Skip to main content

Security And Secrets

This setup assumes secrets live outside the git repo:

  • SSH private keys: in 1Password (via the 1Password SSH agent)
  • API tokens and small secrets: in pass (password-store)

1Password​

The 1Password SSH agent is the expected SSH identity provider.

The 1Password SSH agent itself is configured via:

This controls which 1Password items (ssh keys) are available to the agent based on isWork.

GPG Agent (Pinentry + Cache TTL)​

This setup configures gpg-agent to:

  • use pinentry-mac on macOS
  • set a cache TTL based on the pgpCacheTtl prompt

Relevant files:

Password Store (pass)​

Fish loads several API keys from pass if they are not already set in the environment:

On first setup, pass is installed and the password store is cloned via:

That script also imports PGP keys (via op read) and adjusts trust for the primary identity.

Work vs Personal Password Stores​

On non-work machines, fish defines helpers to switch the PASSWORD_STORE_DIR:

  • wpass selects a work password store
  • ppass resets back to the default

Implementation:

On first setup, the pass bootstrap script attempts to clone both password-store repositories on non-work machines:

  • personal store -> ~/.password-store
  • work store (optional) -> ~/.password-store-work

See:

Verification And Troubleshooting​

Check security wiring:

echo "$SSH_AUTH_SOCK"
git config --get core.sshCommand
gpgconf --list-options gpg-agent | rg -i 'default-cache-ttl|max-cache-ttl'

Check password-store switching:

wpass
echo "$PASSWORD_STORE_DIR"
ppass
echo "$PASSWORD_STORE_DIR"

If secrets are missing at runtime: