dotfiles/.secrets.example at master · snics/dotfiles · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
# Secrets Management — 1Password CLI (`op inject`)
#
# Secrets are loaded from ~/.secrets.tpl via `op inject` directly into RAM.
# The template file (zsh/.secrets.tpl) is safe to commit — it only contains
# op:// references, no actual secret values. Nothing is written to disk.
#
# ┌──────────────────────────────────────────────────────┐
# │  ~/.secrets.tpl  →  op inject  →  eval  →  env vars │
# │  (committed)        (Touch ID)    (RAM only)         │
# └──────────────────────────────────────────────────────┘
#
# Setup:
#   1. brew install --cask 1password-cli
#   2. op signin
#   3. Create 1Password items matching the op:// references in zsh/.secrets.tpl
#   4. stow zsh (creates ~/.secrets.tpl symlink)
#   5. Open a new shell — Touch ID prompt resolves secrets
#
# Touch ID behavior:
#   op's internal session cache (~30 min) means Touch ID is NOT prompted
#   on every shell — only when the session expires.
#
# Fallback:
#   If `op` is not installed or ~/.secrets.tpl doesn't exist, .zshrc falls
#   back to sourcing ~/.secrets (plaintext). This file is NOT committed.

# =============================================================================
# Legacy Format (fallback — ~/.secrets, not committed)
# =============================================================================
# If you don't use 1Password, create ~/.secrets with plaintext values:
#
# git config --global user.name "FIRST_NAME LAST_NAME"
# git config --global user.email "MY_NAME@example.com"
# git config --global user.signingkey MY_SIGNINGKEY
# git config --global commit.gpgsign true
#
# export OPENAI_API_KEY="sk-..."
# export ANTHROPIC_API_KEY="sk-ant-..."
# export GOOGLE_API_KEY="..."
# export OPENROUTER_API_KEY="sk-or-..."
# export CONTEXT7_API_KEY="ctx7sk_..."

# =============================================================================
# 1Password Item Setup
# =============================================================================
# Create these items in your 1Password Employee vault:
#
# "Git Config"         → fields: name, email, signingkey
# "OpenAI API Key"     → field: credential
# "Anthropic API Key"  → field: credential
# "Google API Key"     → field: credential
# "OpenRouter API Key" → field: credential
# "Context7 API Key"   → field: credential
#
# Verify references work:
#   op inject -i ~/.secrets.tpl