardagent '
ssh -G an-untrusted-host | grep '^forwardagent '

The expected output is forwardagent yes for buildbox and forwardagent no for other hosts. ssh -G reports client configuration only; it does not test network reachability, authentication, or the remote server.

Operator recipes

Goal	Read-only evidence	Establishes
Find target source	chezmoi source-path $HOME/.config/nvim/init.lua	Chezmoi ownership and source path.
Preview a change	chezmoi diff	Render delta; no target changed.
Check template values	chezmoi data	Current chezmoi data.
Inspect native editor link	ls -l native User settings target	Link destination, not editor reload/extensions.
Inspect SSH options	ssh -G host	Client resolution, not connection/authentication.
Inspect Git origin	git config —global —show-origin —get core.editor	Selected config file and value.

After a change, check its consumer: Neovim :checkhealth, an editor’s extension list, or a fresh login shell.

Ownership boundaries that prevent drift

Package manifests own installable tools and editor extensions; home owns settings and executable helper sources; installers own platform-native links and generated runtime configuration. The feature map inventories installers/helpers. Agent inventories explain skills, plugins, and MCP ownership without duplicating every declaration here.

Do not commit private SSH host blocks, credential env files, application databases, browser profiles, plugin caches, or editor remote-server state. For template semantics, use chezmoi machine differences and source-state attributes.