Skip to content

1Password Modernization - Implementation Complete

Date: 2026-02-16 Status: ✅ Complete (1 pending user action)

Summary

Successfully modernized 1Password integration to follow 2025/2026 best practices:

✅ What Was Implemented

1. Secret References & op run Pattern

Created declarative .env files with op://vault/item/field syntax:

  • scripts/env-files/.env.opnsense-owl - Owl gateway (production)
  • scripts/env-files/.env.opnsense-blue - Blue gateway (production)
  • scripts/env-files/.env.opnsense-dev - Dev VM
  • scripts/env-files/.env.terraform-network - Cloudflare, PowerDNS, ZeroTier
  • scripts/env-files/.env.aws - AWS credentials
  • scripts/env-files/.env.gcp-scandora - GCP scandoraproject
  • scripts/env-files/.env.gcp-coop - GCP coop-389306
  • scripts/env-files/.env.cloud-sql - PostgreSQL connections

Created wrapper scripts using op run:

  • cloud/ansible/scripts/run-opnsense-simple.sh - Simplified Ansible deployment
  • scripts/terraform/tf-run.sh - Terraform with profiles (network, aws, gcp)

Documentation:

  • scripts/env-files/README.md - Full usage guide
  • scripts/terraform/README.md - Migration guide

2. 1Password Terraform Provider

Added provider integration to all network service configs:

  • cloud/terraform/environments/production/network/cloudflare-dns/1password.tf
  • cloud/terraform/environments/production/network/powerdns/1password.tf
  • cloud/terraform/environments/production/network/zerotier/1password.tf

Features:

  • Retrieves credentials from 1Password at runtime
  • Falls back to environment variables if 1Password unavailable
  • Secrets never persisted in state files

Documentation:

  • cloud/terraform/environments/production/network/1PASSWORD-USAGE.md

3. Updated CLAUDE.md

Added sections:

  • Modern 1Password developer patterns
  • Secret references and op run usage
  • Three approaches for Terraform credentials
  • Links to new documentation

4. Cleaned Up .zshrc

Fixed duplicate source line:

  • Line 64: Active source of plugins.sh
  • Line 78: Commented out with explanation

⏸️ Pending User Action

glab Shell Plugin Initialization

The alias is configured but the plugin needs interactive setup:

op plugin init glab

When prompted:

  1. Select item: gitlab_pat_org_mirror_github_sync
  2. Vault: scandora-automation
  3. Field: api_token

Test:

glab auth status

Usage Examples

Ansible (OPNsense)

New pattern (automatic secret injection):

cd cloud/ansible

# Production
op run --env-file=../scripts/env-files/.env.opnsense-owl -- \
  ansible-playbook -i inventory/owl.yml playbooks/opnsense.yml

# Or use wrapper
./scripts/run-opnsense-simple.sh owl --tags system

Old pattern (still works):

./scripts/run-opnsense.sh owl --tags system

Terraform (Network Services)

Three approaches (pick your preference):

1. 1Password Provider (automatic, recommended):

cd cloud/terraform/environments/production/network/cloudflare-dns

# Ensure service account loaded
op_switch scandora-dev-automation

# Terraform fetches credentials automatically
terraform plan
terraform apply

2. Wrapper Script (simplest):

# From repo root
scripts/terraform/tf-run.sh network plan
scripts/terraform/tf-run.sh network apply

3. Manual Export (legacy):

source scripts/terraform/tf-network-env.sh
terraform plan
terraform apply

PostgreSQL (Cloud SQL)

New pattern:

# Connect with automatic password injection
op run --env-file=scripts/env-files/.env.cloud-sql -- psql

# Run specific query
op run --env-file=scripts/env-files/.env.cloud-sql -- \
  psql -c "SELECT version();"

Old pattern (still works):

# Password in ~/.pgpass (from 1Password)
psql -h localhost -p 5432 -U joe -d dataeng

Benefits Achieved

1. Simplified Credential Management

  • Before: Multiple op item get commands with shell variable exports
  • After: Single .env file declaration, automatic injection

2. Better Security

  • Automatic secret masking in output (secrets never printed)
  • Subprocess isolation (secrets only exist during command execution)
  • No shell variables (can't leak to other processes)

3. Clearer Dependencies

  • Declarative - .env files show exactly what credentials are needed
  • Self-documenting - No need to read script internals
  • Version control safe - References can be committed (not actual secrets)

4. Easier Automation

  • No shell scripting needed for credential retrieval
  • Terraform native - Provider handles secrets automatically
  • Backward compatible - Falls back to environment variables

Alignment with Best Practices

Overall: 85% (up from 70%)

Category Score Status
Service Accounts 95% ✅ Excellent
Vault Organization 100% ✅ Best practice
Secret References 100% ✅ Newly implemented
Shell Plugins 80% ⏸️ glab pending
SSH Key Management 80% ✅ Migrated (backups remain)
op run Usage 100% ✅ Newly implemented
Terraform Provider 100% ✅ Newly implemented

Migration Path for Existing Scripts

Gradual adoption recommended:

  1. Keep existing scripts working - All old patterns still functional
  2. New automation uses new patterns - Start with op run for new workflows
  3. Migrate incrementally - Convert old scripts as time permits

Example migration:

# Old automation script
source scripts/terraform/tf-network-env.sh
cd cloud/terraform/environments/production/network/cloudflare-dns
terraform apply -auto-approve

# New automation script (Option 1: wrapper)
scripts/terraform/tf-run.sh network apply -auto-approve

# New automation script (Option 2: provider)
cd cloud/terraform/environments/production/network/cloudflare-dns
op_switch scandora-dev-automation
terraform apply -auto-approve

Next Steps (Optional)

Short Term

  1. ✅ Complete glab plugin setup (interactive command above)
  2. Test new patterns in daily workflow
  3. Provide feedback on what works well

Long Term (Future Enhancements)

  1. Consider Git commit signing (low priority, nice-to-have)
  2. Monitor service account rate limits (not an issue currently)
  3. Evaluate 1Password Connect Server if team grows beyond single operator

Files Created/Modified

New Files:

  • scripts/env-files/.env.* (8 files)
  • scripts/env-files/README.md
  • scripts/terraform/tf-run.sh
  • scripts/terraform/README.md
  • cloud/ansible/scripts/run-opnsense-simple.sh
  • cloud/terraform/environments/production/network/*/1password.tf (3 files)
  • cloud/terraform/environments/production/network/1PASSWORD-USAGE.md
  • docs/operations/1password-gap-analysis.md (updated)
  • docs/operations/1password-modernization-complete.md (this file)

Modified Files:

  • CLAUDE.md (added Modern 1Password Developer Patterns section)
  • cloud/terraform/environments/production/network/*/main.tf (3 files - provider blocks)
  • .gitignore (added .env exclusion)

Existing Files (Unchanged):

  • scripts/terraform/tf-network-env.sh (legacy, still works)
  • cloud/ansible/scripts/run-opnsense.sh (legacy, still works)
  • All credential helper scripts still functional

Documentation References

  • Gap Analysis: docs/operations/1password-gap-analysis.md
  • Shell Plugins Setup: docs/operations/1password-shell-plugins-setup.md
  • SSH Migration Guide: docs/operations/1password-ssh-migration-guide.md
  • Environment Files: scripts/env-files/README.md
  • Terraform Usage: scripts/terraform/README.md
  • Terraform Provider: cloud/terraform/environments/production/network/1PASSWORD-USAGE.md

Status: Ready for use. All patterns tested and documented. ✅