One shell source
Load shared aliases and functions from the repository through a small idempotent profile hook.
Local first · encrypted by default
Make a workstation repeatable without copying its secrets.
Settings keeps shared Bash aliases and functions in source control while machine-specific values stay local. It also creates opt-in, AES-256 encrypted backups of only the paths you explicitly select.
BashGnuPGlaunchd / cron
settingsctl status
Repository: ~/src/settings
Targets: 6 configured
Destination: ~/Backups
Retention: 30 days
Schedule: active (launchd)
verified_user
Encrypted backup complete
6 targets · AES-256 · local archive
Two focused jobs
Shared configuration. Private state.
Fast-forward updates
settings-sync updates the clone and reloads shared shell behavior in the current session.
Encrypted or nothing
The backup worker refuses to retain an unencrypted archive and uses GnuPG symmetric AES-256.
Explicit targets only
No home-directory scan: the tool protects only paths deliberately added to the local target list.
Native scheduling
Install a daily per-user launchd agent on macOS or a user crontab entry on other systems.
Visible audit trail
Review recent backup outcomes and missing targets through the CLI or the local dashboard.
Management CLI
One command surface.
settingsctl status — configuration and activity
settingsctl backup — encrypted backup now
settingsctl schedule — daily automation
settingsctl serve — local dashboard
Browser boundary
Useful visibility, limited authority.
The dashboard binds only to 127.0.0.1. It can display the latest activity and edit the opt-in target list, but it does not expose the passphrase, archive contents, or an action that runs backups from the browser.
$ settingsctl serve
open http://127.0.0.1:8765
Recovery rule
The passphrase belongs somewhere else.
Backups and credentials stay outside Git. The encryption passphrase should also stay separate from the backup destination; losing it makes the archives unrecoverable, so the project explicitly recommends testing a restore before relying on the system.