You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CONFIGURATION.md
+120Lines changed: 120 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -23,6 +23,7 @@ providers:
23
23
24
24
| Provider | Status |
25
25
|----------|--------|
26
+
| `1password` | Stable |
26
27
| `aws_secretsmanager` | Stable |
27
28
| `azure_keyvault` | Stable |
28
29
| `bitwarden` | Stable |
@@ -33,6 +34,125 @@ providers:
33
34
34
35
## Provider Configuration
35
36
37
+
### 1Password (`1password`)
38
+
39
+
Retrieves secrets from 1Password using the 1Password Connect SDK. Supports fetching individual fields, whole sections, or entire items from 1Password vaults.
40
+
41
+
**Dependencies:**
42
+
- No CLI required. Uses the 1Password Go SDK directly.
43
+
44
+
**Configuration:**
45
+
- `ref` (required): The 1Password secret reference in the format `op://<vault>/<item>/[section/]<field>`. sstart supports custom reference formats that allow fetching different scopes of secrets:
46
+
- `op://VaultName/ItemName/fieldName`- Fetch a specific top-level field (not in any section)
47
+
- `op://VaultName/ItemName/sectionName/fieldName`- Fetch a specific field from a section
48
+
- `op://VaultName/ItemName/sectionName`- **Fetch all fields from a section** (custom sstart feature)
49
+
- `op://VaultName/ItemName`- **Fetch all fields from an entire item** (custom sstart feature)
50
+
- `use_section_prefix` (optional): When `true`, fields from sections will have keys prefixed with the section name (e.g., `SectionName_FieldName`). When `false` or not specified, fields use just the field name. Defaults to `false`.
51
+
52
+
**Reference Format Support:**
53
+
sstart extends the standard 1Password reference format to support fetching multiple secrets at once:
54
+
- **Single field references** (`op://vault/item/field` or `op://vault/item/section/field`): Fetch one specific field value
55
+
- **Whole section references** (`op://vault/item/section`): Fetch all fields from a specific section in an item. All fields from that section will be loaded as environment variables.
56
+
- **Whole item references** (`op://vault/item`): Fetch all fields from an entire item, including both top-level fields and fields from all sections. This is useful when you want to load all secrets from an item at once.
57
+
58
+
**Authentication:**
59
+
1Password authentication must be provided via environment variable:
60
+
- `OP_SERVICE_ACCOUNT_TOKEN` (required): Service account token for 1Password Connect API authentication
61
+
62
+
**Example - Fetch a specific field:**
63
+
```yaml
64
+
providers:
65
+
- kind: 1password
66
+
id: onepassword-prod
67
+
ref: op://Production/MyApp/API_KEY
68
+
```
69
+
70
+
**Example - Fetch a whole section:**
71
+
```yaml
72
+
providers:
73
+
- kind: 1password
74
+
id: onepassword-db
75
+
ref: op://Production/MyApp/Database
76
+
keys:
77
+
HOST: DB_HOST
78
+
PORT: DB_PORT
79
+
USERNAME: DB_USER
80
+
PASSWORD: DB_PASSWORD
81
+
```
82
+
83
+
This example fetches all fields from the "Database" section. When using `keys`, only the specified fields will be mapped. If `keys` is omitted, all fields from the section will be loaded.
84
+
85
+
**Example - Fetch whole item with section prefixes:**
86
+
```yaml
87
+
providers:
88
+
- kind: 1password
89
+
id: onepassword-app
90
+
ref: op://Production/MyApp
91
+
use_section_prefix: true
92
+
keys:
93
+
API_KEY: ==
94
+
Database_HOST: ==
95
+
Database_PORT: ==
96
+
Redis_HOST: ==
97
+
```
98
+
99
+
This example fetches all fields from the entire item. With `use_section_prefix: true`, fields from sections are prefixed (e.g., `Database_HOST`), while top-level fields remain unprefixed (e.g., `API_KEY`).
100
+
101
+
**Example - Fetch whole item without section prefixes:**
102
+
```yaml
103
+
providers:
104
+
- kind: 1password
105
+
id: onepassword-app
106
+
ref: op://Production/MyApp
107
+
use_section_prefix: false
108
+
```
109
+
110
+
This example fetches all fields from the entire item without section prefixes. Field names will be just the field names (e.g., `HOST`, `PORT`). Top-level fields take precedence over section fields with the same name (warnings are logged). If the same field name exists in multiple sections, an error will be raised to prevent collisions.
111
+
112
+
**Section Prefix Behavior:**
113
+
- **Default (no prefix)**: When `use_section_prefix` is not specified or set to `false`, fields use just their field names (e.g., `HOST`, `PORT`). This works well when field names are unique across sections.
114
+
- **With prefix**: When `use_section_prefix: true`, fields from sections are prefixed with the section name (e.g., `Database_HOST`, `Database_PORT`). This prevents collisions when the same field name exists in multiple sections.
115
+
116
+
**Collision Handling and Priority:**
117
+
When fetching secrets without section prefixes, sstart handles collisions with a clear priority system:
118
+
119
+
1. **Top-level fields take precedence**: If a field name exists both as a top-level field and in a section, the top-level field value will be used. A warning will be logged suggesting how to access the section field instead.
