| 1 |
# 10. The shell |
| 2 |
|
| 3 |
Your login shell is **nushell**. Its pipelines carry structured data rather |
| 4 |
than lines of text, so `ls | where size > 10mb | sort-by modified` is a whole |
| 5 |
pipeline and not an awk exercise. |
| 6 |
|
| 7 |
bash is untouched at `/bin/sh` and `/bin/bash`. Nothing that runs a shell |
| 8 |
script cares which login shell you use, so the `curl | sh` pattern and every |
| 9 |
system script behave exactly as they would anywhere else. If you want bash |
| 10 |
back: |
| 11 |
|
| 12 |
chsh -s /bin/bash |
| 13 |
|
| 14 |
## What is already wired up |
| 15 |
|
| 16 |
- **starship** draws the prompt. |
| 17 |
- **zoxide** tracks directories you visit, so `z alloy` lands in that project |
| 18 |
from anywhere. |
| 19 |
- **direnv** loads a directory's `.envrc` when you enter it and unloads it when |
| 20 |
you leave. After editing an `.envrc`, run `direnv-reload`. |
| 21 |
|
| 22 |
All three are live at first login with nothing to set up. |
| 23 |
|
| 24 |
## Aliases |
| 25 |
|
| 26 |
A short list, in `~/.config/nushell/aliases.nu`: |
| 27 |
|
| 28 |
|
| 29 |
|
| 30 |
| `ll`, `la` | `ls -la`, `ls -a` | |
| 31 |
| `..`, `...`, `....` | Up one, two, three directories | |
| 32 |
| `gs` `gd` `ga` `gc` `gp` `gl` | git status, diff, add, commit, push, log | |
| 33 |
| `vim`, `vi` | `hx` | |
| 34 |
| `du` | `dua interactive` | |
| 35 |
| `top` | `btm` | |
| 36 |
|
| 37 |
It is meant to stay short. If the file grows past about thirty lines, the next |
| 38 |
alias probably has not earned its place. |
| 39 |
|
| 40 |
## Config |
| 41 |
|
| 42 |
|
| 43 |
|
| 44 |
| `~/.config/nushell/env.nu` | Environment: `EDITOR`, cursor theme, paths | |
| 45 |
| `~/.config/nushell/config.nu` | Shell behaviour | |
| 46 |
| `~/.config/nushell/aliases.nu` | The list above | |
| 47 |
| `~/.config/starship.toml` | Prompt | |
| 48 |
|
| 49 |
Note that nushell is not bash: `export FOO=bar` is `$env.FOO = "bar"`, and |
| 50 |
command substitution is `(...)` rather than backticks. Its own book covers the |
| 51 |
differences, and the migration is smaller than it looks because scripts keep |
| 52 |
running under bash. |
| 53 |
|
| 54 |
## Becoming root |
| 55 |
|
| 56 |
run0 <command> |
| 57 |
|
| 58 |
`run0` is systemd's, and it is what Alloy documents instead of `sudo`. It |
| 59 |
authenticates through polkit rather than by setuid, and it runs the command in |
| 60 |
a fresh session rather than in your shell's. |
| 61 |
|
| 62 |
`sudo` still exists; nothing removes it. Alloy just does not build habits |
| 63 |
around it. |
| 64 |
|
| 65 |
## Secrets |
| 66 |
|
| 67 |
Two different jobs, and they get confused for each other constantly: |
| 68 |
|
| 69 |
- **gnome-keyring** is the Secret Service provider. It is what programs call |
| 70 |
when they need to store a credential. You do not use it directly; it is there |
| 71 |
so applications that expect it work. |
| 72 |
- **gopass** is where you keep your own logins. It uses an age identity for |
| 73 |
encryption and git for syncing, so a store is a git repository of ciphertext |
| 74 |
and a concurrent edit is a merge conflict rather than a silently duplicated |
| 75 |
file. |
| 76 |
|
| 77 |
Alloy provisions neither with any content. `gopass init` sets up a store when |
| 78 |
you want one, and the age identity that decrypts it should never live in the |
| 79 |
repository it decrypts or travel with it. |
| 80 |
|
| 81 |
`gopass show -c` copies a password to the clipboard, and Alloy keeps that copy |
| 82 |
out of the clipboard history that `Mod+Shift+V` reads. That is not automatic |
| 83 |
anywhere else. It works here because gopass is pointed at `alloy-secret-copy`, |
| 84 |
which marks the selection private, and the watchers skip anything so marked. Nothing to configure, and the reason it is worth knowing is |
| 85 |
the limit: this keeps passwords out of the history *on disk*, and any program |
| 86 |
running as you can still read the clipboard while the password is on it. Paste |
| 87 |
it and move on rather than leaving it there. |
| 88 |
|
| 89 |
That identity lives on the machine, under `~/.config/gopass/age/`. Run `gopass |
| 90 |
config` to see the paths your install is actually using rather than trusting |
| 91 |
this page. It matters because it is the one part of the store that is not in |
| 92 |
git: clone the repository onto a new machine and you have every password in |
| 93 |
ciphertext and no way to read any of it. Copy the identity across yourself, by |
| 94 |
hand, over a channel that is not the one carrying the store. Chapter 14 covers |
| 95 |
the case where the machine is already gone. |
| 96 |
|