JARVISandClaude Opus 5.5
be7d4a4378
Agents get `op` so op:// references resolve at command time and secret values stay out of prompts and transcripts. Installed per 1Password's apt instructions (signed-by keyring, debsig policy + keyring, 1password-cli), with the key fingerprint-checked before it is trusted; EL via their yum repo. multica_op_version pins, "" tracks the repo. Tag: multica_op. Optional, default-off hook writes OP_SERVICE_ACCOUNT_TOKEN from the playbook (ansible-vault) to a 0600 file owned by the daemon user. It is deliberately not wired into the daemon environment: the user unit belongs to the multica CLI, and the delivery design is pending. Rolled out with --tags multica_op to haunted-mansion and spaceship-earth; second run changed=0, op 2.41.1 as multica, debsig verifies the .deb. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
38 lines
1.3 KiB
YAML
38 lines
1.3 KiB
YAML
---
|
|
# Delivers the 1Password service account token to a file only the daemon user
|
|
# can read. It deliberately stops there: nothing here puts the token into the
|
|
# daemon's environment. The daemon's systemd user unit belongs to the multica
|
|
# CLI, so the role must not edit it, and exporting the token to the daemon
|
|
# would hand it to every agent process too. See the README.
|
|
|
|
# no_log: a failed assert would otherwise render the token it inspected.
|
|
- name: 1Password token | Require a service account token
|
|
ansible.builtin.assert:
|
|
that:
|
|
- multica_op_service_account_token | length > 0
|
|
- multica_op_service_account_token is match('^ops_')
|
|
fail_msg: >-
|
|
multica_op_deliver_token is true but multica_op_service_account_token is
|
|
not a 1Password service account token (ops_...).
|
|
quiet: true
|
|
no_log: true
|
|
|
|
- name: 1Password token | Create the token directory
|
|
ansible.builtin.file:
|
|
path: "{{ multica_op_token_file | dirname }}"
|
|
state: directory
|
|
owner: "{{ multica_user }}"
|
|
group: "{{ multica_group }}"
|
|
mode: "0700"
|
|
become: true
|
|
|
|
- name: 1Password token | Write the token file
|
|
ansible.builtin.copy:
|
|
dest: "{{ multica_op_token_file }}"
|
|
content: "{{ multica_op_service_account_token }}\n"
|
|
owner: "{{ multica_user }}"
|
|
group: "{{ multica_group }}"
|
|
mode: "0600"
|
|
no_log: true
|
|
become: true
|