Running the same Linux setup on three machines used to mean cloning a drive and hoping the hardware overlapped. The new default is: sync your dotfiles with one tool, keep a package list in Git, and let your files sync themselves through a separate channel. These seven desktop tools cover the three layers, from a two-file ~/.zshrc sync to a full Nix declarative rebuild.
What to look for in a dotfile sync tool
A few questions decide the shape:
- Templating: do different machines need different configs from the same source?
- Secrets: how are SSH keys and API tokens handled?
- Bootstrap: can it install itself from a one-liner on a fresh box?
- Package management: does it also handle apt, dnf, brew, or nix?
- History: do you want plain Git, or something with its own log?
Quick comparison
| App | Best for | Free plan | Paid | Platforms | Standout |
|---|---|---|---|---|---|
| chezmoi | Templated dotfiles with secrets | Yes | Free | Linux, macOS, Windows | Templates, encryption, machine-aware configs |
| GNU Stow | Symlink farm from a Git repo | Yes | Free | Linux, macOS | The oldest, simplest workflow |
| yadm | Native Git for your dotfiles | Yes | Free | Linux, macOS | Bootstrap script, alt-branch per machine |
| dotbot | Declarative YAML symlink setup | Yes | Free | Linux, macOS | Cross-platform, tiny footprint |
| Ansible | Full-machine config, not just dotfiles | Yes | AAP paid | Linux, macOS, Windows | Same tool for a fleet or one laptop |
| Syncthing | Continuous P2P file sync | Yes | Free | Linux, macOS, Windows | No cloud, direct machine-to-machine |
| Nix Home Manager | Reproducible user environment | Yes | Free | Linux, macOS | Same config yields the same setup every time |
The apps
1. chezmoi — best for templated dotfiles with secrets
chezmoi treats your dotfiles as source code, with per-machine templates (Go’s text/template) and native encryption via age or GPG. One repo covers your work Mac, your home Linux box, and a headless server, and the differences (email, editor plugins, work-only entries) live in template conditionals.
Where it falls short: Learning curve for the template syntax. Merging a template result with a machine-managed system file needs a specific pattern most people learn the hard way.
Pricing: Free, open source.
Platforms: Linux, macOS, Windows.
Download: chezmoi
Bottom line: The current default for anyone who has outgrown a symlink script.
2. GNU Stow — best for the simplest possible workflow
GNU Stow was written in 1994 and still does exactly one thing: create symlinks from a package directory into your home. A dotfiles repo becomes a Stow “package,” and stow zsh symlinks its contents into place. No templating, no secrets, no magic.
Where it falls short: Machine-specific configs mean multiple branches or per-host packages. Secrets have to live somewhere else (an encrypted mount, a password manager).
Pricing: Free, open source.
Platforms: Linux, macOS, Windows (via WSL).
Download: GNU Stow
Bottom line: The right pick when your setup is small and you never want to think about the sync tool again.
3. yadm — best for treating dotfiles as one Git repo
yadm (Yet Another Dotfiles Manager) is Git plus dotfile-specific conveniences: bootstrap scripts, alt files per host or OS, and encryption via GPG. Because it is really just a wrapper around Git, everything you already know still works.
Where it falls short: Alt-file convention is powerful but less discoverable than chezmoi’s templating. Encryption story is basic compared to age-based tools.
Pricing: Free, open source.
Platforms: Linux, macOS.
Download: yadm
Bottom line: The gentlest step up from a bare Git repo of dotfiles.
4. dotbot — best declarative small setup
dotbot reads a YAML install file and creates symlinks, clones repos, and runs shell commands. It is small enough to vendor into your dotfiles repo, so cloning the repo and running ./install is the whole bootstrap on a fresh machine.
Where it falls short: No templating. No native encryption. Complex machines end up with long install.yaml files that get hard to read.
Pricing: Free, open source.
Platforms: Linux, macOS.
Download: dotbot on GitHub
Bottom line: The right pick when you want a declarative install file and nothing else.
5. Ansible — best when the config extends past your home directory
Ansible manages entire machines from a set of playbooks. For a personal setup, one playbook installs packages, sets kernel parameters, drops dotfiles, and configures services in one go. The same playbook runs on a laptop or a homelab node.
Where it falls short: Overkill for a pure dotfile problem. Playbook runs are slower than a symlink farm. YAML fatigue is real once you cross a few hundred lines.
Pricing: Free open source. Ansible Automation Platform paid enterprise tier.
Platforms: Linux, macOS, Windows.
Download: Ansible
Bottom line: The tool for anyone who wants one workflow for both their laptop and their servers.
6. Syncthing — best for the files, not the configs
Syncthing is the peer-to-peer file sync your dotfile manager should sit next to. Keep declarative configs in Git, but let Syncthing move a couple of hundred gigabytes of Documents, Music, and project scratch files across machines without a cloud provider ever touching them.
Where it falls short: Not a dotfile tool at all. Bring your own conflict resolution habits. Initial sync of a large folder takes as long as the slower link allows.
Pricing: Free, open source.
Platforms: Linux, macOS, Windows.
Download: Syncthing
Bottom line: The other half of a real multi-machine setup, one your dotfile tool alone will not replace.
7. Nix Home Manager — best for full reproducibility
Nix Home Manager describes your entire user environment in Nix expressions: packages, dotfiles, services, all of it. A fresh machine gets nix run home-manager -- switch and comes up identically to every other machine in the flake.
Where it falls short: Nix’s learning curve is real. Some proprietary apps do not have Nix packages. Rollbacks are magic when they work and painful when a channel breaks.
Pricing: Free, open source.
Platforms: Linux, macOS.
Download: Nix Home Manager
Bottom line: The right pick for anyone willing to invest in Nix upfront for true reproducibility.
How to pick the right one
- If you have one laptop and never want to think about it: GNU Stow or yadm.
- If you have three machines and one of them is work: chezmoi.
- If you want a declarative bootstrap and nothing else: dotbot.
- If you already run Ansible on servers: extend one playbook to your laptop.
- If you also need to sync data files: Syncthing alongside any of the above.
- If you want a rebuild-from-config workflow: Nix Home Manager.
FAQ
Where do I store secrets in a dotfiles repo? Never in plain text. chezmoi and yadm both encrypt at rest. For plain Git repos, use age or GPG on the specific files, or keep secrets outside the repo entirely.
Do these tools work on macOS? Every tool in this list supports macOS. Nix Home Manager and chezmoi are the most macOS-friendly by far.
How do I handle machine-specific configs? Templates (chezmoi), alt files (yadm), branches (yadm and Stow), or host-guarded blocks in Ansible. The template pattern scales best past two machines.
Should I commit my dotfiles repo publicly? Only after auditing. Even a small config often carries an email or a work-only alias. Private is safer.
How do I sync files that change constantly, like browser bookmarks or shell history? Syncthing, not a dotfile tool. Version-controlled dotfiles do not enjoy hourly churn.
Is Nix worth learning just for dotfiles? For dotfiles alone, no. For anyone building homelabs, dev containers, and reproducible builds, yes.
