With chezmoi it will kind of be read only/immutable with templates no? You could use templates in your dotfiles then on local you can specify the data you want to be templated. So your templates would be read only but the actual content in them could be different per machine. And you could have some dotfiles not be templated at all if you don't use certain configs on different machines.