exe-bootstrap

Modular, idempotent dev environment for disposable exe.dev Ubuntu VMs (works on plain Ubuntu 24.04 too).

Clone once, run ./install, re-run anytime. Add or remove tools by editing modules — no need to rebuild a machine image.

Repo: github.com/robertguss/exe-bootstrap (public — clone over HTTPS, no SSH key required)

# 1. SSH into the VM, then clone (HTTPS — no GitHub SSH key needed)
git clone https://github.com/robertguss/exe-bootstrap.git ~/exe-bootstrap

cd ~/exe-bootstrap
./install
exec zsh
./doctor

Then complete After install: required & optional steps below. The installer configures tools; it does not complete interactive logins or secret backups for you.

Dotfiles are symlinked from home/ into $HOME. Machine-specific overrides go in ~/.zshrc.local (created empty; never overwritten by install after first create).

./install                 # full install (idempotent)
./install --list          # modules on/off
./install --only 60-fnox  # single module (prefix or full id)
./install --dry-run       # show what would run
./install --help
./doctor                  # health check (pass / warn / fail)

Work through this on every new VM. The install script only prints a short reminder; this section is the source of truth.

exec zsh
# or disconnect and SSH back in

Install sets the login shell to zsh, exports SHELL during install, and adds a ~/.bashrc bridge so interactive bash (including tools that spawn $SHELL=/bin/bash after chsh, e.g. herdr panes) auto-execs zsh. New SSH logins get zsh from passwd.

Confirm:

echo $SHELL          # should end with /zsh
echo $0              # should be -zsh or zsh
mise --version
node -v              # LTS via mise
which grok nvim herdr fnox hk
./doctor             # full health check (from the bootstrap repo)

Install generates (if missing):

~/.config/fnox/age.txt

This file decrypts secrets. Copy it offline (password manager, encrypted USB, 1Password secure note, etc.). Do not commit it.

# Show public key only (safe to store in fnox recipients)
grep "public key:" ~/.config/fnox/age.txt

# Confirm permissions
ls -la ~/.config/fnox/age.txt   # expect -rw------- (600)

If you destroy the VM without a backup, encrypted secrets are gone for that key.

These tools are installed but need you to log in. None of this is automated (by design).

Needed for private repos, PRs, gh browse, etc.

gh auth status          # see if already logged in
gh auth login           # if not — HTTPS or SSH; use your robertguss account
gh auth setup-git       # optional: use gh as git credential helper

SSH note: first push/clone via git@github.com may need:

ssh-keyscan -t ed25519,rsa github.com >> ~/.ssh/known_hosts
# Ensure this VM has an SSH key loaded or use exe.dev GitHub integration

exe.dev: you can also attach the GitHub integration so private clones work without storing a PAT on the VM.

Install: official script in module 70-agents (x.ai/build).

grok --version
grok                    # first run: complete browser / API auth as prompted
# or set API key if you use key-based auth — prefer fnox, not plain .zshrc

Docs: https://docs.x.ai/build/overview
Update later: grok update

Binary is installed; login is interactive and was skipped in non-interactive installs.

devin --version
devin                   # complete Cognition / Devin account login

Docs: https://docs.devin.ai/cli

Often preinstalled on exeuntu. Bootstrap only checks presence; it does not reconfigure auth.

command -v pi
# Follow current exe.dev / Shelley docs if login is required on your image

Stock LazyVim starter is cloned to ~/.config/nvim. Plugin install happens on first open:

nvim
# Wait for lazy.nvim to fetch plugins; quit when finished (:q)

Fonts: icons need a Nerd Font in your local terminal (or VS Code remote terminal font), not on the VM.

Installed non-interactively (no setup questions during ./install):

• Binary via mise (fallback: official setup --non-interactive)
• Local history: atuin import auto once per machine (marker under ~/.local/state/exe-bootstrap/)
• Shell hook: eval "$(atuin init zsh)" in managed ~/.zshrc
• Cloud sync is not configured during install

Optional later:

atuin register    # new Atuin Cloud account
atuin login       # existing account
atuin sync

Do not put secrets in .zshrc or this git repo.

Typical first-time flow (after age key exists):

# In a project or in ~/.config/fnox/
fnox init
fnox provider add age --id main --recipients "$(grep 'public key:' ~/.config/fnox/age.txt | awk '{print $NF}')"
fnox secret set SOME_API_KEY --provider main   # prompts for value
fnox exec -- some-command                      # run with secrets
# Shell integration is already in .zshrc via: eval "$(fnox activate zsh)"

See config/fnox.toml.example and https://fnox.jdx.dev/.

