Skip to content

Atuin sync (operator shell)

Login-based, E2E-encrypted history sync for the golden operator shell.

Model

  • Each host keeps a local SQLite DB and a stable host_id.
  • Account login writes a session; encryption uses a shared key (atuin key).
  • Same account + same key on every machine → one history pool.
  • Search filters:
  • filter_mode = "global" — see all hosts (default in golden config)
  • Up-key uses filter_mode_shell_up_key_binding = "host" — this machine first

Config ships from operator/dotfiles/dot_config/atuin/config.toml. Do not commit key or session.

One-time account repair (owner)

WSL previously had a session but sync returned HTTP 404 (stale server state).

  1. On the machine with the largest good history (usually WSL), confirm key is backed up in 1Password: atuin key.
  2. Try re-login:
atuin account logout || true
atuin account login -u <USERNAME>
# password from 1Password
# when prompted for encryption key: paste existing key (do not generate new)
atuin sync -f
atuin status
  1. If login still 404s, register a fresh account on https://api.atuin.sh, save username / password / new key in 1Password, then atuin sync -f. Old orphan keys on other hosts must be replaced via login with the new key.

Fleet hosts

After operator-shell / bootstrap applies configs:

# ensure atuin on PATH (official installer)
. "$HOME/.atuin/bin/env" 2>/dev/null || true
atuin account login -u <USERNAME>
atuin sync -f

Repeat on infra-services, saltierpoop, ubuncap, recordurbate, prox, LXCs, Mac.

Self-host later

Public api.atuin.sh is E2E encrypted and fine for start. Optional later: services/atuin on infra-services (atuin-server + Postgres) and set sync_address in the chezmoi config.