diff --git a/.chezmoi.toml.tmpl b/.chezmoi.toml.tmpl index 7926e81f..948e3ec8 100644 --- a/.chezmoi.toml.tmpl +++ b/.chezmoi.toml.tmpl @@ -4,6 +4,7 @@ {{- $gitName := promptStringOnce . "name" "Enter your full name for Git" -}} {{- $gitEmail := promptStringOnce . "email" "Enter your email for Git" -}} {{- $accessToken := promptStringOnce . "bwsAccessToken" "Enter your BWS Access Token" -}} +{{- $coderUsername := promptStringOnce . "coderUsername" "Enter your Coder deployment username (used in the VS Code remote.SSH.remotePlatform host key)" -}} {{- $editor := or (env "EDITOR") "vim" -}} # Set values in the data section @@ -12,6 +13,7 @@ email = {{ $gitEmail | quote }} editor = {{ $editor | quote }} bwsAccessToken = {{ $accessToken | quote }} + coderUsername = {{ $coderUsername | quote }} [diff] command = "diff" diff --git a/.github/workflows/full-apply-test.yaml b/.github/workflows/full-apply-test.yaml index 29b1f603..111ee2a8 100644 --- a/.github/workflows/full-apply-test.yaml +++ b/.github/workflows/full-apply-test.yaml @@ -48,7 +48,9 @@ jobs: # prove real Bitwarden Secrets Manager resolution works, which requires a real # bwsAccessToken on a real machine (see DESIGN.md's "CI can't be the full story"). run: | - grep -rl 'bitwardenSecrets' . --include='*.tmpl' --include='*.toml' | xargs -r sed -i 's|{{ (bitwardenSecrets "[^"]*" .bwsAccessToken).value }}|fake-test-value|g' + # -Z/-0: NUL-delimited, so paths with spaces (e.g. "private_Application Support") + # survive the grep -> xargs handoff intact instead of being word-split. + grep -rlZ 'bitwardenSecrets' . --include='*.tmpl' --include='*.toml' | xargs -0 -r sed -i 's|{{ (bitwardenSecrets "[^"]*" .bwsAccessToken).value }}|fake-test-value|g' - name: Install chezmoi run: | @@ -64,6 +66,7 @@ jobs: name = "CI Test" email = "ci@example.com" bwsAccessToken = "unused-fake-token" + coderUsername = "ci-test" EOF - name: chezmoi init --apply (first-time bootstrap) diff --git a/private_Library/private_Application Support/private_Code/User/settings.json b/private_Library/private_Application Support/private_Code/User/settings.json.tmpl similarity index 63% rename from private_Library/private_Application Support/private_Code/User/settings.json rename to private_Library/private_Application Support/private_Code/User/settings.json.tmpl index 8408374d..107c69f7 100644 --- a/private_Library/private_Application Support/private_Code/User/settings.json +++ b/private_Library/private_Application Support/private_Code/User/settings.json.tmpl @@ -38,18 +38,64 @@ // Increase delay before showing code completion suggestions (default: 10ms) "editor.suggestDelay": 3000, "editor.suggest.preview": true, - // Prevent extensions from automatically updating in the background - "extensions.autoUpdate": true, + // Prevent extensions from automatically updating in the background. + // "off" (not boolean false) matches the current extensions.autoUpdate schema -- VS Code + // migrates a legacy boolean to "on"/"off" automatically, but writing the string directly + // avoids relying on that migration (and an in-place rewrite of this chezmoi-managed file). + "extensions.autoUpdate": "off", + "extensions.autoCheckUpdates": false, "files.autoSave": "afterDelay", "files.autoSaveDelay": 300, - // Exclude large directories from file watching to reduce I/O and CPU load + // Exclude large/generated directories from file watching to reduce I/O and CPU load. + // The remote (Coder workspace) home holds an 11 GB ~/.vscode-server tree that VS Code + // would otherwise watch recursively (including itself), plus a Homebrew symlink farm and + // every installed mise toolchain version -- none of these are