Authored once, everywhere
Core lives in one repo and is vendored into every OS repo via git subtree. No N-way reconciliation, no drift — edit once, sync out.
~/dotgibson · layered ecosystem
One Core.
One Core.
Every machine.
clone-and-go.
A portable, layered dotfiles system. A single vendored Core — zsh, tmux, Neovim, git, starship, mise — shared across every box, with thin OS-native layers per platform and operator role layers — offensive for Kali, defensive for Defense. Audited, benchmarked, reproducible.
No install — launch the Kali environment in your browser (opens in a new tab) a Codespace boots straight into the offensive shell — htp, ipp, lhost, ttyup live
- ∞machines
- 3layers
- 1vendored Core
- 0submodule flags
# clone — Core is already vendored, no flags
$git clone …/dotfiles-MacBook ~/df && cd ~/df
$./bootstrap.sh --links-only --dry-run
✓ plan: 24 symlinks, 0 conflicts
$./bootstrap.sh
✓ Homebrew · brew bundle · symlinks
$exec zsh
~/df on main via v22
- 10
- public repos
- one Core, vendored everywhere
- 3
- clean layers
- Core · OS-native · Role
- 13
- Core zsh modules
- one canonical load order
- 3,158
- lines of Core zsh
- authored once, synced out
- 57
- git aliases
- OMZ-style, in git.zsh
- 7
- SHA-pinned plugins
- no floating master clones
Core 2.6.0 · derived from source on 2026-07-01
Why it’s built this way
A system, not a pile of config
Ten repositories, one philosophy: if it changes with the operating system it isn’t Core; if it changes with you as an operator it isn’t Core. Everything left over is Core — and it lives in exactly one place.
Clone-and-go
Subtree vendors the actual files, so a fresh clone just works. No submodule init, no flags. Perfect for public portfolio repos.
Same shell, every OS
The zsh module chain loads in one canonical order on macOS, Linux, and WSL — PowerShell mirrors it. Muscle memory transfers everywhere.
Audited & benchmarked
A manifest-driven audit gate, hermetic behavioral tests, pinned plugin SHAs, and a startup-perf budget keep every sync honest.
Three clean layers
Core (identical everywhere), OS-native (changes with the OS), and Role (offensive scaffolding for Kali, defensive tooling for Defense). Every file has exactly one home.
Discoverable by design
core-help cheat sheets, core-doctor health checks, did-you-mean command handling, and first-party completions for every verb.
The three-layer model
Core → OS-native → Role
Each layer answers a different question. Drawing the boundary precisely is what lets one Core serve every machine without special-casing.
01
Core
zsh modules, tmux base, Neovim, git, starship, mise, clip. Vendored into each OS repo under core/ — except Windows, which replicates it natively.
02
OS-native
Package manager, paths, clipboard backend, OS tmux/git tweaks. One thin layer per platform.
03
Role
Operator tooling stacked on an OS layer — offensive on Kali, defensive (detections, hunt/triage) on Defense.
The fleet
Repository map
Ten repositories are public today — one Core, vendored into eight of the nine machine repos (Windows replicates Core natively in PowerShell). Each card links straight to its repo, with live stars, last-push, and CI status pulled from GitHub at build time.
Core Stable
◆ dotfiles-core
The keystone. Single source of truth for everything identical on every machine — shell modules, tmux base, Neovim, git, starship, mise.
★ 0
⟳ today ● CI
View on GitHub ↗
OS-native Stable
⌘ dotfiles-MacBook
macOS (Apple Silicon / Intel) terminal environment. Homebrew + brew bundle, Ghostty, 1Password agent, native pbcopy clipboard — plus a committed tiling-desktop layer: AeroSpace, SketchyBar, and Karabiner.
★ 0
⟳ today ● CI
64 pkgs
View on GitHub ↗
Native host Stable
⊞ dotfiles-Windows
The native Windows host: PowerShell 7 as daily driver, Windows Terminal, scoop/winget, psmux, and the bridge into WSL2.
★ 0
⟳ today ● CI
View on GitHub ↗
Role Stable
⚔ dotfiles-Kali
The Kali node — Core + apt OS layer + a unique offensive role layer for authorized engagements.
★ 0
⟳ today ● CI
29 pkgs
+ 34 offensive View on GitHub ↗
Role Stable
⛨ dotfiles-Defense
The blue mirror of Kali — the defensive role. Detection engineering & investigation: hunt/triage tooling, version-controlled detection content (Sigma, Sysmon, Zeek/Suricata, SIEM), and a Dockerized detection lab. Distro-agnostic.
★ 1
⟳ today ● CI
View on GitHub ↗
OS-native Stable
◉ dotfiles-Fedora
The Linux template every other distro repo is stamped from. dnf + RPM Fusion, Flathub, Wayland clipboard, SELinux helpers.
★ 0
⟳ today ● CI
31 pkgs
View on GitHub ↗
OS-native Stable
▲ dotfiles-Arch
Rolling-release Arch. pacman + AUR + multilib, with a bare-metal stage-0 SETUP guide for a minimal install.
★ 0
⟳ today ● CI
36 pkgs
View on GitHub ↗
OS-native Stable
❖ dotfiles-openSUSE
zypper with the best dependency solver of the bunch. Packman, AppArmor, Btrfs/snapper, Tumbleweed (dup) + Leap (up) aware.
★ 0
⟳ today ● CI
30 pkgs
View on GitHub ↗
OS-native Stable
❄ dotfiles-Alpine
The lean outlier: musl libc, busybox, doas. The small-footprint / container / rescue layer — bootstrap detects doas vs sudo.
★ 0
⟳ today ● CI
32 pkgs
View on GitHub ↗
OS-native Stable
◢ dotfiles-Gentoo
Source-based capstone. emerge + full category/name atoms + USE flags — the most educational build in the fleet.
★ 0
⟳ today ● CI
30 pkgs
View on GitHub ↗
Try it
Up and running in three commands
Pick your platform, clone, bootstrap. The installer is idempotent and ships a dry-run so you can preview every change before it touches your machine.
Build your install command
Pick a platform, toggle the options you want — get the exact command: clone the repo and run its idempotent bootstrap, so you can read everything first. No curl | bash; every flag is one the bootstrap actually accepts.