diff --git a/dotfiles/.local/share/chezmoi/home/.chezmoidata.yaml b/dotfiles/.local/share/chezmoi/home/.chezmoidata.yaml
index cfeb6937..a57d3044 100644
--- a/dotfiles/.local/share/chezmoi/home/.chezmoidata.yaml
+++ b/dotfiles/.local/share/chezmoi/home/.chezmoidata.yaml
@@ -28,6 +28,8 @@ softwarePackages:
       - sshpass
       - tmux
     pipx: ansibleconnect
+  aqua:
+    brew: aquaproj/aqua/aqua
   asciicinema:
     pipx: asciicinema
   astronvim:
diff --git a/dotfiles/.local/share/chezmoi/home/.chezmoiexternal.toml b/dotfiles/.local/share/chezmoi/home/.chezmoiexternal.toml
index b4d30c75..2ab2044b 100644
--- a/dotfiles/.local/share/chezmoi/home/.chezmoiexternal.toml
+++ b/dotfiles/.local/share/chezmoi/home/.chezmoiexternal.toml
@@ -88,7 +88,7 @@
     url = "https://gitlab.com/megabyte-labs/common/shared/-/raw/master/Taskfile.yml"
     refreshPeriod = "{{ $refreshPeriod }}"
 
-{{- if (not .host.headless) and (ne .chezmoi.os "windows") }}
+{{- if and (not .host.headless) (ne .chezmoi.os "windows") }}
 ### Neovim
 [".config/nvim"]
     type = "git-repo"
@@ -98,7 +98,7 @@
         args = ["--ff-only"]
 {{- end }}
 
-{{- if (eq .chezmoi.os "linux") and (not .host.headless) }}
+{{- if and (eq .chezmoi.os "linux") (not .host.headless) }}
 ### Rofi
 [".local/share/fonts/GrapeNuts-Regular.ttf"]
     type = "file"
diff --git a/dotfiles/.local/share/chezmoi/home/.chezmoiremove b/dotfiles/.local/share/chezmoi/home/.chezmoiremove
new file mode 100644
index 00000000..bf0a4cfa
--- /dev/null
+++ b/dotfiles/.local/share/chezmoi/home/.chezmoiremove
@@ -0,0 +1,20 @@
+.asdf
+Brewfile
+.bash_logout
+.cargo
+.dircolors
+.gitconfig
+.gitignore
+.gradle
+.inputrc
+.krew
+.m2
+.npmrc
+.rustup
+.subversion
+.tmux.conf
+.wgetrc
+.zlogin
+.zlogout
+.zprofile
+.zshrc.zwc
diff --git a/dotfiles/.local/share/chezmoi/home/.chezmoiscripts/archlinux/run_onchange_before_10_install-archlinux-packages.tmpl b/dotfiles/.local/share/chezmoi/home/.chezmoiscripts/archlinux/run_onchange_before_10_install-archlinux-packages.tmpl
new file mode 100644
index 00000000..7eb21311
--- /dev/null
+++ b/dotfiles/.local/share/chezmoi/home/.chezmoiscripts/archlinux/run_onchange_before_10_install-archlinux-packages.tmpl
@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+
+{{- $packages := splitList " " (includeTemplate "universal/essential-packages" .) }}
+{{- $pyenvDependencies := list
+"base-devel"
+"openssl"
+"zlib"
+"xz"
+"tk"
+}}
+{{- if .toolchains.python }}
+{{- $packages = concat $packages $pyenvDependencies -}}
+{{- end }}
+
+sudo packan -Sy --noconfirm --needed {{ $packages | sortAlpha | uniq | join " " -}}
diff --git a/dotfiles/.local/share/chezmoi/home/.chezmoiscripts/darwin/run_onchange_after_10_configure-darwin.tmpl b/dotfiles/.local/share/chezmoi/home/.chezmoiscripts/darwin/run_onchange_after_10_configure-darwin.tmpl
new file mode 100644
index 00000000..5364a0fd
--- /dev/null
+++ b/dotfiles/.local/share/chezmoi/home/.chezmoiscripts/darwin/run_onchange_after_10_configure-darwin.tmpl
@@ -0,0 +1,474 @@
+
+
+#!/usr/bin/env bash
+
+set -x
+
+# Close any open System Preferences panes, to prevent them from overriding
+# settings we’re about to change
+osascript -e 'tell application "System Preferences" to quit'
+
+###############################################################################
+# General UI/UX                                                               #
+###############################################################################
+
+# Disable automatic capitalization as it’s annoying when typing code
+defaults write NSGlobalDomain NSAutomaticCapitalizationEnabled -bool false
+
+# Disable smart dashes as they’re annoying when typing code
+defaults write NSGlobalDomain NSAutomaticDashSubstitutionEnabled -bool false
+
+# Disable automatic period substitution as it’s annoying when typing code
+defaults write NSGlobalDomain NSAutomaticPeriodSubstitutionEnabled -bool false
+
+# Disable smart quotes as they’re annoying when typing code
+defaults write NSGlobalDomain NSAutomaticQuoteSubstitutionEnabled -bool false
+
+# Disable auto-correct
+defaults write NSGlobalDomain NSAutomaticSpellingCorrectionEnabled -bool false
+
+###############################################################################
+# Trackpad, mouse, keyboard, Bluetooth accessories, and input                 #
+###############################################################################
+
+# Trackpad: enable tap to click for this user and for the login screen
+defaults write com.apple.driver.AppleBluetoothMultitouch.trackpad Clicking -bool true
+defaults -currentHost write NSGlobalDomain com.apple.mouse.tapBehavior -int 1
+defaults write NSGlobalDomain com.apple.mouse.tapBehavior -int 1
+
+# Trackpad: map bottom right corner to right-click
+defaults write com.apple.driver.AppleBluetoothMultitouch.trackpad TrackpadCornerSecondaryClick -int 2
+defaults write com.apple.driver.AppleBluetoothMultitouch.trackpad TrackpadRightClick -bool true
+defaults -currentHost write NSGlobalDomain com.apple.trackpad.trackpadCornerClickBehavior -int 1
+defaults -currentHost write NSGlobalDomain com.apple.trackpad.enableSecondaryClick -bool true
+
+# Disable press-and-hold for keys in favor of key repeat
+defaults write NSGlobalDomain ApplePressAndHoldEnabled -bool false
+
+# Set language and text formats
+defaults write NSGlobalDomain AppleLanguages -array "en" "ru"
+defaults write NSGlobalDomain AppleLocale -string "en_US@currency=USD"
+defaults write NSGlobalDomain AppleMeasurementUnits -string "Inches"
+defaults write NSGlobalDomain AppleMetricUnits -bool false
+
+###############################################################################
+# Screen                                                                      #
+###############################################################################
+
+# Require password immediately after sleep or screen saver begins
+defaults write com.apple.screensaver askForPassword -int 1
+defaults write com.apple.screensaver askForPasswordDelay -int 0
+
+# Save screenshots to the desktop
+defaults write com.apple.screencapture location -string "$HOME/Desktop"
+
+# Save screenshots in PNG format (other options: BMP, GIF, JPG, PDF, TIFF)
+defaults write com.apple.screencapture type -string "png"
+
+# Disable shadow in screenshots
+defaults write com.apple.screencapture disable-shadow -bool true
+
+# Enable subpixel font rendering on non-Apple LCDs
+# Reference: https://github.com/kevinSuttle/macOS-Defaults/issues/17#issuecomment-266633501
+defaults write NSGlobalDomain AppleFontSmoothing -int 1
+
+###############################################################################
+# Finder                                                                      #
+###############################################################################
+
+# Finder: allow quitting via ⌘ + Q; doing so will also hide desktop icons
+defaults write com.apple.finder QuitMenuItem -bool true
+
+# Finder: show all filename extensions
+defaults write NSGlobalDomain AppleShowAllExtensions -bool true
+
+# Finder: show status bar
+defaults write com.apple.finder ShowStatusBar -bool true
+
+# Finder: show path bar
+defaults write com.apple.finder ShowPathbar -bool true
+
+# Display full POSIX path as Finder window title
+defaults write com.apple.finder _FXShowPosixPathInTitle -bool true
+
+# Keep folders on top when sorting by name
+defaults write com.apple.finder _FXSortFoldersFirst -bool true
+
+# When performing a search, search the current folder by default
+defaults write com.apple.finder FXDefaultSearchScope -string "SCcf"
+
+# Disable the warning when changing a file extension
+defaults write com.apple.finder FXEnableExtensionChangeWarning -bool false
+
+# Enable spring loading for directories
+defaults write NSGlobalDomain com.apple.springing.enabled -bool true
+
+# Remove the spring loading delay for directories
+defaults write NSGlobalDomain com.apple.springing.delay -float 0
+
+# Avoid creating .DS_Store files on network or USB volumes
+defaults write com.apple.desktopservices DSDontWriteNetworkStores -bool true
+defaults write com.apple.desktopservices DSDontWriteUSBStores -bool true
+
+# Use list view in all Finder windows by default
+# Four-letter codes for the other view modes: `icnv`, `clmv`, `glyv`
+defaults write com.apple.finder FXPreferredViewStyle -string "Nlsv"
+
+# Expand the following File Info panes:
+# “General”, “Open with”, and “Sharing & Permissions”
+defaults write com.apple.finder FXInfoPanesExpanded -dict \
+	General -bool true \
+	OpenWith -bool true \
+	Privileges -bool true
+
+###############################################################################
+# Dock, Dashboard, and hot corners                                            #
+###############################################################################
+
+# Enable highlight hover effect for the grid view of a stack (Dock)
+defaults write com.apple.dock mouse-over-hilite-stack -bool true
+
