Skip to content

Latest commit

 

History

History
181 lines (151 loc) · 5.07 KB

README.md

File metadata and controls

181 lines (151 loc) · 5.07 KB
 ██████╗ ██████╗ ███╗   ██╗██╗██╗  ██╗
██╔═══██╗██╔══██╗████╗  ██║██║╚██╗██╔╝
██║   ██║██████╔╝██╔██╗ ██║██║ ╚███╔╝ 
██║   ██║██╔═══╝ ██║╚██╗██║██║ ██╔██╗ 
╚██████╔╝██║     ██║ ╚████║██║██╔╝ ██╗
 ╚═════╝ ╚═╝     ╚═╝  ╚═══╝╚═╝╚═╝  ╚═╝

OPNix: 1Password Secrets for NixOS

Secure integration between 1Password and NixOS for managing secrets during system builds and home directory setup.

Overview

╭────────────────────────────────────────────╮
│ • Secure secret storage in 1Password       │
│ • NixOS integration via service accounts   │
│ • Build-time secret retrieval             │
│ • Home Manager secret management          │
╰────────────────────────────────────────────╯

Installation

Add OPNix to your NixOS configuration:

{
  inputs.opnix.url = "github:brizzbuzz/opnix";
  
  outputs = { self, nixpkgs, opnix }: {
    nixosConfigurations.yourhostname = nixpkgs.lib.nixosSystem {
      modules = [
        opnix.nixosModules.default
        ./configuration.nix
      ];
    };

    # If using home-manager
    homeConfigurations.yourusername = home-manager.lib.homeManagerConfiguration {
      modules = [
        opnix.homeManagerModules.default
        ./home.nix
      ];
    };
  };
}

Setup

  1. Create a 1Password service account and generate a token:

  2. Store the token securely:

    # Using the opnix CLI (recommended)
sudo opnix token set

# Or with a custom path
sudo opnix token set -path /path/to/token

  3. Create a secrets configuration file for system secrets:

    {
  "secrets": [
    {
      "path": "mysql/root-password",
      "reference": "op://vault/database/root-password"
    },
    {
      "path": "ssl/private-key",
      "reference": "op://vault/certificates/private-key"
    }
  ]
}

  4. Enable OPNix in your NixOS configuration:

    {
  services.onepassword-secrets = {
    enable = true;
    users = [ "yourusername" ];  # Users that need secret access
    tokenFile = "/etc/opnix-token";  # Default location
    configFile = "/path/to/your/secrets.json";
    outputDir = "/var/lib/opnix/secrets";  # Optional, this is the default
  };
}

  5. (Optional) Set up Home Manager integration for user-specific secrets:

    {
  programs.onepassword-secrets = {
    enable = true;
    secrets = [
      {
        # Paths are relative to home directory
        path = ".ssh/id_rsa";
        reference = "op://Personal/ssh-key/private-key"
      }
      {
        path = ".config/secret-app/token";
        reference = "op://Work/api/token"
      }
    ];
  };
}

Commands

╭─ CLI Commands ──────────────────────────────╮
│ opnix secret                               │
│ └─ Retrieve secrets from 1Password         │
│                                           │
│ opnix token set                           │
│ └─ Set up service account token           │
╰───────────────────────────────────────────╯

Security Considerations

Token Storage

  • Store token file with proper permissions (600 for system, 640 for group access)
  • Default location: /etc/opnix-token
  • Never commit tokens to version control
  • Access controlled via onepassword-secrets group for Home Manager users

Service Account Security

  • Use minimal required permissions
  • Rotate tokens regularly
  • Monitor service account activity

Troubleshooting

Common issues and solutions:

  1. Token File Issues:

    Error: Token file not found
▪ Check if /etc/opnix-token exists
▪ Verify file permissions
▪ For Home Manager, ensure user in onepassword-secrets group

  2. Authentication Problems:

    Error: Authentication failed
▪ Verify token validity
▪ Check service account permissions

  3. Secret Access:

    Error: Cannot access secret
▪ Verify secret reference format
▪ Check service account vault access

Development

For local development:

# Enter development shell
nix develop

# Run tests
go test ./...

License

MIT License

Credits