opsops: SOPS(-Nix) Goodies

opsops is a command-line application to generate clear SOPS secrets from a given specification and generate sops-nix snippets for it.

The specification is a YAML/JSON file representing a tree-like structure where terminal nodes represent how the clear secrets will be generated, and internal nodes represent the "path" to the clear secret.

Currently, system processes, scripts and 1password field reference URIs are supported:

secrets:
zamazingo:
secret:
type: "process"value:
command: "zamazingo"arguments: ["--hip", "hop"]github:
token:
type: "script"value:
content: 'printf "%s" "$(gh auth token)"'example.com:
password:
type: "script"value:
interpreter: "python3"content: | import netrc import sys _login, _account, password = netrc.netrc().authenticators("example.com") sys.stdout.write("password")dockerhub:
password:
type: "op"value:
account: "PAIT5BAHSH7DAPEING3EEDIE2E"vault: "Cloud Accounts"item: "yies1Ahl4ahqu1afao4nahshoo"field: "password"influxdb:
token:
type: "op-read"value:
account: "IPAEPH0JI3REE8FICHOOVU4CHA"uri: "op://Devops/OokahCuZ4fo8ahphie1aiFa0ei/API Tokens/write-only"

• opsops: SOPS(-Nix) Goodies
  • Installation
  • Usage
    • Specification
    • See Canonical Specification
    • Render Clear Secrets
    • Create Snippet for sops-nix
  • Development
  • License

Installation

Warning

If 1Password is used, 1Password CLI application (op) must be on PATH when running opsops.

Install opsops into your Nix profile:

nix profile install github:vst/opsops

Alternatively, you can run opsops via nix run without installing it:

nix run github:vst/opsops -- --help

Finally, you can download pre-built binaries from releases page:

https://github.com/vst/opsops/releases

Usage

Specification

A specification is a YAML (or JSON) file. Here is an example:

See Example

## File: opsops.yamlsecrets:
zamazingo:
secret:
type: "process"value:
command: "zamazingo"arguments: ["--hip", "hop"]strip: "both"trailingNewline: "crlf"github:
token:
type: "script"value:
content: 'printf "%s" "$(gh auth token)"'example.com:
password:
type: "script"value:
interpreter: "python3"content: | import netrc import sys _login, _account, password = netrc.netrc().authenticators("example.com") sys.stdout.write("password")dockerhub:
password:
type: "op"value:
account: "PAIT5BAHSH7DAPEING3EEDIE2E"vault: "Cloud Accounts"item: "yies1Ahl4ahqu1afao4nahshoo"field: "password"influxdb:
token:
type: "op-read"value:
account: "IPAEPH0JI3REE8FICHOOVU4CHA"uri: "op://Devops/OokahCuZ4fo8ahphie1aiFa0ei/API Tokens/write-only"

See Canonical Specification

To see canonical/normalized specification:

opsops normalize --input opsops.yaml

See Output

secrets:
dockerhub:
password:
type: opvalue:
account: PAIT5BAHSH7DAPEING3EEDIE2Efield: passworditem: yies1Ahl4ahqu1afao4nahshoonewline: falsesection: nullstrip: nulltrailingNewline: nullvault: Cloud Accountsexample.com:
password:
type: scriptvalue:
arguments: []content: | import netrc import sys _login, _account, password = netrc.netrc().authenticators("example.com") sys.stdout.write("password")interpreter: python3strip: nulltrailingNewline: nullgithub:
token:
type: scriptvalue:
arguments: []content: printf "%s" "$(gh auth token)"interpreter: bashstrip: nulltrailingNewline: nullinfluxdb:
token:
type: op-readvalue:
account: IPAEPH0JI3REE8FICHOOVU4CHAnewline: falsestrip: nulltrailingNewline: nulluri: op://Devops/OokahCuZ4fo8ahphie1aiFa0ei/API Tokens/write-onlyzamazingo:
secret:
type: processvalue:
arguments:
- --hip
- hopcommand: zamazingoenvironment: {}strip: bothtrailingNewline: crlf

Render Clear Secrets

Warning

If 1Password is used, 1Password CLI application (op) should be authenticated first:

eval$(op signin -f [--account <ACCOUNT>])

To render clear secrets:

opsops render --input opsops.yaml

See Output

example.com:
password: passwordgithub:
token: gho_meecubier5dinohSh3tohphaekuo5Phahpeizamazingo:
secret: hebelehubeledockerhub:
password: ohbauy5eing8pheSh6iigooweeZee6chinfluxdb:
token: mu9aephabeadi7zi8goo9peYo8yae7ge

Create Snippet for sops-nix

To create snippet for sops-nix that can be copied/pasted inside the sops-nix module configuration:

opsops snippet sops-nix --input opsops.yaml

See Output

"dockerhub/password"={};"example.com/password"={};"github/token"={};"influxdb/token"={};"zamazingo/secret"={};

... or with some prefix:

opsops snippet sops-nix --input opsops.yaml --prefix my_namespace

See Output

"my_namespace/dockerhub/password"={key="dockerhub/password";};"my_namespace/example.com/password"={key="example.com/password";};"my_namespace/github/token"={key="github/token";};"my_namespace/influxdb/token"={key="influxdb/token";};"my_namespace/zamazingo/secret"={key="zamazingo/secret";};

Development

Provision direnv:

direnv allow

Big, long build command for the impatient:

hpack &&
direnv reload &&
fourmolu -i app/ src/ test/ &&
prettier --write .&&
find . -iname "*.nix" -print0 | xargs --null nixfmt &&
statix check &&
find . -iname "*.sh" -print0 | xargs --null shfmt -w &&
find . -iname "*.sh" -print0 | xargs --null shellcheck &&
taplo lint &&
taplo format &&
hlint app/ src/ test/ &&
cabal build -O0 &&
cabal run -O0 opsops -- --version &&
cabal v1-test --ghc-options=-O0 &&
cabal haddock -O0

To check and build:

cabal verify [-c]

License

See LICENSE.