JARVISandClaude Opus 5.5
78ac06378e
Deliver vault_op_service_account_claude to the agent hosts and install a role-owned ~multica/.local/bin/op shim that exports OP_SERVICE_ACCOUNT_TOKEN to /usr/bin/op only. op run / op plugin run get env -u spliced after "--" so the child never sees the token. The daemon unit is untouched (WDWL-18). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
56 lines
1.9 KiB
Django/Jinja
56 lines
1.9 KiB
Django/Jinja
#!/bin/sh
|
|
# {{ ansible_managed }}
|
|
#
|
|
# 1Password CLI shim for the Multica daemon user (multica_agent_host role,
|
|
# WDWL-37). Reads the service account token from a 0600 file and exports it
|
|
# to {{ multica_op_binary }} only, so it never sits in an agent's shell
|
|
# environment.
|
|
token_file="{{ multica_op_token_file }}"
|
|
|
|
if [ ! -r "$token_file" ]; then
|
|
echo "op: no 1Password service account token at $token_file" >&2
|
|
exit 78
|
|
fi
|
|
IFS= read -r OP_SERVICE_ACCOUNT_TOKEN < "$token_file"
|
|
if [ -z "$OP_SERVICE_ACCOUNT_TOKEN" ]; then
|
|
echo "op: 1Password service account token file $token_file is empty" >&2
|
|
exit 78
|
|
fi
|
|
export OP_SERVICE_ACCOUNT_TOKEN
|
|
|
|
# `op run` (and `op plugin run`) hand their own environment, token included,
|
|
# to the command they start. Find the subcommand, skipping global flags that
|
|
# take a value, and stop at the first `--`.
|
|
sub1=""; sub2=""; skip=0; help=0
|
|
for a in "$@"; do
|
|
if [ "$skip" = 1 ]; then skip=0; continue; fi
|
|
case "$a" in
|
|
--) break ;;
|
|
-h|--help) help=1 ;;
|
|
--account|--config|--encoding|--format|--session) skip=1 ;;
|
|
-*) ;;
|
|
*) if [ -z "$sub1" ]; then sub1=$a; elif [ -z "$sub2" ]; then sub2=$a; fi ;;
|
|
esac
|
|
done
|
|
|
|
if [ "$sub1" = run ] || { [ "$sub1" = plugin ] && [ "$sub2" = run ]; }; then
|
|
# Rebuild the arguments with `env -u` spliced in after the first `--`, so
|
|
# the child starts without the token.
|
|
n=$#; i=0; spliced=0
|
|
while [ "$i" -lt "$n" ]; do
|
|
a=$1; shift
|
|
set -- "$@" "$a"
|
|
if [ "$spliced" = 0 ] && [ "$a" = "--" ]; then
|
|
set -- "$@" /usr/bin/env -u OP_SERVICE_ACCOUNT_TOKEN
|
|
spliced=1
|
|
fi
|
|
i=$((i + 1))
|
|
done
|
|
if [ "$spliced" = 0 ] && [ "$help" = 0 ]; then
|
|
echo "op: use 'op run [flags] -- <command>'; the shim needs the '--' to keep the service account token out of <command>" >&2
|
|
exit 64
|
|
fi
|
|
fi
|
|
|
|
exec "{{ multica_op_binary }}" "$@"
|