Opensesame CLI

A simple command line interface to store and share non-version controlled application secrets files within the 1Password vault structure.

Setup Instructions

1. npm install @launchpadlab/opensesame -g
2. Within your project, ensure a npm command in the package.json file exists for load_secrets: opensesame -d XXX -v XXX -f XXX. If one is not present, add it within the scripts key. For this command -d refers to the document_id in 1Password, -v refers to the vault_id in 1Password, -f refers to the local file_path where the secrets file is located.

{
  ...
  "scripts": {
    ...,
    "load_secrets": "opensesame -d XXX -v XXX -f XXX"
  }
  ...
}

1. If you know the values for -d -v or -f, please insert those values if not already set. Otherwise the CLI tool will guide you through how to set those.
2. Run the command npm run load_secrets and follow on-screen instructions

Manual Instructions

If you prefer, you can manually perform the initial steps and use the CLI for syncing secrets files and diff-ing.

1. Login to 1Password and create a new vault (grab the id of the vault as that will be used for the -v argument to the CLI)
2. Within that vault, upload the secrets file to create a new document (grab the id of the document as that will be used for the -d argument to the CLI)
3. Add the secrets file previously uploaded to 1Password in your project folder and make sure it is not tracked in version control. Grab the file_path within your project for the secrets file as that will be used for the -f argument to the CLI
4. Within the project's package.json file, add a new key within the scripts block for load_secrets: opensesame -d XXX -v XXX -f XXX making sure to replace the XXX values with the respective values captured in the previous steps.
5. Run the command npm run load_secrets and follow on-screen instructions to sync secrets files within 1Password
6. If node or a package.json file is not used for a given project, a direct invocation of the CLI can be used with opensesame -d XXX -v XXX -f XXX. Note: This will only work if the flag values are already set for -d, -v, and -f.

FAQs

• This CLI tool can be used to sync any non-version controlled file into 1Password. Typically this is a .env or application.yml file. However, it can also be used with rails credentials to be used to sync the .key files that are not version controlled.
• To interact with 1Password directly, you can reference their documentation.

Maintainers Only: Publish Command

1. npm publish --access restricted