Uses

The setup this is all built with. Written as rules rather than an inventory, because the useful part is why a tool sits where it does. A list of installed packages goes stale the week after it is published and never said much to begin with.

The split

One rule decides where a tool is installed. mise owns language runtimes and anything version-sensitive, so a project can pin what it needs. Homebrew owns everything else: system utilities, terminal apps, the container stack. There is exactly one deliberate exception, and it is the task runner: it has to come from mise, because the bootstrap script runs it before Homebrew exists.

Runtimes

Pinned per project, resolved on directory entry. Terraform tracks the 1.x line by major rather than latest, so a 2.0 release cannot arrive as a surprise mid-week. Python interpreters come from mise and packages from uv; no separate version manager is installed, because two things claiming to own the interpreter is a bad afternoon.

miseGoPythonNodeTerraformuv

Kubernetes

Day to day this is a terminal, not a dashboard. Manifests are schema-validated offline before they reach a cluster, which catches the class of mistake that otherwise fails during a rollout.

kubectlhelmk9skubectxkubeconformterragrunt

Secrets

No credential is ever written to disk. A template file holding references, not values, is committed to the repo; direnv resolves it through the 1Password CLI on entry to the directory and exports the results into that shell only. The resolved file does not exist. A secret scanner runs as a pre-commit hook regardless, because a rule that depends on nobody ever making a mistake is not a rule.

1Password CLIdirenvgitleakssopsage

Scaffolding

Project boilerplate is generated, never hand-written. A new project arrives with its task runner, tool versions, pre-commit config and CI already wired, because those are exactly the files that get written slightly differently every time and then drift. An audit command re-checks an existing project against the template and exits non-zero when something is missing.

justpre-commitstowgum

Containers

Colima rather than Docker Desktop. Same Docker socket, no licence question, no menu bar process, and the VM is a config file that can be thrown away and rebuilt.

Colimalazydocker

Shell

zsh, reloaded by replacing the process rather than re-sourcing the config, which is the only way to get a clean state. History is SQLite-backed and searchable rather than a flat file, and directory jumping is frecency-based, so the two things typed most often are the two that cost least.

zshoh-my-poshatuinzoxidefzfezabatripgrepfd

Git

Conventional commits everywhere, enforced by hook rather than by memory. Pulls rebase, rebases autostash and autosquash, fetches prune. Commits are signed with an SSH key. Diffs render syntax-aware, with a structural differ available for the changes where a line-based diff is noise.

gitdeltadifftasticlazygitghgit-cliffgoreleaser

Supply chain

Anything published under the open-source org is signed and scanned before it ships. Images and OCI charts are signed with cosign in keyless mode, so the identity is a workflow rather than a key somebody has to look after. Dependencies, images and the workflows themselves each get their own scanner.

cosigntrivyosv-scannerzizmorcheckov

Writing docs

Diagrams are text that compiles to SVG, so they live in the repository and change in a pull request. Terminal demos are scripted from a file rather than recorded live, which means they can be regenerated when output formats change instead of quietly describing an old version.

d2vhsasciinemaglowlycheetypos

This site

Static, no framework runtime shipped to the browser. Fonts are self-hosted, the security headers are generated at build time so their hashes cannot drift from what actually shipped, and a script checks every colour in the palette against WCAG contrast on every build.

AstroTailwindCloudflare Pagespa11ylychee

Nothing on this page names a vault, an item, a host or a credential. The patterns are public; what they hold is not.

← Back to the sheet