diff --git a/dot_config/encrypted_mbsyncrc.asc b/dot_config/encrypted_mbsyncrc.asc
new file mode 100644
index 0000000..e96d40b
--- /dev/null
+++ b/dot_config/encrypted_mbsyncrc.asc
@@ -0,0 +1,16 @@
+-----BEGIN PGP MESSAGE-----
+
+hF4Dt852JJsu9zQSAQdAr6x9smVwC0vNXosdEHRQ3D+zshds/N/d6Wv62b+5EkIw
+CkmC4Qj05zRSBcXCUVfZtfCRBxlWvQEUIZm3H18qB68CIple/PTWESCpomhQJJj2
+0sEQAXEpC88xeApS6NupmlDyamvOEfRXiBXhaozM58qUnBDsfkiqzdFEct7wmLBR
+Z+H8gDjaUialyzXcnSFOhJkNU4bnH7zFjIn1lgXn0/6K6FISo63kpsq7K5cwfp7a
+TZVkjTxjFbzKSUlUHjoyevhidZEWcnA/cNgv2MTjHNINRkUS85yAuuuVJL3oX8mh
+X6aSGSdTRZTAFNcCOCNQ/901sC0rzfGyLFaiwZyN/hsq9/CwjZuGPXHJMnWoFY1v
+U/l+Gv/fH8CpGHYSSyHzvwbnq7yxICrWvnDhws/BxoT03Qm2CJWUp64ut2h7qC8G
+34KtLIuiuttAxk3D6ZUvD0Lyk9xdEN58Vvw0r4uTw1fsdm/PgBCiEMdPBF/3iRjw
+fpAhDLxJUAmTdcH3sYPU9hgr1Igu7IMupFTfCNDkMbNXgdHnw1D/+fLLf+AMEjLw
+Uh4dDicCPdkWhx3c9UncVatoVIYub11/ExdrInvs7VDX3HZZmKWLuFGosdmtTjNr
+7m0yf57SuIr+98skB8BF4XJ9R1PsMMU5MQbWFGWIqsCp3B6pcn+mtimO0YokkBPI
+Y6wc9Bm5EFN3jcPzvGAx7CVIoxdYXQ9X7F0wH1oxCb6KuNg=
+=RU6n
+-----END PGP MESSAGE-----
diff --git a/dot_gitconfig b/dot_config/git/config
similarity index 94%
rename from dot_gitconfig
rename to dot_config/git/config
index 7308d20..6eb3e92 100644
--- a/dot_gitconfig
+++ b/dot_config/git/config
@@ -1,8 +1,10 @@
 # vim:ft=gitconfig:fenc=utf-8:fdm=marker
 
 ; identity & authentication
-[include]
-  path = ~/.config/git/pseudonym
+[user]
+  name = winston
+  email = hey@winston.sh
+  signingkey = A476C39610E53A689A57BD0D0B89BC45007EE9CC
 
 ; using 'pass' as the password manager
 [credential]
diff --git a/dot_config/git/encrypted_pseudonym.asc b/dot_config/git/encrypted_pseudonym.asc
deleted file mode 100644
index d638ccf..0000000
--- a/dot_config/git/encrypted_pseudonym.asc
+++ /dev/null
@@ -1,11 +0,0 @@
------BEGIN PGP MESSAGE-----
-
-hF4Dt852JJsu9zQSAQdAH6u8KuzZ7V+9Rh1r8DyA1En64bqAjuoIUe9YRgprSH4w
-vo2DqLAss0dn67m9IOQWhvT+xY5YV5khhrPNbuOE8TlPfkxF05C8wnuOesZd6S/A
-0sAAAUMgdUgfx/TyKWQGYQYwj44m26IUWGNVJDZ4lQXbE4Z+pEaQguohsoeKTEhQ
-A890l1IryH317sbFcgR37kHKMoL8T2cDbjfRWsaIZOnioXUS6RcdzkkInE36enge
-PwxThiiSk179DYFkKQUfoq54QXIhK0x3BImbzbiaxCvAS55Np1jzWeQMF7h+IK5/
-nxF3kQxJOZbGL4b0IfixgrIi3P1xAo/QY1xTUGNgobhH/+cOc9dwahY0xqUyvytx