+# Set the icon size of Dock items to 64 pixels
+defaults write com.apple.dock tilesize -int 64
+
+# Change minimize/maximize window effect
+defaults write com.apple.dock mineffect -string "scale"
+
+# Minimize windows into their application’s icon
+defaults write com.apple.dock minimize-to-application -bool true
+
+# Enable spring loading for all Dock items
+defaults write com.apple.dock enable-spring-load-actions-on-all-items -bool true
+
+# Show indicator lights for open applications in the Dock
+defaults write com.apple.dock show-process-indicators -bool true
+
+# Don’t animate opening applications from the Dock
+defaults write com.apple.dock launchanim -bool false
+
+# Speed up Mission Control animations
+defaults write com.apple.dock expose-animation-duration -float 0.1
+
+# Don’t group windows by application in Mission Control
+# (i.e. use the old Exposé behavior instead)
+defaults write com.apple.dock expose-group-by-app -bool false
+
+# Disable Dashboard
+defaults write com.apple.dashboard mcx-disabled -bool true
+
+# Don’t show Dashboard as a Space
+defaults write com.apple.dock dashboard-in-overlay -bool true
+
+# Don’t automatically rearrange Spaces based on most recent use
+defaults write com.apple.dock mru-spaces -bool false
+
+# Remove the auto-hiding Dock delay
+defaults write com.apple.dock autohide-delay -float 0
+# Remove the animation when hiding/showing the Dock
+defaults write com.apple.dock autohide-time-modifier -float 0
+
+# Automatically hide and show the Dock
+defaults write com.apple.dock autohide -bool false
+
+# Make Dock icons of hidden applications translucent
+defaults write com.apple.dock showhidden -bool true
+
+# Don’t show recent applications in Dock
+defaults write com.apple.dock show-recents -bool false
+
+# Hot corners
+# Possible values:
+#  0: no-op
+#  2: Mission Control
+#  3: Show application windows
+#  4: Desktop
+#  5: Start screen saver
+#  6: Disable screen saver
+#  7: Dashboard
+# 10: Put display to sleep
+# 11: Launchpad
+# 12: Notification Center
+# 13: Lock Screen
+# Top left screen corner → Mission Control
+defaults write com.apple.dock wvous-tl-corner -int 2
+defaults write com.apple.dock wvous-tl-modifier -int 0
+# Top right screen corner → Desktop
+defaults write com.apple.dock wvous-tr-corner -int 4
+defaults write com.apple.dock wvous-tr-modifier -int 0
+# Bottom left screen corner → Start screen saver
+defaults write com.apple.dock wvous-bl-corner -int 5
+defaults write com.apple.dock wvous-bl-modifier -int 0
+
+###############################################################################
+# Safari & WebKit                                                             #
+###############################################################################
+
+# Privacy: don’t send search queries to Apple
+defaults write com.apple.Safari UniversalSearchEnabled -bool false
+defaults write com.apple.Safari SuppressSearchSuggestions -bool true
+
+# Press Tab to highlight each item on a web page
+defaults write com.apple.Safari WebKitTabToLinksPreferenceKey -bool true
+defaults write com.apple.Safari com.apple.Safari.ContentPageGroupIdentifier.WebKit2TabsToLinks -bool true
+
+# Show the full URL in the address bar (note: this still hides the scheme)
+defaults write com.apple.Safari ShowFullURLInSmartSearchField -bool true
+
+# Set Safari’s home page to `about:blank` for faster loading
+defaults write com.apple.Safari HomePage -string "about:blank"
+
+# Prevent Safari from opening ‘safe’ files automatically after downloading
+defaults write com.apple.Safari AutoOpenSafeDownloads -bool false
+
+# Allow hitting the Backspace key to go to the previous page in history
+defaults write com.apple.Safari com.apple.Safari.ContentPageGroupIdentifier.WebKit2BackspaceKeyNavigationEnabled -bool true
+
+# Hide Safari’s bookmarks bar by default
+defaults write com.apple.Safari ShowFavoritesBar -bool false
+
+# Hide Safari’s sidebar in Top Sites
+defaults write com.apple.Safari ShowSidebarInTopSites -bool false
+
+# Disable Safari’s thumbnail cache for History and Top Sites
+defaults write com.apple.Safari DebugSnapshotsUpdatePolicy -int 2
+
+# Enable Safari’s debug menu
+defaults write com.apple.Safari IncludeInternalDebugMenu -bool true
+
+# Make Safari’s search banners default to Contains instead of Starts With
+defaults write com.apple.Safari FindOnPageMatchesWordStartsOnly -bool false
+
+# Remove useless icons from Safari’s bookmarks bar
+defaults write com.apple.Safari ProxiesInBookmarksBar "()"
+
