The alias to invoke ssh with tmux is ssht: ssht srv.

When running locally tmux uses the standard prefix: Ctrl+b. If you are running a remote session from a local session press Ctrl+b twice to send commands to the remote session. For example, to detach from the remote session, but not the local one: Ctrl+b Ctrl+b d.

When running tmux for the first time, install plugins by pressing Prefix+I. To update plugins, press Prefix+U. Note that I and U are uppercase.

See "Kitty terminal" below if you run Kitty with tmux remotely.

Why Micro? It is small, TUI-based, available in system repositories, and uses natural GUI-like keybindings (Ctrl+C/V/X, Ctrl+S, Ctrl+Q) — no modal editing to learn. It is extensible with plugins (fzf, prettier) and a good fit for users coming from GUI editors. Vim is also installed as a fallback (universal on servers), but Micro is the daily driver set in EDITOR and VISUAL.

Currently installed plugins (including the default ones) can be listed using:

mic -plugin list

The list of recommended plugins can be found here: ~/.config/micro/plugins.txt.

The prettier plugin is installed manually: https://github.com/claromes/micro-prettier

Consider its cousin for Python: https://github.com/claromes/micro-yapf

The rest of plugins (excluding default plugins) are installed using:

mic -plugin install fzf

Links on customization:

• https://claromes.com/blog/customizing-my-micro-editor.html

See for details on installing: https://sw.kovidgoyal.net/kitty/binary/

tmux will complain that xterm-kitty is unknown. The solution is to copy .terminfo to the remote server: Tmux under Kitty terminal.

Example:

scp -r ~/.terminfo REMOTE:~./terminfo

Where REMOTE is the remote server you are copying .terminfo to.

Another (better) solution is to install kitty-terminfo system-wide, which solves the problem for other users including the super user:

# on Debian
sudo apt install kitty-terminfo

I used the following articles as a guidance:

• https://www.howtogeek.com/improve-ubuntu-without-using-the-terminal/
• https://www.howtogeek.com/i-always-install-these-gnome-extensions-on-my-linux-computers/

This is the list of user-installed extensions I use:

• ArcMenu, moderately useful, usually disabled
• Clipboard History
• Dash to Dock — doesn't work for me, sometimes locks GNOME (?), disabled
• Dash to Panel — not sure I like how it works, disabled
• GSConnect — sometimes not available in newer versions
• Just Perfection
• LAN IP Address
• Tray Icons: Reloaded
• Vitals — useful, but I usually disable it on low-powered systems

A local extension to show username@hostname is included.

The best way is to install it on Linux via PPA:

• https://connectwww.com/how-to-install-makemkv-on-ubuntu-mkv-converter/61127/

Non-interactive tools like playbash, upd -y, and cln -y need sudo to run without a password prompt. There are two paths:

run_onchange_after_install-sudoers.sh.tmpl writes /etc/sudoers.d/chezmoi with NOPASSWD rules tailored to the platform:

The script:

• Skips itself if the user has no sudo access
• Validates with visudo -cf before installing
• Installs with mode 0440, owner root:root (Linux) or root:wheel (macOS)
• Is idempotent — re-runs only when the rendered rules change

To remove:

sudo rm /etc/sudoers.d/chezmoi

doas is not installed by default. If you prefer doas (smaller config syntax, less surface area than sudo), install it manually:

sudo apt install opendoas         # Debian/Ubuntu
# RHEL/Fedora: not packaged; build from source if needed

Once doas is installed, run_onchange_after_install-doas.sh.tmpl manages /etc/doas.conf on the next chezmoi apply. The full configuration looks like:

permit persist keepenv setenv { PATH XAUTHORITY LANG LC_ALL } :sudo

permit nopass :sudo cmd apt args update
permit nopass :sudo cmd apt args upgrade
permit nopass :sudo cmd apt args -y upgrade
permit nopass :sudo cmd apt args upgrade -y
permit nopass :sudo cmd apt args autoremove
permit nopass :sudo cmd apt args -y autoremove
permit nopass :sudo cmd apt args autoremove -y
permit nopass :sudo cmd apt args autoclean
permit nopass :sudo cmd apt args -y autoclean
permit nopass :sudo cmd apt args autoclean -y

permit nopass :sudo cmd snap args refresh

permit nopass :sudo cmd ping
permit nopass :sudo cmd prettyping

permit nopass :sudo cmd aa-remove-unknown

permit nopass :sudo cmd systemctl args restart docker
permit nopass :sudo cmd systemctl args restart containerd