-+Jy1
-=AH1k
------END PGP MESSAGE-----
diff --git a/dot_config/notmuch/default/encrypted_config.asc b/dot_config/notmuch/default/encrypted_config.asc
new file mode 100644
index 0000000..c90ec06
--- /dev/null
+++ b/dot_config/notmuch/default/encrypted_config.asc
@@ -0,0 +1,12 @@
+-----BEGIN PGP MESSAGE-----
+
+hF4Dt852JJsu9zQSAQdANsumSpMu+ahtq5bJI+1jxsZjHp0BOTwybpiy2NLDe1ow
+N7k6vZRm+7SaiNZ+mTz3c4GwDH9+/SYhazgS5K/xwDNU6Vwnd6bA9lG8plrc+6hg
+0sBSATTyAva1JPBktj5lsIcoKGDwKDw5uuyP8PyBh6yhpYEDJZYuwev9o/PqtPy4
+EQJaKfsgAqlSsNMP8/AJOXYdTiiadTfkZlynAxLwpkQe9pDW5Fbi+akycks/yt7q
+B+BD+4p8UMOOTS8Y4hRe+wcuzaw6J2cAIvxWYgG1AAI2GrU+Yl2/TgkYPEmrXSOy
+mvg3svoYjkaoOyW05bPYISBSgJKKkS2SqbbDIhh5z5RcPRh6HRZfH+wuMyWHl13k
+jvuy6eCi/DjWkJlj+wrcddKyM6kW4QlXuG5vUrtLHDY3HxkfHPYiyG12gT64fUEL
+Arg9eSIPMhAjoIxR9ZsThVDQ1ELAiinq6Cei9kR2+c0WgD7cgg==
+=AHxY
+-----END PGP MESSAGE-----
diff --git a/dot_zprofile.tmpl b/dot_config/zsh/dot_zprofile.tmpl
similarity index 100%
rename from dot_zprofile.tmpl
rename to dot_config/zsh/dot_zprofile.tmpl
diff --git a/dot_config/zsh/dot_zshenv b/dot_config/zsh/dot_zshenv
new file mode 100644
index 0000000..ec687a7
--- /dev/null
+++ b/dot_config/zsh/dot_zshenv
@@ -0,0 +1,62 @@
+# vim:ft=zsh:fenc=utf-8:fdm=marker
+
+### COMMON ###
+export EDITOR=nvim
+export HISTFILE=~/.config/zsh/history
+# don't write a less history
+export LESSHISTFILE=-
+
+# check if .local/bin is directory, if not create it
+if [ ! -d "$HOME/.local/bin" ]; then
+  mkdir -p "$HOME/.local/bin"
+fi
+export PATH="$HOME/.local/bin:$PATH"
+
+if [ -d "/usr/local/sbin" ]; then
+  export PATH="/usr/local/sbin:$PATH"
+fi
+
+### LINUX ### - TODO: replace with chezmoi os check
+if [[ $(uname -s) == "Linux" ]]; then
+  BROWSER="$(which firefox)"
+  export BROWSER
+fi
+
+### MACOS ###
+export XDG_CONFIG_HOME="$HOME/.config"
+if [[ -x "$(command -v brew)" ]]; then
+  export PATH="/opt/homebrew/sbin:$PATH"
+fi
+
+### KUBERNETES ###
+export KUBECONFIG="$HOME/.config/kube/config"
+export KUBECACHEDIR="$HOME/.cache/kube"
+export KREW_ROOT="$HOME/.local/krew"
+# add to path if ".krew" exists or $KREW_ROOT is set
+if [ -d "$KREW_ROOT" ]; then