+# Enable the Develop menu and the Web Inspector in Safari
+defaults write com.apple.Safari IncludeDevelopMenu -bool true
+defaults write com.apple.Safari WebKitDeveloperExtrasEnabledPreferenceKey -bool true
+defaults write com.apple.Safari com.apple.Safari.ContentPageGroupIdentifier.WebKit2DeveloperExtrasEnabled -bool true
+
+# Add a context menu item for showing the Web Inspector in web views
+defaults write NSGlobalDomain WebKitDeveloperExtras -bool true
+
+# Enable continuous spellchecking
+defaults write com.apple.Safari WebContinuousSpellCheckingEnabled -bool true
+# Disable auto-correct
+defaults write com.apple.Safari WebAutomaticSpellingCorrectionEnabled -bool false
+
+# Disable AutoFill
+defaults write com.apple.Safari AutoFillFromAddressBook -bool false
+defaults write com.apple.Safari AutoFillPasswords -bool false
+defaults write com.apple.Safari AutoFillCreditCardData -bool false
+defaults write com.apple.Safari AutoFillMiscellaneousForms -bool false
+
+# Warn about fraudulent websites
+defaults write com.apple.Safari WarnAboutFraudulentWebsites -bool true
+
+# Disable plug-ins
+defaults write com.apple.Safari WebKitPluginsEnabled -bool false
+defaults write com.apple.Safari com.apple.Safari.ContentPageGroupIdentifier.WebKit2PluginsEnabled -bool false
+
+# Disable Java
+defaults write com.apple.Safari WebKitJavaEnabled -bool false
+defaults write com.apple.Safari com.apple.Safari.ContentPageGroupIdentifier.WebKit2JavaEnabled -bool false
+defaults write com.apple.Safari com.apple.Safari.ContentPageGroupIdentifier.WebKit2JavaEnabledForLocalFiles -bool false
+
+# Block pop-up windows
+defaults write com.apple.Safari WebKitJavaScriptCanOpenWindowsAutomatically -bool false
+defaults write com.apple.Safari com.apple.Safari.ContentPageGroupIdentifier.WebKit2JavaScriptCanOpenWindowsAutomatically -bool false
+
+# Disable auto-playing video
+#defaults write com.apple.Safari WebKitMediaPlaybackAllowsInline -bool false
+#defaults write com.apple.SafariTechnologyPreview WebKitMediaPlaybackAllowsInline -bool false
+#defaults write com.apple.Safari com.apple.Safari.ContentPageGroupIdentifier.WebKit2AllowsInlineMediaPlayback -bool false
+#defaults write com.apple.SafariTechnologyPreview com.apple.Safari.ContentPageGroupIdentifier.WebKit2AllowsInlineMediaPlayback -bool false
+
+# Enable “Do Not Track”
+defaults write com.apple.Safari SendDoNotTrackHTTPHeader -bool true
+
+# Update extensions automatically
+defaults write com.apple.Safari InstallExtensionUpdatesAutomatically -bool true
+
+###############################################################################
+# Mail                                                                        #
+###############################################################################
+
+# Disable send and reply animations in Mail.app
+defaults write com.apple.mail DisableReplyAnimations -bool true
+defaults write com.apple.mail DisableSendAnimations -bool true
+
+# Copy email addresses as `foo@example.com` instead of `Foo Bar <foo@example.com>` in Mail.app
+defaults write com.apple.mail AddressesIncludeNameOnPasteboard -bool false
+
+# Add the keyboard shortcut ⌘ + Enter to send an email in Mail.app
+defaults write com.apple.mail NSUserKeyEquivalents -dict-add "Send" "@\U21a9"
+
+# Display emails in threaded mode, sorted by date (oldest at the top)
+defaults write com.apple.mail DraftsViewerAttributes -dict-add "DisplayInThreadedMode" -string "yes"
+defaults write com.apple.mail DraftsViewerAttributes -dict-add "SortedDescending" -string "yes"
+defaults write com.apple.mail DraftsViewerAttributes -dict-add "SortOrder" -string "received-date"
+
+# Disable inline attachments (just show the icons)
+defaults write com.apple.mail DisableInlineAttachmentViewing -bool true
+
+# Disable automatic spell checking
+defaults write com.apple.mail SpellCheckingBehavior -string "NoSpellCheckingEnabled"
+
+###############################################################################
+# Terminal & iTerm 2                                                          #
+###############################################################################
+
+# Only use UTF-8 in Terminal.app
+defaults write com.apple.terminal StringEncodings -array 4
+
+# Enable “focus follows mouse” for Terminal.app and all X11 apps
+# i.e. hover over a window and start typing in it without clicking first
+#defaults write com.apple.terminal FocusFollowsMouse -bool true
+#defaults write org.x.X11 wm_ffm -bool true
+