ever hand-edited. "files.watcherExclude": { "**/.git/objects/**": true, "**/.git/subtree-cache/**": true, "**/node_modules/**": true, "**/dist/**": true, - "**/build/**": true + "**/build/**": true, + "**/.vscode-server/**": true, + "**/.linuxbrew/**": true, + "**/.local/share/mise/**": true, + "**/.terraform/**": true, + "**/.cache/**": true, + "**/.cargo/**": true, + "**/go/pkg/**": true, + "**/.claude/**": true, + "**/target/**": true, + "**/vendor/**": true, + "**/.venv/**": true }, + // Same directories as files.watcherExclude -- keep full-text search from indexing them too. + "search.exclude": { + "**/.git/objects/**": true, + "**/.git/subtree-cache/**": true, + "**/node_modules/**": true, + "**/dist/**": true, + "**/build/**": true, + "**/.vscode-server/**": true, + "**/.linuxbrew/**": true, + "**/.local/share/mise/**": true, + "**/.terraform/**": true, + "**/.cache/**": true, + "**/.cargo/**": true, + "**/go/pkg/**": true, + "**/.claude/**": true, + "**/target/**": true, + "**/vendor/**": true, + "**/.venv/**": true + }, + // Homebrew/mise symlink farms make plain (non-excluded) symlink traversal expensive. + "search.followSymlinks": false, + // Cap the TypeScript server's heap instead of leaving it unbounded. + "typescript.tsserver.maxTsServerMemory": 2048, + "typescript.disableAutomaticTypeAcquisition": true, + // Reduce the git extension's background repository scanning. + "git.autoRepositoryDetection": "openEditors", + "git.repositoryScanMaxDepth": 1, + "git.autofetch": false, "telemetry.telemetryLevel": "off", "window.restoreWindows": "preserve", "window.zoomLevel": 0, @@ -59,9 +105,21 @@ "workbench.list.smoothScrolling": false, "remote.SSH.connectTimeout": 1800, + // Host key matches the "coder-vscode.----." format + // that the Coder VS Code extension's SSH authority parser actually produces (verified against + // coder/vscode-coder's src/util/authority.ts). A second, differently-shaped entry that used + // to live here (a "----" tail instead of ".") does not parse under + // that scheme -- it predates the current extension version and was dropped rather than + // templated (dotfiles#772). "remote.SSH.remotePlatform": { - "coder-vscode.coder.homelab.nikara.net--ppat--peter--main": "linux", - "coder-vscode.coder.homelab.nikara.net--peter--peter.main": "linux" + "coder-vscode.coder.{{ (bitwardenSecrets "288eeda0-d57f-4a91-8651-b2090163ecc0" .bwsAccessToken).value }}--{{ .coderUsername }}--{{ .coderUsername }}.main": "linux" + }, + // APPLICATION/WINDOW-scoped in VS Code's own configuration registry (never MACHINE or + // MACHINE_OVERRIDABLE), so it must live in this file -- the remote Machine settings file + // parses only [MACHINE, MACHINE_OVERRIDABLE] scopes and silently drops anything else. + "remote.extensionKind": { + "vscode-icons-team.vscode-icons": ["ui"], + "bierner.markdown-mermaid": ["ui"] }, "remote.SSH.defaultExtensions": [ "bierner.markdown-mermaid", diff --git a/private_dot_local/bash/limits.bash b/private_dot_local/bash/limits.bash new file mode 100644 index 00000000..63a00067 --- /dev/null +++ b/private_dot_local/bash/limits.bash @@ -0,0 +1,7 @@ +# The Coder workspace memory watchdog (coder repo: script-memory-watchdog.sh) stamps a soft +# RLIMIT_DATA on the VS Code server tree via prlimit to keep it from re-approaching the +# container's memory.max. Terminals forked from ptyHost inherit that soft limit. The watchdog +# deliberately leaves the hard limit at "unlimited" specifically so a shell can restore itself -- +# do that here, every time an interactive shell starts, rather than requiring the operator to +# notice and fix it by hand. +ulimit -d unlimited 2>/dev/null || true