Chef Infra

chef

A powerful automation platform that transforms infrastructure into code, automating how it is configured, deployed and managed.

Detected by chef, knife, chef-client, chef-solo, chef-apply | macOS, Linux, Windows |www.chef.io

Sync it chef.toml

Sync rules

What travels, what stays, what never leaves

Synced2 paths, copied whole to your other machines

~/.chef/config.rb

~/.chef/knife.rb

Never synced2 credential paths, never uploaded in any form

~/.chef/credentials

~/.chef/*.pem

Otty extracts these into your secret store instead of syncing the files. Every generated manager config below leaves them out too.

Stays on this machineInside a file that otherwise syncs

~/.chef/config.rblines starting with client_key, validation_key, cookbook_path, chef_repo_path

# Chef Infra workstation configuration.

node_name 'octocat'

client_key '/home/octocat/.chef/octocat.pem'machine-local

validation_client_name 'example-validator'

validation_key '/home/octocat/.chef/example-validator.pem'machine-local

chef_server_url 'https://chef.example.com/organizations/example'

chef_repo_path '/home/octocat/code/chef-repo'machine-local

cookbook_path ['/home/octocat/code/chef-repo/cookbooks']machine-local

ssl_verify_mode :verify_peer

Otty splits these out before upload and puts each machine’s own back on the way down — no templates to write. The lines above come from this tool’s test fixture in the catalog.

Stays on this machineInside a file that otherwise syncs

~/.chef/knife.rblines starting with client_key, validation_key, cookbook_path, chef_repo_path

…

log_level :info

log_location STDOUT

node_name 'octocat'

client_key '/Users/octocat/.chef/octocat.pem'machine-local

validation_client_name 'example-validator'

validation_key '/Users/octocat/.chef/example-validator.pem'machine-local

chef_server_url 'https://chef.example.com/organizations/example'

chef_repo_path '/Users/octocat/code/chef-repo'machine-local

cookbook_path ['/Users/octocat/code/chef-repo/cookbooks']machine-local

knife[:editor] = 'vim'

Otty splits these out before upload and puts each machine’s own back on the way down — no templates to write. The lines above come from this tool’s test fixture in the catalog.

Excluded

Nothing. Chef Infra writes no caches or state in your home directory.

Chef Infra in your home directory Every rule on this page, by file

# Chef Infra workstation configuration.

node_name 'octocat'

client_key '/home/octocat/.chef/octocat.pem'machine-local

validation_client_name 'example-validator'

validation_key '/home/octocat/.chef/example-validator.pem'machine-local

chef_server_url 'https://chef.example.com/organizations/example'

chef_repo_path '/home/octocat/code/chef-repo'machine-local

cookbook_path ['/home/octocat/code/chef-repo/cookbooks']machine-local

ssl_verify_mode :verify_peer

Each machine keeps its own copy of these.

…

log_level :info

log_location STDOUT

node_name 'octocat'

client_key '/Users/octocat/.chef/octocat.pem'machine-local

validation_client_name 'example-validator'

validation_key '/Users/octocat/.chef/example-validator.pem'machine-local

chef_server_url 'https://chef.example.com/organizations/example'

chef_repo_path '/Users/octocat/code/chef-repo'machine-local

cookbook_path ['/Users/octocat/code/chef-repo/cookbooks']machine-local

knife[:editor] = 'vim'

Each machine keeps its own copy of these.

· credentials Never synced

· *.pem Never synced

Only what the catalog names. A directory that syncs brings everything inside it except what is listed as excluded here.

apps/chef.tomlThe file this page is generated from

id = "chef"

name = "Chef Infra"

homepage = "https://www.chef.io"

description = "A powerful automation platform that transforms infrastructure into code, automating how it is configured, deployed and managed."

icon = "SimpleIcons:chef"

detect = ["chef", "knife", "chef-client", "chef-solo", "chef-apply"]

# chef-config/lib/chef-config/workstation_config_loader.rb, locate_local_config():

# the last candidate pair is "Look for $HOME/.chef/knife.rb" —

# `PathHelper.home(ChefUtils::Dist::Infra::USER_CONF_DIR) { |dot_chef_dir|

# candidate_configs << File.join(dot_chef_dir, "config.rb");

# candidate_configs << File.join(dot_chef_dir, "knife.rb") }`, where

# USER_CONF_DIR is ".chef". The earlier candidates are $KNIFE_HOME, the working

# directory and the nearest .chef directory above it — all per-project, not

# per-user, so they are not listed here.

# `PathHelper.home` builds the path from the user's home directory on every

# platform, so there is no separate Windows spelling: %USERPROFILE%\.chef and

# ~/.chef resolve to the same file.

paths = [

"~/.chef/config.rb",

"~/.chef/knife.rb",

]

exclude = []

# chef-config/lib/chef-config/mixin/credentials.rb, credentials_file_path():

# `PathHelper.home(ChefUtils::Dist::Infra::USER_CONF_DIR, "credentials")` —

# ~/.chef/credentials, parsed with Tomlrb. It is a TOML file of profiles, each

# holding a client_key (often the PEM inline) and the node name it belongs to,

# so it is a credential end to end. The .pem files beside it are the RSA private

# keys those profiles point at.

# ~/.chef/context is neither: credentials_profile() reads it for the name of the

# active profile, which is a per-session choice rather than configuration, so it

# is left out of paths entirely.

secret = [

"~/.chef/credentials",

"~/.chef/*.pem",

]

# knife.rb and config.rb are Ruby, read once per invocation.

side_effect = false

# Every one of these is an absolute path into this machine's filesystem —

# client_key and validation_key point at the .pem files above, cookbook_path and

# chef_repo_path at a checkout that lives somewhere else on the next laptop.

# node_name, chef_server_url and the editor settings are deliberately absent:

# those identify the user and their server, and are what a second machine needs

# to be set up the same way. Both files, or the lines only stay behind in

# whichever one the loader happened to find first. All four are the user's

# own — the key they were issued and the checkout they cloned — and all four

# have to be back in place before this workstation works again, so they are

# kept: backup.

[[machine_lines]]

file = ["~/.chef/config.rb", "~/.chef/knife.rb"]

match = { prefix = ["client_key", "validation_key", "cookbook_path", "chef_repo_path"] }

scope = "backup"

Use it with your dotfile manager

Same data, in the shape your tool already reads

Opens Otty and adds this tool to what it syncs

Opens otty://sync/add/chef. Otty ships with this catalog, so the link only has to name the tool — nothing is downloaded.

Every one of these keeps all credential files out. None of them splits client_key and validation_key for you — that part is Otty’s own sync, or a template you write by hand.