+# Enable Secure Keyboard Entry in Terminal.app
+# See: https://security.stackexchange.com/a/47786/8918
+defaults write com.apple.terminal SecureKeyboardEntry -bool true
+
+# Disable the annoying line marks
+defaults write com.apple.Terminal ShowLineMarks -int 0
+
+# Don’t display the annoying prompt when quitting iTerm
+defaults write com.googlecode.iterm2 PromptOnQuit -bool false
+
+###############################################################################
+# Time Machine                                                                #
+###############################################################################
+
+# Prevent Time Machine from prompting to use new hard drives as backup volume
+defaults write com.apple.TimeMachine DoNotOfferNewDisksForBackup -bool true
+
+###############################################################################
+# Activity Monitor                                                            #
+###############################################################################
+
+# Show the main window when launching Activity Monitor
+defaults write com.apple.ActivityMonitor OpenMainWindow -bool true
+
+# Visualize CPU usage in the Activity Monitor Dock icon
+defaults write com.apple.ActivityMonitor IconType -int 5
+
+# Show all processes in Activity Monitor
+defaults write com.apple.ActivityMonitor ShowCategory -int 0
+
+# Sort Activity Monitor results by CPU usage
+defaults write com.apple.ActivityMonitor SortColumn -string "CPUUsage"
+defaults write com.apple.ActivityMonitor SortDirection -int 0
+
+###############################################################################
+# Address Book, Dashboard, iCal, TextEdit, and Disk Utility                   #
+###############################################################################
+
+# Enable the debug menu in Address Book
+defaults write com.apple.addressbook ABShowDebugMenu -bool true
+
+# Enable Dashboard dev mode (allows keeping widgets on the desktop)
+defaults write com.apple.dashboard devmode -bool true
+
+# Enable the debug menu in iCal (pre-10.8)
+defaults write com.apple.iCal IncludeDebugMenu -bool true
+
+# Use plain text mode for new TextEdit documents
+defaults write com.apple.TextEdit RichText -int 0
+# Open and save files as UTF-8 in TextEdit
+defaults write com.apple.TextEdit PlainTextEncoding -int 4
+defaults write com.apple.TextEdit PlainTextEncodingForWrite -int 4
+
+# Enable the debug menu in Disk Utility
+defaults write com.apple.DiskUtility DUDebugMenuEnabled -bool true
+defaults write com.apple.DiskUtility advanced-image-options -bool true
+
+# Auto-play videos when opened with QuickTime Player
+defaults write com.apple.QuickTimePlayerX MGPlayMovieOnOpen -bool true
+
+###############################################################################
+# Mac App Store                                                               #
+###############################################################################
+
+# Enable the WebKit Developer Tools in the Mac App Store
+defaults write com.apple.appstore WebKitDeveloperExtras -bool true
+
+# Enable Debug Menu in the Mac App Store
+defaults write com.apple.appstore ShowDebugMenu -bool true
+
+# Enable the automatic update check
+defaults write com.apple.SoftwareUpdate AutomaticCheckEnabled -bool true
+
+# Check for software updates daily, not just once per week
+defaults write com.apple.SoftwareUpdate ScheduleFrequency -int 1
+
+# Download newly available updates in background
+defaults write com.apple.SoftwareUpdate AutomaticDownload -int 1
+
+# Install System data files & security updates
+defaults write com.apple.SoftwareUpdate CriticalUpdateInstall -int 1
+
+# Automatically download apps purchased on other Macs
+defaults write com.apple.SoftwareUpdate ConfigDataInstall -int 1
+
+# Turn on app auto-update
+defaults write com.apple.commerce AutoUpdate -bool true
+
+# Allow the App Store to reboot machine on macOS updates
+defaults write com.apple.commerce AutoUpdateRestartRequired -bool true
+
+###############################################################################
+# Photos                                                                      #
+###############################################################################
+
+# Prevent Photos from opening automatically when devices are plugged in
+defaults -currentHost write com.apple.ImageCapture disableHotPlug -bool true
+
+###############################################################################
