onepassword

README

scriptling-onepassword

1Password service account support for Scriptling's onepassword secret provider.

Scriptling's onepassword provider talks to 1Password Connect out of the box. This extension adds service accounts, so a provider can read secrets with a single ops_... token and no Connect server:

[[secrets.provider]]
provider = "onepassword"
alias = "op"
service_account_token = "ops_..."

It uses the official 1Password Go SDK, which adds about 14 MB to a binary, so it's a separate module: only programs that import it link it. Without it, a service_account_token config fails with an error naming this extension.

Paths and fields work the same as with Connect: vault/item by name or ID, the field defaulting to password and falling back to credential and the item's notes. A read is normally one request to 1Password.

Embedding Scriptling

Import the package for its side effect:

import _ "github.com/paularlott/scriptling-onepassword"

Every secretprovider.Config with ServiceAccountToken set then builds a service account provider. Set onepassword.IntegrationName and IntegrationVersion before first use to identify your application to 1Password.

A Scriptling CLI with service accounts

Scriptling releases include two CLI builds with this extension compiled in:

brew install paularlott/tap/scriptling-onepassword        # with the database plugins
brew install paularlott/tap/scriptling-slim-onepassword   # without them

The zips (scriptling-onepassword-<os>-<arch>.zip, scriptling-slim-onepassword-<os>-<arch>.zip) are on the Scriptling releases page. The standard scriptling and scriptling-slim builds support 1Password Connect only.

To build your own instead, make a module with this main.go:

package main

import (
	"github.com/paularlott/scriptling/scriptling-cli/scriptlingcmd"
	_ "github.com/paularlott/scriptling-onepassword"
)

func main() { scriptlingcmd.Main() }

then:

go mod init example.com/scriptling
go mod tidy
go build -o scriptling .

Add the database drivers by building with the same tags as the released CLI, for example -tags plugin_sqlite,plugin_sql,plugin_valkey,plugin_badgerdb.

Service account or Connect?

A service account needs only its token. Each new process starts cold, though: its first secret read loads 1Password's engine and signs in (about a second), and each secret is fetched from 1Password once per process, counting against the service account's rate limits. That suits long-running programs, interactive use and occasional scripts. For something that starts many times a minute, 1Password Connect, which keeps a synced copy of your vaults on your own server, is the better fit.

A service account can only read the vaults it was given when it was created, and can't be given your built-in Personal, Private or Employee vault, or the default Shared vault.

License

MIT — see LICENSE.txt. Contributions are covered by the Scriptling CLA; see CONTRIBUTING.md.

Documentation

Overview

Package onepassword adds 1Password service account support to Scriptling's onepassword secret provider. Import it for its side effect:

import _ "github.com/paularlott/scriptling-onepassword"

A provider config with service_account_token then resolves through the 1Password Go SDK instead of 1Password Connect. It lives outside Scriptling because the SDK is large (about 14 MB); only binaries that import it link it.

Index

• Variables
• type Provider
  • func New(cfg secretprovider.Config) (*Provider, error)
  • func (p *Provider) ID() string
  • func (p *Provider) List(ctx context.Context, path string) ([]string, error)
  • func (p *Provider) Resolve(ctx context.Context, path, field string) (string, error)

Variables

var (
	IntegrationName    = "Scriptling"
	IntegrationVersion = build.Version
)

IntegrationName and IntegrationVersion identify the integration to 1Password. Embedding applications may set them before first use.

Types

type Provider

type Provider struct {
	// contains filtered or unexported fields
}

Provider resolves secrets with a 1Password service account through the 1Password Go SDK — no Connect server. Paths and fields follow the Connect provider (vault/item by name or id, the same field matching and default-field fallbacks), so switching a provider from Connect to a service account needs no script changes.

func New

func New(cfg secretprovider.Config) (*Provider, error)

New creates a 1Password service account provider from cfg.

func (*Provider) ID

func (p *Provider) ID() string

func (*Provider) List

func (p *Provider) List(ctx context.Context, path string) ([]string, error)

List returns the item titles in a vault, or the field names of an item for vault/item, as the Connect provider does.

func (*Provider) Resolve

func (p *Provider) Resolve(ctx context.Context, path, field string) (string, error)