Security And Secrets
This setup assumes secrets live outside the git repo:
- SSH private keys: in 1Password (via the 1Password SSH agent)
- API tokens and small secrets: in
pass(password-store) - Machine-local overrides that must not be chezmoi-managed: optional extra files sourced last by the shell profiles (see Shell: Fish)
1Password
The 1Password SSH agent is the expected SSH identity provider.
- SSH config:
home/private_dot_ssh/private_executable_config - Git wiring:
home/private_readonly_dot_gitconfig.tmpl
The 1Password SSH agent itself is configured via:
This controls which 1Password items (ssh keys) are available to the agent.
GPG Agent (Pinentry + Cache TTL)
This setup configures gpg-agent to:
- use
pinentry-macon macOS - set a cache TTL based on the
pgpCacheTtlprompt
Relevant files:
- Prompts:
home/.chezmoi.toml.tmpl - Template:
home/private_dot_gnupg/readonly_gpg-agent.conf.tmpl
Password Store (pass)
Fish loads several API keys from pass if they are not already set in the environment:
home/dot_config/fish/readonly_config.fish.tmpl- Non-fish login profiles are kept side-effect free and do not invoke
pass.
On first setup, pass is installed and the password store is cloned via:
That script also imports PGP keys (via op read) and adjusts trust for the primary identity.
Verification And Troubleshooting
Check security wiring:
echo "$SSH_AUTH_SOCK"
git config --get core.sshCommand
gpgconf --list-options gpg-agent | rg -i 'default-cache-ttl|max-cache-ttl'
If secrets are missing at runtime:
- confirm
passis initialized and unlocked. - confirm secret paths referenced in
home/dot_config/fish/readonly_config.fish.tmplexist.