+# Google Chrome & Google Chrome Canary                                        #
+###############################################################################
+
+# Disable the all too sensitive backswipe on trackpads
+defaults write com.google.Chrome AppleEnableSwipeNavigateWithScrolls -bool false
+defaults write com.google.Chrome.canary AppleEnableSwipeNavigateWithScrolls -bool false
+
+# Disable the all too sensitive backswipe on Magic Mouse
+defaults write com.google.Chrome AppleEnableMouseSwipeNavigateWithScrolls -bool false
+defaults write com.google.Chrome.canary AppleEnableMouseSwipeNavigateWithScrolls -bool false
+{{ if not .host.restricted }}
+###############################################################################
+# Settings that require administrator permissions                             #
+###############################################################################
+
+# Ask for the administrator password upfront
+sudo -v
+
+# Keep-alive: update existing `sudo` time stamp until `.macos` has finished
+while true; do sudo -n true; sleep 60; kill -0 "$$" || exit; done 2>/dev/null &
+
+# Show language menu in the top right corner of the boot screen
+sudo defaults write /Library/Preferences/com.apple.loginwindow showInputMenu -bool true
+
+# Set the timezone; see `sudo systemsetup -listtimezones` for other values
+sudo systemsetup -settimezone "America/New_York" > /dev/null
+
+# Enable lid wakeup
+sudo pmset -a lidwake 1
+
+# Sleep the display after 15 minutes
+sudo pmset -a displaysleep 15
+
+# Disable machine sleep while charging
+sudo pmset -c sleep 0
+
+# Set machine sleep to 5 minutes on battery
+sudo pmset -b sleep 5
+
+# Enable HiDPI display modes (requires restart)
+sudo defaults write /Library/Preferences/com.apple.windowserver DisplayResolutionEnabled -bool true
+
+# Show the ~/Library folder
+sudo chflags nohidden ~/Library
+
+# Show the /Volumes folder
+sudo chflags nohidden /Volumes
+{{- end -}}
diff --git a/dotfiles/.local/share/chezmoi/home/.chezmoiscripts/darwin/run_onchange_after_20-configure-darwin-shell.tmpl b/dotfiles/.local/share/chezmoi/home/.chezmoiscripts/darwin/run_onchange_after_20-configure-darwin-shell.tmpl
new file mode 100644
index 00000000..e3ccb385
--- /dev/null
+++ b/dotfiles/.local/share/chezmoi/home/.chezmoiscripts/darwin/run_onchange_after_20-configure-darwin-shell.tmpl
@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+
+set -eufo pipefail
+
+{{- if (not .host.restricted) }}
+if ! grep -qc "/usr/local/bin/zsh" /etc/shells; then
+  echo "/usr/local/bin/zsh" | sudo tee -a /etc/shells > /dev/null
+fi
+
+{{- if eq .host.arch "arm64" }}
+if [[ ! -e /usr/local/bin/zsh ]]; then
+  sudo ln -sf /opt/homebrew/bin/zsh /usr/local/bin/zsh
+fi
+{{- end -}}
+{{- end -}}
diff --git a/dotfiles/.local/share/chezmoi/home/.chezmoiscripts/darwin/run_onchange_before_10_install-darwin-packages.tmpl b/dotfiles/.local/share/chezmoi/home/.chezmoiscripts/darwin/run_onchange_before_10_install-darwin-packages.tmpl
new file mode 100644
index 00000000..985ba881
--- /dev/null
+++ b/dotfiles/.local/share/chezmoi/home/.chezmoiscripts/darwin/run_onchange_before_10_install-darwin-packages.tmpl
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+xcode-select -p >/dev/null 2>&1 || xcode-select --install
+
+if ! command -v brew >/dev/null 2>&1; then
+  echo "Installing Homebrew..."
+  /bin/sh -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
+fi
+
+{{ if eq .host.arch "arm64" -}}
+eval $(/opt/homebrew/bin/brew shellenv)
+{{- else }}
+eval $(/usr/local/bin/brew shellenv)
+{{- end }}
+
+brew bundle --verbose --no-lock --file=/dev/stdin <<EOF
+{{ includeTemplate "darwin/brewfile" . }}
+EOF
diff --git a/dotfiles/.local/share/chezmoi/home/.chezmoiscripts/ubuntu/run_onchange_before_10_install-ubuntu-packages.tmpl b/dotfiles/.local/share/chezmoi/home/.chezmoiscripts/ubuntu/run_onchange_before_10_install-ubuntu-packages.tmpl
new file mode 100644
index 00000000..56dd6e28
--- /dev/null
+++ b/dotfiles/.local/share/chezmoi/home/.chezmoiscripts/ubuntu/run_onchange_before_10_install-ubuntu-packages.tmpl
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+
+{{- $packages := splitList " " (includeTemplate "universal/essential-packages" .) -}}
+{{- $pyenvDependencies := list
+"make"
+"build-essential"
+"libssl-dev"
+"zlib1g-dev"
+"libbz2-dev"
+"libreadline-dev"
+"libsqlite3-dev"
+"wget"
+"curl"
+"llvm"
+"libncursesw5-dev"
+"xz-utils"
+"tk-dev"
+"libxml2-dev"
+"libxmlsec1-dev"
+"libffi-dev"
+"liblzma-dev"
+-}}