+  export PATH="$KREW_ROOT/bin:$PATH"
+fi
+export KUBE_EDITOR="$EDITOR"
+
+### PYTHON ###
+export PYENV_VIRTUALENV_DISABLE_PROMPT=1
+if [ -d "$HOME/.pyenv/bin" ]; then
+  export PATH="$PATH:$HOME/.pyenv/bin"
+fi
+
+### RUST ###
+export CARGO_HOME="$HOME/.local/share/cargo"
+if [ -f "$CARGO_HOME/env" ]; then
+  . "$CARGO_HOME/env"
+fi
+export PATH="$PATH:$CARGO_HOME/bin"
+
+### NODE ###
+export NVM_DIR="$HOME/.config/nvm"
+[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
+# yarn
+export PATH="$PATH:$HOME/.yarn/bin"
+
+### GO ###
+export GOPATH="$HOME/.local/share/go"
+export PATH="$PATH:$GOPATH/bin"
diff --git a/dot_zshrc b/dot_config/zsh/dot_zshrc
similarity index 99%
rename from dot_zshrc
rename to dot_config/zsh/dot_zshrc
index 8b56f9d..f68b122 100644
--- a/dot_zshrc
+++ b/dot_config/zsh/dot_zshrc
@@ -41,7 +41,7 @@ fi
 
 ### basics {{{
 # history
-export HISTFILE="$HOME/.zhistory"
+export HISTFILE="$ZDOTDIR/.zhistory"
 export HISTSIZE=10000
 export SAVEHIST=10000
 setopt HIST_IGNORE_ALL_DUPS
diff --git a/dot_zshenv b/dot_zshenv
index 7c5f047..9942698 100644
--- a/dot_zshenv
+++ b/dot_zshenv
@@ -1,57 +1,3 @@
-# vim:ft=zsh:fenc=utf-8:fdm=marker
-
-### COMMON ###
-export EDITOR=nvim
-
-# don't write a less history
-export LESSHISTFILE=-
-
-# check if .local/bin is directory, if not create it
-if [ ! -d "$HOME/.local/bin" ]; then
-  mkdir -p "$HOME/.local/bin"
-fi
-export PATH="$HOME/.local/bin:$PATH"
-
-if [ -d "/usr/local/sbin" ]; then
-  export PATH="/usr/local/sbin:$PATH"
-fi
-
-### LINUX ### - TODO: replace with chezmoi os check
-if [[ $(uname -s) == 'Linux' ]]; then
-  BROWSER="$(which firefox)"
-  export BROWSER
-fi
-
-### MACOS ###
-export XDG_CONFIG_HOME="$HOME/.config"
-if [[ -x "$(command -v brew)" ]]; then
-  export PATH="/opt/homebrew/sbin:$PATH"
-fi
-
-### KUBERNETES ###
-# add to path if '.krew' exists or $KREW_ROOT is set
-if [ -d "$HOME/.krew" ] || [ -z "$KREW_ROOT" ]; then
-  export PATH="${KREW_ROOT:-$HOME/.krew}/bin:$PATH"
-fi
-export KUBE_EDITOR="$EDITOR"
-
-### PYTHON ###
-export PYENV_VIRTUALENV_DISABLE_PROMPT=1
-if [ -d "$HOME/.pyenv/bin" ]; then
-  export PATH="$PATH:$HOME/.pyenv/bin"
-fi
-
-### RUST ###