Migrate keys that used to live in your Mac .zshrc (Gemini, Linear, Hetzner, etc.) into fnox, and rotate any key that was ever committed or pasted into chat.

Already set via linked home/.gitconfig:

Override per-repo with git config user.email ... if needed. Signing keys (GPG/SSH commit signing) are not configured — add manually if you use them.

npp    # cookiecutter https://github.com/robertguss/cookiecutter-modern-python-projects

Needs network; first run may prompt for template variables.

hk is on PATH after install. It does not enable hooks in every repo.

hk --version
cd your-project
hk install --mise    # attach hooks for this repo (needs project hk config)

See docs/hk.md and https://hk.jdx.dev/.

cd ~/exe-bootstrap   # or wherever you cloned
./doctor             # exit 1 if required checks fail

Use after every fresh install and when something “feels wrong.”

[ ] exec zsh  (or new SSH session)
[ ] ./doctor  (fix fails, fix until clean enough to work)
[ ] mise / node / nvim / grok / hk respond on PATH
[ ] Backed up ~/.config/fnox/age.txt offline
[ ] gh auth login  (if needed)
[ ] grok  — completed first-run auth
[ ] devin — completed first-run auth
[ ] nvim  — first launch finished plugin install
[ ] atuin import / login  (optional)
[ ] Moved API keys into fnox  (optional but recommended)
[ ] Nerd Font set on local terminal client
[ ] (per project) hk install --mise when you want hooks

Enabled list: config/modules.enabled (comment out a line to skip).

Modules are sourced in filename order. Each defines run().

1. Copy an existing file under modules/ → modules/XX-mytool.sh.
2. Implement run() using helpers from lib/common.sh (apt_install, have, log, ok, skip, link_file, …).
3. Add XX-mytool to config/modules.enabled.
4. For mise-managed CLIs, add a line to config/packages.cli and/or config/mise.toml.
5. Commit, push, run ./install or ./install --only XX-mytool.

1. Comment out or delete the id in config/modules.enabled.
2. Optionally delete the module file and drop tools from config/mise.toml / packages.cli.
3. Re-run install (does not always uninstall packages already on disk — remove manually if you need disk space).

exe-bootstrap/
├── install                 # entrypoint
├── doctor                  # health check (pass/warn/fail)
├── setup-exe.dev.sh        # optional thin first-boot (clone + install)
├── lib/common.sh           # logging, apt, symlink helpers
├── modules/                # numbered install steps
├── docs/                   # POST_INSTALL.md, hk.md, …
├── config/
│   ├── modules.enabled     # feature flags
│   ├── mise.toml           # languages + many CLIs
│   ├── packages.cli        # CLI list for 30-cli-tools
│   ├── omz-plugins.txt     # documentation of OMZ plugins
│   └── fnox.toml.example
├── home/
│   ├── .zshrc              # → ~/.zshrc
│   ├── aliases.zsh         # → ~/.aliases.zsh
│   ├── .gitconfig          # → ~/.gitconfig
│   └── starship.toml       # → ~/.config/starship.toml
└── README.md               # this file

Primary workflow is still SSH → clone → ./install.

If you later want auto-bootstrap on ssh exe.dev new:

# One-off for a new VM (script stays small; clones this public repo over HTTPS)
export EXE_BOOTSTRAP_REPO=https://github.com/robertguss/exe-bootstrap.git
cat setup-exe.dev.sh | ssh exe.dev new --setup-script /dev/stdin

Default setup-exe.dev.sh already uses the HTTPS URL.
Do not put secrets in the setup script. After boot, still do the P0/P1 steps (age backup, agent logins).

• This repo is public — never commit secrets, even “temporarily.”
• Never commit age.txt, .env, or API keys.
• .gitignore blocks common secret paths; double-check before git add -f.
• Rotate any credential that lived in plain shell config or chat logs.
• Prefer fnox (or exe.dev integrations) over export KEY=... in dotfiles.
• Git identity in home/.gitconfig is personal (name/email); forks should edit it.

Re-run everything safely:

cd ~/exe-bootstrap && git pull && ./install

• exe.dev docs
• exe.dev customization / setup scripts
• mise · fnox · aube
• Grok Build · Devin CLI
• LazyVim · herdr · starship · atuin

Personal bootstrap, public for easy cloning. Use/adapt as you like; no warranty.