---
type: reference
title: Command Center Dotfiles
description: "How the dotfiles repo deploys: stow-equivalent packages, full-replica rsync, the pre-overwrite audit, transport gotchas."
tags: [dotfiles, omp, deploy, rsync, blankpad]
timestamp: 2026-10-05T00:00:00-07:00
---

# Command Center Dotfiles

Repo `~/.omp` is itself the deployment: packages are home-relative trees
under `dotfiles/<pkg>/`; `scripts/deploy.sh` symlinks live files into the
repo checkout. `git pull` + `deploy.sh` is the whole propagation story.

## Transport decision (agreed with Frank, executed 2026-09-09)

- Ship via **full-replica rsync of `/home/dank/.omp/` including `.git`** to
  `<user>@<host>:/home/<user>/.omp/`, NOT clone-from-Gitea — `main` can be
  ahead of `origin/main`; push is a user-only trigger, so clone would ship
  stale state.
- Deploy runs on-target as the target user: `bash
  /home/<user>/.omp/scripts/deploy.sh` (resolves the repo via `git -C
  $(dirname $(realpath $0)) rev-parse --show-toplevel`, so `.git` must be
  present at the target path — full-replica transport guarantees this).

## Pre-overwrite audit (MANDATORY before first sync on a non-blank host)

Diff every file that `deploy.sh --check` reports as DRIFT against the repo
copy BEFORE letting quarantine-and-replace run. Host-specific divergence
belongs in an override package, not in quarantine:

1. Pull divergent live files from target
   (`ssh ... 'cat <path>' > local-staged-copy`).
2. Secret-audit staged copies (grep token/secret/password/key shapes)
   before anything enters git.
3. Compose `dotfiles/zz-<hostname>/` on the source machine from those live
   copies; commit to repo first.
4. Ship the package dir via rsync, then run deploy sync — override deploys
   LAST and win over base packages.

## deploy.sh mechanics (verified on blankpad)

- `--check` = pure report (ADOPT/LINK/DRIFT lines), writes nothing. Run it
  first, always.
- Default mode = sync: adopt identicals silently, link new,
  quarantine-and-replace divergents into `.quarantine/<host>/<ts>/`
  (gitignored; never rm).
- **Override-target bug (fixed cc2c652):** `zz-<host>` packages nest
  base-package dirs internally (`zz-blankpad/niri/.config/...`); target
  derivation must strip the nested package segment, else overrides deploy to
  phantom `$HOME/niri/.config/...` while real targets keep pointing at
  canonical copies (visible symptom: check shows 0 actions but
  `readlink ~/.zshrc` points at base `zsh/.zshrc`).
- systemd units auto-enable only when ExecStart binary resolves on that
  host; dconf packages load via `dconf load /`, never symlinks.
- `core.hooksPath=.githooks` is armed by deploy.sh per machine — set it once
  post-transfer even before first sync.

## ssh/sshpass transport gotchas (all bit live)

- Resolve the target via mDNS FQDN (`avahi-resolve -4 -n <host>.local`); a
  bare hostname may not resolve. Drop-not-refuse on port 22 = sshd down or
  firewall default-drop, not auth failure — needs a local/console fix on
  target.
- `SSHPASS='...' sshpass -e ssh ...` inline per invocation; an env passed
  via the tool's env parameter did not propagate to the sshpass child
  process.
- The remote login shell may be **fish**: never send bash syntax
  (`for/do/done`, `$?`) bare through `ssh host 'cmd'`; wrap as `bash -c
  "..."` or ship a script. See [[SSH and Remote Access]].
- File shipping: `ssh 'cat > /remote/path' < localfile` (stdin redirect). A
  here-doc attached to the ssh command is consumed by `cat` — the intended
  script body becomes the file content, silently. Verify shipped bytes with
  an md5sum compare on both ends; do NOT compare `/dev/stdin` after `cat`
  drained it (false DIVERGED).

## Verification of a completed deploy

Re-run `deploy.sh --check` → expect exactly zero actions/quarantined/skipped
= idempotent steady state. Spot-check `readlink` on override files points
into `dotfiles/zz-<host>/`, not base packages.

## Related

- [[SSH and Remote Access]] — the transport mechanics this deploy rides
- [[Noctalia and Niri]] — the desktop packages this repo ships
- [[Deploy State Triage]] — the serverAppConfig deploy flow (different repo)