120
+
121
+
2. **Ambiguous references**: When using a reference like `op://vault/item/DB` where both a top-level field "DB" and a section "DB" exist, sstart will:
122
+
- Use the top-level field (priority)
123
+
- Log a warning about the ambiguous reference
124
+
- Suggest renaming either the top-level field or the section in 1Password to avoid ambiguity, or use `use_section_prefix: true` when fetching the whole item to access both
125
+
126
+
3. **Section-to-section collisions**: If the same field name exists in multiple sections (e.g., `HOST` in both "Database" and "Redis" sections), sstart will return an error. Use `use_section_prefix: true` to load both fields with distinct names.
127
+
128
+
**Examples of collision handling:**
129
+
130
+
- **Top-level field vs section field**: If item has top-level field `DB` and section `DB` with field `HOST`:
131
+
- `op://vault/item/DB`→ Uses top-level field `DB`, warns about section
132
+
- `op://vault/item`→ Uses top-level field `DB`, section field `HOST` is loaded (no collision)
133
+
- If section `DB` also had a field named `DB`, the top-level field takes precedence, and a warning is logged
134
+
135
+
- **Multiple sections with same field name**: If item has `HOST` in both "Database" and "Redis" sections:
- `op://vault/item` with `use_section_prefix: true` → Loads both as `Database_HOST` and `Redis_HOST`
138
+
139
+
**How it works:**
140
+
The provider uses the 1Password Connect SDK to authenticate with 1Password Connect (or 1Password Business/Enterprise) using a service account token. It resolves vault and item names to IDs, then retrieves the specified secrets.
141
+
142
+
sstart implements custom support for 1Password reference formats beyond single-field references:
143
+
- **Section-level fetching** (`op://vault/item/section`): When a reference points to a section (without a field name), sstart fetches all fields within that section and makes them available as environment variables.
144
+
- **Item-level fetching** (`op://vault/item`): When a reference points to just a vault and item (without section or field), sstart fetches all fields from the entire item, including top-level fields and fields from all sections.
145
+
146
+
This custom implementation allows you to efficiently load multiple secrets in a single provider configuration, rather than requiring separate provider entries for each field.
147
+
148
+
**1Password Connect Setup:**
149
+
To use this provider, you need:
150
+
1. 1Password Connect server running (or access to 1Password Business/Enterprise)
151
+
2. A service account token created in your 1Password account
152
+
3. The service account must have access to the vaults and items you want to retrieve
153
+
154
+
For more information on setting up 1Password Connect, see the [1Password Connect documentation](https://developer.1password.com/docs/connect).
155
+
36
156
### AWS Secrets Manager (`aws_secretsmanager`)
37
157
38
158
Retrieves secrets from AWS Secrets Manager. Supports both JSON secrets (parsed into multiple key-value pairs) and plain text secrets.
Copy file name to clipboardExpand all lines: README.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,11 +1,11 @@
1
1
# 🤫 sstart: Secure Start for Cloud-Native Secrets
2
-
sstart is a minimalist, zero-persistence CLI tool that securely retrieves application secrets from multiple backend sources (Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager) and injects them as environment variables into any wrapped process.
2
+
sstart is a minimalist, zero-persistence CLI tool that securely retrieves application secrets from multiple backend sources (1Password, Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager) and injects them as environment variables into any wrapped process.
3
3
4
4
It is the spiritual successor to the [Teller](https://github.com/tellerops/teller), modernized and rebuilt in Go for fast execution, reliability, and cross-platform simplicity.
5
5
6
6
## 🎯 Why sstart?
7
7
8
-
Say goodbye to `.env` files. With sstart, we eliminate the need for static `.env` files that store secrets in your project directory. Instead, secrets are pulled at runtime from secure backends like AWS Secrets Manager, Azure Key Vault, HashiCorp Vault, or GCP Secret Manager.
8
+
Say goodbye to `.env` files. With sstart, we eliminate the need for static `.env` files that store secrets in your project directory. Instead, secrets are pulled at runtime from secure backends like 1Password, AWS Secrets Manager, Azure Key Vault, HashiCorp Vault, or GCP Secret Manager.
9
9
10
10
This approach provides multiple security benefits:
11
11
@@ -17,7 +17,7 @@ You define all your required secrets from all your sources in a single, declarat
17
17
18
18
## Features
19
19
20
-
- 🔐 **Multiple Secret Providers**: Support for AWS Secrets Manager, Azure Key Vault, Bitwarden, HashiCorp Vault, GCP Secret Manager, dotenv files, and more
20
+
- 🔐 **Multiple Secret Providers**: Support for 1Password, AWS Secrets Manager, Azure Key Vault, Bitwarden, HashiCorp Vault, GCP Secret Manager, dotenv files, and more
21
21
- 🔄 **Combine Secrets**: Merge secrets from multiple providers
22
22
- 🚀 **Subprocess Execution**: Automatically inject secrets into subprocesses
23
23
- 🔒 **Secure by Default**: Secrets never appear in shell history or logs
0 commit comments