-if [ -f "$HOME/.cargo/env" ]; then
-  . "$HOME/.cargo/env"
-fi
-export PATH="$PATH:$HOME/.cargo/bin"
-
-### NODE ###
-export NVM_DIR="$HOME/.config/nvm"
-[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
-# yarn
-export PATH="$PATH:$HOME/.yarn/bin"
-
-### GO ###
-export PATH="$PATH:$HOME/go/bin"
+# vim:ft=zsh:fenc=utf-8
+export ZDOTDIR=$HOME/.config/zsh
+. $ZDOTDIR/.zshenv
diff --git a/encrypted_dot_mbsyncrc.asc b/encrypted_dot_mbsyncrc.asc
deleted file mode 100644
index 7a06ba2..0000000
--- a/encrypted_dot_mbsyncrc.asc
+++ /dev/null
@@ -1,16 +0,0 @@
------BEGIN PGP MESSAGE-----
-
-hF4Dt852JJsu9zQSAQdAScqMcrDn0VKl7IBjwUsE9R7MDLYN+Dsd+A3ChSFiKTww
-T2wwdWqjRpTtqRucbm5bOJ8374kudX01CgygjQuYVZv+dnvg9G4DA9w4a3dx0X6+
-0sEPAf6ckVZ/EfxNAdS1BXF0tZ6JpiqUN8nv2lHBDDCY7bk+SbPnDHT97n4e21M6
-QeTHt9aYlvvn3KOkQ40XH6Sp7YyaNNBi7w8aE8JhId9z7LVCkND8dYSCBE+k5qnM
-71LeWJY+c845COjuK917L9X6CgSfYLi5oe9u/CrF0P2Jdj65eBRqz+WSw9OUz9sR
-p5so4NhzXU7tUZAokDeRuuAiuaQjOH/Ye/YucqCioV1ATUaa3j8gb8M8lrO+0EJK
-4bxH8qdWlGZS4WTH97l/1CrpgVrt6OtW9jEZK4CddyuPS/uY1CPdrbyAMRugRw19
-Z/pGp0cNmNXk2iUa3QUrdnyRfv68sCv0wB+xrqgppU/90JNd2bCAb+RIWU8mtOHe
-CPXsWlEtY0VkhDto2o4LEJEq/TIrQBUerubSo1p/r10UBws/1NU3YcdhSTEYdy2b
-yUUKz4H9E4EK9AiHLtMQ4I15ojToivvb7rJDaGZQGjN75qev0u15qELLjhNLlAS/
-l5IF4UYIT3t3puZxmNQuH9GyfOVzbZGNZ+kjVSXEgArhhQZBi/5UHVGG09WEfAyr
-i+vhtZlxFu1vBmiK64stiIN0cmICH1Y4UyGZi5KCiXlYdw==
-=b25X
------END PGP MESSAGE-----
diff --git a/encrypted_dot_notmuch-config.asc b/encrypted_dot_notmuch-config.asc
deleted file mode 100644
index 7d52ddc..0000000
--- a/encrypted_dot_notmuch-config.asc
+++ /dev/null
@@ -1,12 +0,0 @@
------BEGIN PGP MESSAGE-----
-
-hF4Dt852JJsu9zQSAQdAhC83Q146cdQ9FqgO9BrkXmh77m/0YZ+RdSZPnQKvQQ4w
-WCkoVukVe3T8BnoRAMGEBUYmy5Hd1CFUbKVPD+GCt8IslunaT0CO9ITyEPS4RZka
-0sBRAf+rSCDwtWHgxk0LRS+4WocvxTnoGlMjxUfI+ljRr9wNv2RfWDbMzFkSpZm2
-nFcpQOOsQBfKoSmXao0ZttbjpCnHvQZac57YAujpxvR/oa+fK73wedhh8PLCLTpq
-aJhwkB3X4NgPFLcZ5COF1Y+EbNQgrnIS5bP1u2TQskx7h0sMBnj5W7Yx+ei4nz1M
-3pp8jnIzWmol6MiEfkpQEYGYtsJoT+2aRETNF5MDphGcOTp+fmRz0XYDmw69/QJZ
-PjTFsyxUIdPEs/RZBGrR8TW8aHPpP5Bh7oMpA5Ewxdm07+UXKjg9EjSXLj8ubB0a
-xTjS/rIr9IRBZP9BkZV8+eBJcmF25o0vbt55MKwonnoY522t
-=0DgQ
------END PGP MESSAGE-----