These maintenance-workflow commands:

• aa-remove-unknown is run by upd/cln when apt upgrades AppArmor, and by dcm as a fail-safe retry when a docker operation hits an AppArmor-related error. See Playbash Server Management for the full story.
• systemctl restart docker / systemctl restart containerd are used by upd --restart-services (alias upd -r) to recover from a docker-ce upgrade without a full reboot.

If doas is available and /etc/doas.conf exists, it is aliased as sudo in .bash_aliases. Both sudoers.d and doas rules are installed and coexist safely — the alias means sudo calls go through doas at the shell level, while the sudoers rules remain as a fallback for contexts where the alias isn't active (e.g., cron, non-interactive shells).

For more details see:

• https://wiki.debian.org/Doas
• https://manpages.debian.org/bookworm/opendoas/doas.1.en.html
• https://manpages.debian.org/bookworm/opendoas/doas.conf.5.en.html

See: https://wiki.archlinux.org/title/Etckeeper

I add manually *.mount to /etc/.gitignore:

sudoedit /etc/.gitignore

# mosh
sudo ufw allow 60000:61000/udp
# et
sudo ufw allow 2022/tcp

On Linux we can install with apt (or other system package manager) the following packages:

• texlive — the core of TeX + most common TeX/LaTeX packages.
• texworks — the GUI editor for TeX files.
• texmaker — the GUI editor for TeX files.
• latexmk — the utility to run process iteratively in multiple passes. Useful for getting labels and pages correctly.

On Mac texlive is available with brew.

One of popular choices of mutiplatform GUI editors is LyX.

This system does not install TeX by default.

On Debian/Ubuntu, installing texmaker or texlive-full pulls in asymptote, which has Depends: imagemagick (hard, not Suggests). The chezmoi-managed brew migration installs ImageMagick 7 under /home/linuxbrew/.linuxbrew/bin/; on TeX-enabled hosts, apt's ImageMagick stays installed as asymptote's library backend and brew's magick/convert win on PATH via brew shellenv. The two coexist without conflict.

Flatpak has an annoying issue with permissions. Everything works locally, but when run remotely via ssh it starts to ask for password on every operation several times per item it processes.

The solution is a polkit rule that authorizes org.freedesktop.Flatpak.* for members of sudo (Debian family) or wheel (everyone else). Unlike the stock rules (/usr/share/polkit-1/rules.d/org.freedesktop.Flatpak.rules), it doesn't require an active/local session and doesn't list individual operations by name.

Deployed automatically by chezmoi on GUI hosts with flatpak installed via run_onchange_after_install-flatpak-polkit.sh.tmpl. The script writes /usr/local/share/polkit-1/rules.d/90-flatpak-ssh.rules, reloads polkit, and is idempotent. To change the authorized groups, edit the $sudoerGroups list in that template.

The flatpak-install utility consumes this rule to decide whether a --system install is viable non-interactively; non-sudoers fall back to --user scope.

The rendered rule:

polkit.addRule(function (action, subject) {
  if (
    action.id.indexOf('org.freedesktop.Flatpak.') == 0 &&
    (subject.isInGroup('sudo') || subject.isInGroup('wheel'))
  ) {
    return polkit.Result.YES;
  }
  return polkit.Result.NOT_HANDLED;
});

For some reason Chrome packaged as Flatpak cannot print to actual printers. Only to PDF. Apparently it needs some additional permissions (can be set by Flatseal):

• Printing system (under Socket) socket=cups is set by default.
• All user files (under Filesystem) filesystem=home should be set.

Other custom settings I use:

• Other files (under Filesystem):
  • ~/.local/share/icons
  • ~/.local/share/applications
• GPU acceleration (under Device) device=dri.

For some reason GNOME CUPS tools have problems: they set up a network printer but it is very slow. Sources recommend to use native CUPS utilities to set it up. For example, use "Administration" on https://localhost:631