+{{- if .toolchains.python }}
+{{- $packages = concat $packages $pyenvDependencies -}}
+{{- end }}
+
+
+sudo apt-get update
+sudo apt-get install -y --no-install-recommends {{ $packages | sortAlpha | uniq | join " " -}}
diff --git a/dotfiles/.local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_after_10_install-aqua-packages.sh.tmpl b/dotfiles/.local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_after_10_install-aqua-packages.sh.tmpl
new file mode 100644
index 00000000..afb8682e
--- /dev/null
+++ b/dotfiles/.local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_after_10_install-aqua-packages.sh.tmpl
@@ -0,0 +1,19 @@
+{{ if .enableAquaInstall }}
+#!/usr/bin/env bash
+set -eufo pipefail
+
+source $HOME/.config/shell/exports.sh
+
+{{- $files := list -}}
+{{- range $path := glob (list .chezmoi.sourceDir "private_dot_config/aqua/**/*.yaml.tmpl" | join "/") }}
+{{- $files = concat $files (list (include $path)) -}}
+{{- end }}
+# aqua.yaml.tmpl hash: {{ $files | join "" | sha256sum }}
+if ! command -v aqua >/dev/null 2>&1; then
+  echo "Installing aqua"
+  curl -sSfL https://raw.githubusercontent.com/aquaproj/aqua-installer/v1.0.0/aqua-installer | bash
+fi
+
+aqua update-aqua
+aqua install -a
+{{ end }}
\ No newline at end of file
diff --git a/dotfiles/.local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_after_15_install-asdf-packages.tmpl b/dotfiles/.local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_after_15_install-asdf-packages.tmpl
new file mode 100644
index 00000000..82ffafc8
--- /dev/null
+++ b/dotfiles/.local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_after_15_install-asdf-packages.tmpl
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+
+source $HOME/.config/shell/exports.sh
+
+# dot_tool-versions.tmpl hash: {{ include "dot_tool-versions.tmpl" | sha256sum }}
+
+[ ! -d $ASDF_DIR ] && git clone https://github.com/asdf-vm/asdf.git "${ASDF_DIR}"
+. ${ASDF_DIR}/asdf.sh
+
+asdf plugin-add direnv
+{{- if or .toolchains.java }}
+asdf plugin-add java
+asdf plugin-add maven
+{{- end }}
+{{- if or .toolchains.node }}
+asdf plugin-add nodejs
+{{- end }}
+{{- if or .toolchains.python }}
+asdf plugin-add python
+{{- end }}
+asdf install || true
diff --git a/dotfiles/.local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_after_20_install-helm-plugins.tmpl b/dotfiles/.local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_after_20_install-helm-plugins.tmpl
new file mode 100644
index 00000000..a622a07a
--- /dev/null
+++ b/dotfiles/.local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_after_20_install-helm-plugins.tmpl
@@ -0,0 +1,15 @@
+{{- if .toolchains.extra -}}
+#!/usr/bin/env bash
+
+source $HOME/.config/shell/exports.sh
+helm_plugins=(
+  https://github.com/databus23/helm-diff
+  https://github.com/jkroepke/helm-secrets
+)
+
+for plugin in "${helm_plugins[@]}"
+do
+    echo Installing Helm plugin \"$plugin\"
+    helm plugin install $plugin 2>/dev/null|| true
+done
+{{- end -}}
diff --git a/dotfiles/.local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_after_30_install-krew-plugins.tmpl b/dotfiles/.local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_after_30_install-krew-plugins.tmpl
new file mode 100644
index 00000000..c11e16f7
--- /dev/null
+++ b/dotfiles/.local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_after_30_install-krew-plugins.tmpl
@@ -0,0 +1,40 @@
+{{- if .toolchains.extra -}}
+#!/usr/bin/env bash
+
+source $HOME/.config/shell/exports.sh
+if [[ ! -e $KREW_ROOT/bin/kubectl-krew ]]; then
+    (
+    set -x; cd "$(mktemp -d)" &&
+    OS="$(uname | tr '[:upper:]' '[:lower:]')" &&
+    ARCH="$(uname -m | sed -e 's/x86_64/amd64/' -e 's/\(arm\)\(64\)\?.*/\1\2/' -e 's/aarch64$/arm64/')" &&
+    KREW="krew-${OS}_${ARCH}" &&
+    curl -fsSLO "https://github.com/kubernetes-sigs/krew/releases/latest/download/${KREW}.tar.gz" &&
+    tar zxvf "${KREW}.tar.gz" &&
+    ./"${KREW}" install krew
+    )
+fi
+
+krew_plugins=(
+  access-matrix
+  datree
+  deprecations
+  get-all
+  konfig
+  modify-secret
+  neat
+  node-shell
+  resource-capacity
+  score
+  sniff
+  tree
+  tunnel
+  view-allocations
+  who-can
+)
+
+for plugin in "${krew_plugins[@]}"
+do
+    echo Installing Krew plugin \"$plugin\"
+    $KREW_ROOT/bin/kubectl-krew install $plugin 2>/dev/null || true
+done
+{{- end -}}
diff --git a/dotfiles/.local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_after_40_install-rust-toolchain.tmpl b/dotfiles/.local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_after_40_install-rust-toolchain.tmpl
