noconnorandClaude Opus 5
c6e5f22acb
Secrets were pulled in each box's hand-written ~/.zshrc.local with one `op read` per field on EVERY new shell: every terminal waited on 1Password, every shell broke when it was unreachable, and the loop lived outside the repo. New secrets/ module (after bin/, which provides op and jq): one vault per user and one item, both defaulting to the login name, whose field labels are the variable names. It asks for the service-account token once (hidden), fetches the item with a single `op item get`, and writes every valid-named field to ~/.config/dotfiles/secrets.env (0600), replaced atomically so a failed fetch keeps the previous copy. Values go through jq @sh, so quotes, $() and newlines in a secret can't break or inject. The token is kept in op.env (0600), which shells never source. bootstrap loads secrets.env right after the module, so mcp-config takes LITELLM_KEY from the env instead of prompting. A LITELLM_KEY rotated in the vault also updates ~/.config/mcp-sync/key, since sync.sh re-exports from that file after secrets.env loads and would otherwise win. The managed zshrc sources secrets.env (no op call at startup) and adds envr / envc / envd / envl / envs to read, upsert, delete, list and refresh; they load the token only in a subshell. Existing boxes still need the old op loop removed from ~/.zshrc.local. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
148 lines
5.7 KiB
Bash
148 lines
5.7 KiB
Bash
# Managed by dotfiles/zsh/install.sh — edits made directly to ~/.zshrc will be
|
|
# overwritten on the next bootstrap run. Edit zsh/zshrc in the dotfiles repo
|
|
# instead.
|
|
|
|
# If this account was added to the docker group (dotfiles/docker/install.sh)
|
|
# but this shell's session predates that, re-exec via newgrp so docker works
|
|
# without a full logout. Guarded: fires only when the group is on the account
|
|
# yet missing from the running shell's groups, so the newgrp'd shell (which
|
|
# has the group) cannot loop.
|
|
# Only for real terminals ([ -t 0 ]): newgrp replaces the shell and would
|
|
# swallow the command in scripted `zsh -i -c ...` invocations.
|
|
if [ -t 0 ] && [ -S /var/run/docker.sock ] \
|
|
&& id -nG "${USER:-$(id -un)}" 2>/dev/null | grep -qw docker \
|
|
&& ! id -Gn 2>/dev/null | grep -qw docker; then
|
|
exec newgrp docker
|
|
fi
|
|
|
|
# Userland tools installed by dotfiles/bin/install.sh live here.
|
|
case ":$PATH:" in
|
|
*":$HOME/.local/bin:"*) ;;
|
|
*) export PATH="$HOME/.local/bin:$PATH" ;;
|
|
esac
|
|
|
|
export ZSH="$HOME/.oh-my-zsh"
|
|
|
|
ZSH_THEME="robbyrussell"
|
|
|
|
plugins=(git)
|
|
|
|
source "$ZSH/oh-my-zsh.sh"
