noconnorandClaude Opus 5
c6e5f22acb
Secrets were pulled in each box's hand-written ~/.zshrc.local with one `op read` per field on EVERY new shell: every terminal waited on 1Password, every shell broke when it was unreachable, and the loop lived outside the repo. New secrets/ module (after bin/, which provides op and jq): one vault per user and one item, both defaulting to the login name, whose field labels are the variable names. It asks for the service-account token once (hidden), fetches the item with a single `op item get`, and writes every valid-named field to ~/.config/dotfiles/secrets.env (0600), replaced atomically so a failed fetch keeps the previous copy. Values go through jq @sh, so quotes, $() and newlines in a secret can't break or inject. The token is kept in op.env (0600), which shells never source. bootstrap loads secrets.env right after the module, so mcp-config takes LITELLM_KEY from the env instead of prompting. A LITELLM_KEY rotated in the vault also updates ~/.config/mcp-sync/key, since sync.sh re-exports from that file after secrets.env loads and would otherwise win. The managed zshrc sources secrets.env (no op call at startup) and adds envr / envc / envd / envl / envs to read, upsert, delete, list and refresh; they load the token only in a subshell. Existing boxes still need the old op loop removed from ~/.zshrc.local. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
59 lines
3.2 KiB
Plaintext
59 lines
3.2 KiB
Plaintext
# ~/.zshrc.local — per-machine customizations. Copy this file to
|
|
# ~/.zshrc.local and fill in what this box needs. It is sourced at the end
|
|
# of the managed ~/.zshrc, is never overwritten by bootstrap, and never
|
|
# lives in the repo. Secrets normally come from your 1Password vault instead
|
|
# (secrets/install.sh -> ~/.config/dotfiles/secrets.env); set one here only on
|
|
# a box without 1Password, or to override the vault's value on this machine.
|
|
#
|
|
# cp zsh/zshrc.local.example ~/.zshrc.local && chmod 600 ~/.zshrc.local
|
|
|
|
# --- Gitea -------------------------------------------------------------
|
|
# Personal access token for git.nic-oconnor.com (API/CLI use; HTTPS git
|
|
# auth itself goes through credential.helper store, see git/).
|
|
# export GITEA_KEY=...
|
|
|
|
# --- covert-gpt LiteLLM gateway -----------------------------------------
|
|
# LITELLM_KEY is normally exported by mcp-config's sync hook from
|
|
# ~/.config/mcp-sync/key — run mcp-config/install.sh once instead of
|
|
# setting it here. Only set it here on a box without mcp-sync:
|
|
# export LITELLM_KEY=sk-...
|
|
#
|
|
# Hermes Agent uses the same key and endpoint. The base_url is configured
|
|
# in ~/.hermes/config.yaml to point to your covert-gpt gateway
|
|
# (https://llm.covert-gpt.com). Run hermes setup or update config.yaml
|
|
# to set the default model (see ~/.hermes/config.yaml for available models).
|
|
|
|
# mcp-config/install.sh records the checkout it ran from, and the sync reads
|
|
# the config and skills from there — no download, no anonymous read of the repo.
|
|
# To point it at a DIFFERENT checkout (e.g. develop against a feature branch
|
|
# while ~/.dotfiles stays on main), set one variable:
|
|
# MCP_SYNC_REPO="$HOME/source/dotfiles"
|
|
#
|
|
# Only the bootstrap-managed checkout (~/.dotfiles) is ever `git pull`-ed by the
|
|
# hook, and only when clean — a tree you work in is read, never touched.
|
|
|
|
# --- 1Password -----------------------------------------------------------
|
|
# Nothing to set here. Do NOT loop over `op read` in this file: that ran on
|
|
# every shell. secrets/install.sh stores the service-account token in
|
|
# ~/.config/dotfiles/op.env and writes the vault's fields to secrets.env, which
|
|
# the managed ~/.zshrc loads. Use envr / envc / envd (see zsh/zshrc).
|
|
|
|
# --- Proxmox -------------------------------------------------------------
|
|
# One pair of credentials, several consumers: the proxmox MCP server
|
|
# (mcp-config/opencode.gateway.json) and the terraform layer in
|
|
# rke2-devops-airgap, whose Taskfile composes PROXMOX_VE_API_TOKEN from them.
|
|
# Unprefixed on purpose — these are Proxmox credentials, not MCP ones.
|
|
#
|
|
# secrets.env already exports them from your vault item, so these lines are
|
|
# only needed without 1Password. Never committed.
|
|
# export PROXMOX_TOKEN_ID="root@pam!terragrunt-proxmox"
|
|
# export PROXMOX_TOKEN_SECRET="00000000-0000-0000-0000-000000000000"
|
|
#
|
|
# The host and TLS setting are hardcoded per-server in the MCP config and read
|
|
# from variables.yaml by terraform, so there is nothing to export for them.
|
|
|
|
# --- Anything else -------------------------------------------------------
|
|
# Aliases, PATH additions, kubeconfig defaults, etc. This file loads last,
|
|
# so it can override anything the managed zshrc sets.
|
|
# export KUBECONFIG="$HOME/.kube/homelab.yaml"
|