new file mode 100644
index 00000000..55b0a8ea
--- /dev/null
+++ b/dotfiles/.local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_after_40_install-rust-toolchain.tmpl
@@ -0,0 +1,6 @@
+{{- if .toolchains.rust -}}
+#!/usr/bin/env bash
+
+source $HOME/.config/shell/exports.sh
+rustup-init -y --no-modify-path
+{{- end -}}
diff --git a/dotfiles/.local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_after_99_bootstrap-z4h.tmpl b/dotfiles/.local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_after_99_bootstrap-z4h.tmpl
new file mode 100644
index 00000000..64372238
--- /dev/null
+++ b/dotfiles/.local/share/chezmoi/home/.chezmoiscripts/universal/run_onchange_after_99_bootstrap-z4h.tmpl
@@ -0,0 +1,5 @@
+{{- if .host.headless -}}
+#!/usr/bin/env bash
+
+Z4H_BOOTSTRAPPING=1 exec zsh && exit 0
+{{- end -}}
diff --git a/dotfiles/.local/share/chezmoi/home/.chezmoitemplates/universal/essential-packages b/dotfiles/.local/share/chezmoi/home/.chezmoitemplates/universal/essential-packages
new file mode 100644
index 00000000..a4a8b68b
--- /dev/null
+++ b/dotfiles/.local/share/chezmoi/home/.chezmoitemplates/universal/essential-packages
@@ -0,0 +1,18 @@
+{{- $packages := list
+  "age"
+  "bash"
+  "coreutils"
+  "curl"
+  "exa"
+  "git"
+  "gnupg"
+  "htop"
+  "httpie"
+  "jq"
+  "neovim"
+  "ripgrep"
+  "tmux"
+  "wget"
+  "zsh"
+-}}
+{{- $packages | join " " -}}
diff --git a/dotfiles/.local/share/chezmoi/home/dot_local/bin/symlink_bat.tmpl b/dotfiles/.local/share/chezmoi/home/dot_local/bin/symlink_bat.tmpl
new file mode 100644
index 00000000..0cdce448
--- /dev/null
+++ b/dotfiles/.local/share/chezmoi/home/dot_local/bin/symlink_bat.tmpl
@@ -0,0 +1,3 @@
+{{- if (eq .host.distro.id "ubuntu") -}}
+/usr/bin/batcat
+{{- end -}}
\ No newline at end of file
diff --git a/dotfiles/.local/share/chezmoi/home/dot_local/bin/symlink_fd.tmpl b/dotfiles/.local/share/chezmoi/home/dot_local/bin/symlink_fd.tmpl
new file mode 100644
index 00000000..fc7c9507
--- /dev/null
+++ b/dotfiles/.local/share/chezmoi/home/dot_local/bin/symlink_fd.tmpl
@@ -0,0 +1,3 @@
+{{- if (eq .host.distro.id "ubuntu") -}}
+/usr/bin/fdfind
+{{- end -}}
\ No newline at end of file
diff --git a/dotfiles/.local/share/chezmoi/home/dot_local/bin/symlink_readlink.tmpl b/dotfiles/.local/share/chezmoi/home/dot_local/bin/symlink_readlink.tmpl
new file mode 100644
index 00000000..8432f75d
--- /dev/null
+++ b/dotfiles/.local/share/chezmoi/home/dot_local/bin/symlink_readlink.tmpl
@@ -0,0 +1,3 @@
+{{- if (eq .host.distro.family "darwin") -}}
+/usr/local/bin/greadlink
+{{- end -}}
\ No newline at end of file
diff --git a/dotfiles/.local/share/chezmoi/home/private_dot_config/shell/exports b/dotfiles/.local/share/chezmoi/home/private_dot_config/shell/exports
index 53b586e8..d685aa0d 100644
--- a/dotfiles/.local/share/chezmoi/home/private_dot_config/shell/exports
+++ b/dotfiles/.local/share/chezmoi/home/private_dot_config/shell/exports
@@ -61,6 +61,9 @@ fi
 {{- end }}
 export ANDROID_SDK_HOME="$XDG_DATA_HOME/android-sdk"
 
+### Aqua
+export PATH="${AQUA_ROOT_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/aquaproj-aqua}/bin:$PATH"
+
 ### ASDF
 export ASDF_CONFIG_FILE="$XDG_CONFIG_HOME/asdf/asdfrc"
 export ASDF_DIR="$XDG_DATA_HOME/asdf"
diff --git a/dotfiles/.local/share/chezmoi/home/private_dot_config/shell/functions b/dotfiles/.local/share/chezmoi/home/private_dot_config/shell/functions
index 779da54b..54546685 100644
--- a/dotfiles/.local/share/chezmoi/home/private_dot_config/shell/functions
+++ b/dotfiles/.local/share/chezmoi/home/private_dot_config/shell/functions
@@ -7,6 +7,12 @@ appiumwebdriver() {
   xcodebuild -project WebDriverAgent.xcodeproj -scheme WebDriverAgentRunner -destination "id=${UDID_INPUT}" test
 }
 
+asdf-update () {
+  asdf update > /dev/null 2>&1
+  asdf plugin update --all > /dev/null 2>&1
+  diff <(cat ~/.tool-versions | awk '{print $1}' | xargs -I {} bash -c 'echo {} $(asdf latest {})') <(cat ~/.tool-versions)
+}
+
 # Change directories and view contents at the same time
 cl() {
   DIR="$*"
@@ -116,3 +122,17 @@ transfer() {
     curl --progress-bar --upload-file "-" "https://transfer.sh/$file_name" | tee /dev/null
   fi
 }
+
+update-all() {
+  brew update
+  brew upgrade
+  brew upgrade --cask --greedy
+  brew cleanup --prune=1
+  asdf update || true
+  asdf plugin-update --all
+  rustup self update || true
+  rustup update || true
+  npm update -g || true
+  chezmoi upgrade
+  z4h update
+}
\ No newline at end of file