|
|
|
|
HISTSIZE=10000
|
|
SAVEHIST=10000
|
|
setopt SHARE_HISTORY
|
|
setopt HIST_IGNORE_DUPS
|
|
|
|
# Delete remote branches without fighting tab-completion.
|
|
#
|
|
# `git push origin --delete <TAB>` completes to `origin/foo`, but `origin/foo`
|
|
# is a LOCAL remote-tracking name — the ref on the server is just `foo`. So the
|
|
# command zsh completes for you is the one git rejects, with "remote ref does
|
|
# not exist", which reads like the branch is missing rather than misnamed.
|
|
#
|
|
# grmb takes either form. It fetches with --prune first so branches already
|
|
# deleted on the server stop being offered at all (that is the other half of
|
|
# this annoyance, and `fetch.prune = true` from dotfiles/git/install.sh makes it
|
|
# automatic everywhere else).
|
|
#
|
|
# Named grmb, not gbd: oh-my-zsh's git plugin already binds gbd to
|
|
# `git branch --delete`, aliases resolve before functions, and the collision
|
|
# fails in the worst possible way — `gbd origin/foo` would quietly try to
|
|
# delete a LOCAL branch instead of the remote one. Check with `type <name>`
|
|
# before adding any g* helper here.
|
|
#
|
|
# grmb origin/my-branch # completed form, works
|
|
# grmb my-branch other # bare form, several at once
|
|
grmb() {
|
|
emulate -L zsh
|
|
local remote=origin b rc=0
|
|
if [ "$#" -eq 0 ]; then
|
|
print -u2 "grmb: usage: grmb <branch>... (origin/ prefix optional)"
|
|
return 2
|
|
fi
|
|
git fetch --prune --quiet "$remote" || return 1
|
|
for b in "$@"; do
|
|
b=${b#${remote}/}
|
|
if git push "$remote" --delete "$b"; then
|
|
print "deleted ${remote}/${b}"
|
|
else
|
|
print -u2 "grmb: could not delete ${b} (already gone? check: git ls-remote --heads ${remote})"
|
|
rc=1
|
|
fi
|
|
done
|
|
return $rc
|
|
}
|
|
|
|
# Secrets from this user's 1Password vault, written by dotfiles/secrets/install.sh.
|
|
# Reading a local 0600 file keeps shell startup off the network: nothing here
|
|
# calls op. envc/envd refresh the file themselves; after editing the vault
|
|
# anywhere else (the 1Password app, another box), run `envs`.
|
|
_DOTFILES_CONF="$HOME/.config/dotfiles"
|
|
[ -f "$_DOTFILES_CONF/secrets.env" ] && source "$_DOTFILES_CONF/secrets.env"
|
|
|
|
# envr NAME read one field straight from the vault
|
|
# envc NAME [VALUE] create or update a field (prompts, hidden, when VALUE is
|
|
# omitted, which keeps the secret out of shell history),
|
|
# then refresh and reload this shell
|
|
# envd NAME delete a field, refresh, and unset it in this shell
|
|
# envl [VAULT [ITEM]] show every field and its current value (default: your
|
|
# vault and item from op.env)
|
|
# envs re-fetch the vault into secrets.env and reload this shell
|
|
#
|
|
# The service-account token lives in op.env and is loaded only inside these
|
|
# subshells, so it never lands in the environment of everything you run.
|
|
_dotfiles_op() {
|
|
[ -f "$_DOTFILES_CONF/op.env" ] || { print -u2 "no $_DOTFILES_CONF/op.env; run: envs"; return 1; }
|
|
( set -a; source "$_DOTFILES_CONF/op.env"; set +a; "$@" )
|
|
}
|
|
_dotfiles_env_name() {
|
|
[[ "$1" =~ '^[A-Za-z_][A-Za-z0-9_]*$' ]] && return 0
|
|
print -u2 "$2: '$1' is not a valid variable name"; return 2
|
|
}
|
|
envr() {
|
|
_dotfiles_env_name "$1" envr || return
|
|
_dotfiles_op sh -c 'op read "op://$OP_VAULT/$OP_ITEM/$1"' envr "$1"
|
|
}
|
|
envc() {
|
|
emulate -L zsh
|
|
local name=$1 value
|
|
_dotfiles_env_name "$name" envc || return
|
|
if (( $# >= 2 )); then
|
|
value=$2
|
|
else
|
|
read -rs "value?$name: " && print
|
|
fi
|
|
# [concealed] makes it a password field; an existing field of that name is updated.
|
|
_dotfiles_op sh -c 'op item edit "$OP_ITEM" --vault "$OP_VAULT" "$1[concealed]=$2" >/dev/null' \
|
|
envc "$name" "$value" && envs
|
|
}
|
|
envd() {
|
|
_dotfiles_env_name "$1" envd || return
|
|
_dotfiles_op sh -c 'op item edit "$OP_ITEM" --vault "$OP_VAULT" "$1[delete]" >/dev/null' envd "$1" \
|
|
&& unset "$1" && envs
|
|
}
|
|
envl() {
|
|
_dotfiles_op sh -c '
|
|
vault=${1:-$OP_VAULT} item=${2:-$OP_ITEM}
|
|
printf "op://%s/%s\n" "$vault" "$item" >&2
|
|
op item get "$item" --vault "$vault" --reveal --format json' envl "$@" \
|
|
| jq -r '
|
|
[.fields[] | select(.purpose != "NOTES")] as $f
|
|
| ([$f[] | .label // "" | length] | max // 0) as $w
|
|
| $f[]
|
|
| ((.label // "") + " " * ($w - ((.label // "") | length))) as $name
|
|
| ((.value // "") | split("\n")) as $lines
|
|
| "\($name) \($lines[0] // "")",
|
|
($lines[1:][] | (" " * ($w + 2)) + .)'
|
|
}
|
|
envs() {
|
|
"${DOTFILES_DIR:-$HOME/.dotfiles}/secrets/install.sh" \
|
|
&& source "$_DOTFILES_CONF/secrets.env"
|
|
}
|
|
|
|
# Per-machine customizations (secrets, keys, local overrides) live in
|
|
# ~/.zshrc.local, which bootstrap never touches. See zsh/zshrc.local.example
|
|
# for the variables modules look for. Loaded last so it can override anything.
|
|
[ -f "$HOME/.zshrc.local" ] && source "$HOME/.zshrc.local"
|