I use git-annex and Guix (particularly Guix Home in this case) for managing all of my data, including dotfiles. git-annex handles syncing (and backups via delivery to a Borg repo) and version management as git does, while Guix takes care of installing programs and setting up configuration files.

I previously wrote a custom Guix service that utilized Stow as well for managing writable files, but have since replaced it with another custom Guix service that handles some cleanup processes better.

Depending on how much you want simplicity of restoration, this approach might be on the heavier side since it’s concerned with a lot more than just dotfiles. You could replace git-annex with git to simplify the syncing part if you’re only interested in managing configuration files, though. Here’s what my Guix config looks like; the readme file shows how I would set up a system from scratch.

Was not aware of this, thanks! Looks like it does, with a notable difference being that Cryptomator has better cross-platform support in exchange for not having file size obfuscation.

The CryFS developers have a comparison page here that might help you decide what to use. There’s a summary table at the bottom that gives a comparison of features between encryption filesystems if you don’t feel like reading through it all.

I personally use and would recommend CryFS because it’s the only one (that I’m aware of) that plays nice with data synchronization software (i.e. doesn’t store the container as a single file) while keeping the directory structure encrypted.

Does Guix fit your criteria, perhaps? If you haven’t heard of it, you can think of it as Nix with a Lisp frontend.

I unfortunately am not very experienced with containerizing packages so I can’t say much, but I know you can do it; the Nonguix channel employs containers for some proprietary software.

Like Nix, Guix has all that building-from-source stuff you’d want from Gentoo. There’s recently been work on making parameterized packages (the Guix equivalent of USE flags) a thing, but it’s still work-in-progress.

Ignoring the steep upfront cost of learning it, I’d say Guix makes it incredibly easy to add your own packages. Here’s the custom packages I currently have in my dotfiles repository. I can import one to my main config file, add the package, and it gets included in my environment the next time I reconfigure it.

As for patches, I can’t make any comparisons since I’m not familiar with Gentoo, so I think a code snippet is probably better for you to judge if you’d like it.

(define-public custom-pkg
  (package
    (inherit pkg)
    (name "custom-pkg")
    (version (package-version pkg))
    (source (origin
              (inherit (package-source pkg))
              (patches
               (list (string-append (dirname (current-filename))
                                    "/fix-some-thing.patch")))))))

(define-public custom-pkg
  (package-with-patches
   pkg
   (list (string-append (dirname (current-filename))
                        "/fix-some-thing.patch"))))

Not sure if this addresses your concern about multi-architecture support, but the Foreign Architectures section of the manual discusses what you can build to.

EDIT: So I was curious after posting this because usually the CLI often has much less verbose options (like --with-input for replacing inputs), and I started wondering if there was any procedure that would make this simpler. Turns out there is :) I’ve included it under the example. Although, I suppose I should have mentioned you could write your own if you really wanted to.

I use git-annex for syncing and backing up all of my data; would highly recommend if you’re looking for something that scales well, OP.

Could you elaborate on why you think Guix will attempt to pull systemd? As far as I’m aware, Guix doesn’t impose any hard requirement on systemd when installing it on a foreign system; the manual (particularly 2.1 Binary Installation) simply provides instructions for setting it up on systemd and Upstart.

I just found this blog post about setting up Guix on Void Linux if it helps at all.

I remember having this issue, albeit not as workflow-disrupting as you’ve had it so I never bothered actively searching for a solution. I can confirm however that there is definitely a solution; at some point in my migrations to different distros, the problem stopped showing up, and right now I actually can’t reproduce the problem - labels are displayed correctly for me, both on my existing drives and new partitions that I create.

After some digging (and a sleep-deprived me smiting my boot partition during my investigation and having to fix that, LMAO - I never thought it’d happen, but Guix saved me from a reinstall), I found that LUKS1 has some kind of limitation that makes Dolphin not display the label as expected according to this and my own testing, which may be your problem if your drives are still using LUKS1. The Arch Wiki has a section on how to convert to LUKS2 here.

At the very least, if this is not the solution for you, I can say with certainty that it is fixable!