hako

README

hako

Pack your configs in a box, unpack them on any machine.

hako is a CLI tool that syncs your dotfiles (SSH config, git settings, shell profiles, etc.) across multiple machines with encryption and change tracking.

Features

• Multi-backend sync — Git today, cloud storage tomorrow. Your dotfiles aren't locked to one transport.
• Encryption built in — Protect sensitive files (SSH keys, tokens) with per-file encryption.
• Intelligent merge — SSH config and gitconfig are merged at block/section level, not full-file replacement.
• Profile-aware — Different files for different machines. One store, multiple setups.

Quickstart

# Set up a new store
hako init git@github.com:you/hako-store.git

# Start tracking files
hako add ~/.ssh/config
hako add ~/.ssh/id_ed25519 --encrypt
hako add ~/.gitconfig

# Sync
hako sync

On another machine:

hako init git@github.com:you/hako-store.git
hako sync

Installation

Download binary

Download the latest release for your platform from GitHub Releases and add it to your PATH.

Available platforms: Linux (amd64, arm64), macOS (amd64, arm64), Windows (amd64, arm64)

Usage

Initialize

# Connect to a repository (auto-detects new or existing store)
hako init git@github.com:you/hako-store.git

Track files

# Add a file
hako add ~/.gitconfig

# Add with encryption
hako add ~/.ssh/id_ed25519 --encrypt

# Add for a specific machine only
hako add ~/.config/work/settings.json --profile work-macbook

# Stop tracking
hako remove ~/.ssh/known_hosts

Sync

# Interactive sync (pull then push, with review)
hako sync

# Non-interactive (CI/scripts)
hako sync --yes

Status and list

# Show sync status
hako status

# List tracked files
hako list

Configuration

# View all settings
hako config list

# Get/set a value
hako config get hostname
hako config set hostname work-macbook

# Manage encryption recipients
hako config add-recipient age1...

How It Works

hako stores your dotfiles in ~/.hako/:

~/.hako/
├── config          # Local settings (not synced)
├── secret          # Encryption private key (not synced, 0600)
├── state           # Last sync hashes (not synced)
└── store/          # Synced via git (or other remotes)
    ├── .hako/
    │   ├── shared      # Shared settings (remote URL, recipients)
    │   └── manifest    # Tracked file list
    ├── c687721b107f    # Stored files (hash-based flat structure)
    └── 1c856a059138

Files are copied between their original location and the store. Each file is stored with a hash-based filename — the manifest maps source paths to store entries. Encrypted files are stored as age ciphertext.

License

MIT