1password-secrets
1password-secrets is a CLI utility to sync 1Password secrets (env files). It enables:
- Seamless sharing of local secrets used for development.
Developers starting out in a project can just use this tool to retrieve the .env file needed for local development. Likewise it is also simple to push any local changes to the 1password vault.
- More secure and simpler method of managing Fly.io secrets.
By default, Fly secrets must be managed by flyctl. This means that when setting secrets in production, developers must use flyctl to pass credentials via arguments - risking credentials being stored in their histories. Alternatively, one must write secrets in a file and run flyctl secrets import. This works well, but you must ensure everything is synced to a secret/password manager and then delete the file. 1password-secrets enables a leaner management of secrets via 1password. When passing a fly app name, it automatically finds and imports secrets on 1password to Fly. This way you ensure developers always keep secrets up-to-date and never in any files on disk.
Motivation: Using 1password avoids the need for another external secret management tool and keeps the access control in a centralised place that we already use.
Getting started
Requirements
- Have the following dependencies: 1Password, Python and optionally fly.
Install them with one command:
brew install --cask 1password 1password-cli && \
brew install flyctlMinimum supported versions: 1Password = 8.9.13 1Password CLI = 2.13.1 Python = 3.10 flyctl = 0.0.451 (optional)
More information and installation instructions for other systems can be found in the 1password documentation.
- Allow 1Password to connect to 1Password-CLI by going to 1Password's Settings - Developer -
Command-Line Interface (CLI) and select Integrate with 1Password CLI.
- Sign into your 1Password desktop and if you wish to use the fly integration, also make sure
the CLI is authenticated.