torben/chemenu
1
1 Fork 0
Code Issues 40 Pull Requests Actions Packages Releases 41 Wiki Activity
Page: How to Use 1password for settings
Pages
Dev Development Explanation Architecture Explanation Configuration tiers Explanation Knowledge and commitment Explanation Language boundaries Explanation Model and effort selection Explanation Ownership and templates Explanation Pipeline rationale Explanation Telemetry and evaluation Explanation Version model Explanation Why gates are code Explanation Home How to Back up to a synced folder How to Browse with obsidian How to Capture repository docs How to Collect from a synced folder How to Export guidelines How to Export to a synced folder How to Fetch pages behind a login How to Ingest a source How to Maintain the wiki How to Query the wiki How to Run the weekly review How to Set up the mcp server How to Trace and score sessions How to Troubleshoot How to Update an instance How to Use 1password for settings How to Write a site handler How to Install Reference Commands Catalog and log Reference Commands Configuration Reference Commands Content migrations Reference Commands Distribution and versioning Reference Commands Exports Reference Commands Finding and checking Reference Commands Git Reference Commands Instance health Reference Commands Links and citations Reference Commands Pages Reference Commands Provenance Reference Commands Raw material and uploads Reference Commands Telemetry Reference Commands Types instructions and docs Reference Commands Workshop runs and session budget Reference Commands Reference Configuration Reference Exit codes Reference Page types Reference Skills Reference Tutorials First source to first answer Tutorials Sample source Tutorials
Clone
2
How to Use 1password for settings
Wiki Mirror edited this page 2026-10-16 14:43:37 +00:00
Unescape Escape
Table of Contents
This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

Generated from docs/how-to/use-1password-for-settings.md at v10.1.0 – edit the repository, not this wiki.

Use 1Password for settings

Keep secrets and private values (host names, internal URLs) out of the working tree by storing them in 1Password and leaving only an op:// reference in the settings. The committed wikitool.json then works on every machine signed in to the same 1Password account, and in CI. What the files and references are: configuration reference. Why, and what this does not protect against: configuration-tiers.md.

On a desktop

  1. Install the 1Password CLI (op) and turn on its integration with the 1Password desktop app, so op asks the app instead of keeping a session of its own. 1Password's own documentation describes both steps for each platform.

  2. Run the preflight again - tools/preflight.sh, or in PowerShell 7 pwsh -NoProfile -ExecutionPolicy Bypass -File tools/preflight.ps1. It records op in .wikitool-tools.json and shows it as OK; without op the line reads ABSENT, which is no problem until a reference needs it.

  3. Make a vault of its own for this instance, and put each secret or private value into an item there. A vault of its own limits what an unlocked op can reach.

  4. Copy each value's reference (op://<vault>/<item>/<field>) - the 1Password app offers it on the field - and tell the agent which setting it belongs to:

    Set <section>.<field> to the reference op://<vault>/<item>/<field>.

    The agent runs tools/wikitool config set <section>.<field> --ref op://<vault>/<item>/<field>, which writes the reference into wikitool.json. Never paste the value itself into the chat: the agent should never see it.

  5. Check it: tools/wikitool doctor. The settings-secrets line says how many references resolve. When the desktop app asks to approve access, that is the prompt doing its job - a locked app makes the line a WARN, and a command that needs the value stops with exit 42 until you unlock it.

Without 1Password

A reference by name works the same way without op:

  • set the reference: tools/wikitool config set <section>.<field> --ref <name>;
  • put the value into WIKITOOL_SECRET_<NAME> (the name upper-cased) in the environment, or into the secrets file as {"<name>": "<value>"}: ~/.config/chemenu/<instance_id>/secrets.json ($XDG_CONFIG_HOME instead of ~/.config when it is set), readable by you only (chmod 600) - on Windows %APPDATA%\chemenu\<instance_id>\secrets.json. The instance_id is in wikitool.json.

In CI

There are two ways, and which one fits depends on the form of the references:

  • op itself, with a service-account token - for settings that hold op:// references. Install op in the job, run the preflight so it records it, and set OP_SERVICE_ACCOUNT_TOKEN; the references then resolve exactly as on a desktop.
  • 1Password's action resolves the values first - for settings that hold references by name. 1password/load-secrets-action with a service-account token reads an op:// reference into a variable before wikitool starts; name the variable WIKITOOL_SECRET_<NAME> and use {"ref": "<name>"} in the settings. This repository's own CI does this, in .gitea/workflows/ci.yml. An op:// reference in the settings is not resolved this way: it still needs op.

Give the service account access to the instance's own vault only.