1password not installed on linux (including WSL)?

[ashebanow]

I see you are using the 'op' command in plate and in packages/op-wsl-proxy, but the 1password app & CLI currently are only installed on darwin, via features/darwin/apps.nix. This makes me wonder whether you typically install 1password in your nixOS host configuration(s), or if you always run plate from your mac.

While on the subject of nixos hosts, I get where you are coming from in terms of not making it too easy to build nixOS hosts, but I for one would really appreciate it if you showed some simple examples of a working desktop and server host, because you do abstract out some of the hardware-related bits into feature modules (amd/nvidia, zfs, impermanence, secure-boot, etc.). Knowing how all these fit with each other (and with plate) would be very helpful. Right now I'm take my existing config and then edit things out a few pieces at a time until it works, which is tedious. The examples don't need to be working ones.

[Cu3PO42]

Hi! I took the liberty of moving this to Discussions, since I don't think there's a bug here or feature I'm not already tracking.

For the most part, I have indeed run plate from either macOS or WSL. While I don't explicitly install it on WSL, plate will still call into the 1Password CLI installed on Windows. Even on native Linux, 1Password isn't strictly necessary to use plate, as long as you login via nix run once.

In any case, I have since added 1Password features (both CLI and GUI) for NixOS, but they are not yet public. I can cherry-pick them onto the next branch soon. The next branch is a massive update, and as the name implies, will become the master branch once it is ready. The current master branch will likely not see any noteworthy changes until next is merged. The main blocker for merging it is documentation. I am currently in the process of rewriting the README and giving it a better structure. The updated documentation will also come with examples like the ones you are asking for.

The reason that currently no configurations are included is not at all that I want to make it more difficult to create your own, it's just that I have no configurations that do not include sensitive data. A lot of that is because I have a lot of configurations for hosts at work. And I just haven't gotten around to removing all secrets from a config for my personal PC.

The expected format is really quite simple for a host: it's just a standard NixOS module. The only thing you need to set is the nixpkgs.hostPlatform key. Beyond that, you're free to do whatever. I'll try to put up an example or two in a Gist while I'm still working on my docs. I'll post it here when I do.

[Cu3PO42]

A configuration for a server could, for example, look like in this Gist. This configuration omits a user, but that works just like normal in any NixOS configuration. The above file woudl be placed in hosts/nixos/hostname.nix.

The config for a desktop works the same way, except you'd probably add a desktop environment and you might enable either the AMD or the Nvidia feature. As for all the config options in the feature modules, I hope that the description will typically be suffcient, please let me know if any aren't clear.

[ashebanow]

Thanks very much for this info. Glad to hear you have a nixOS 1password implementation done, as I was going to do it myself.

In my older config I had 1password set up to manage my ssh keys, do git code signing, and so forth.

[Cu3PO42]

I have pushed my 1Password modules to the next branch. There's a NixOS module and a HM module you can enable. For commit signing you will need to separately set:

copper.feature.nixos._1password.gitSigning = {
  enable = true;
  key = "<your public key>";
};

Right now the HM module is for use on Linux only because the paths it sets are only applicable on Linux.

[ashebanow]

Thanks. Here is an excerpt from my older config, for reference. Some notes:

• As far as paths go, here is the stuff from my old config. This assumes you install the MacOS 1Password GUI via nix, not homebrew casks.
• I have an allowed_signers file which I install in ~/.ssh/ via home.file which limits file signing to my github specific ssh key
• on linux systems I don't specify the full store path to op-ssh-sign, since it will be in the path as well. Probably better to ignore this, though, and use the full store path as you currently do.

  programs.git = {
      # usual config stuff omitted...

      # Sign all commits using ssh key via 1password
      signing = {
        key = "PATH/TO/ed25519.pub";
        signByDefault = true;
      };

      # this is the way to point to 1password correctly, not by setting git's
      # signing.gpgPath setting. See:
      # https://discourse.nixos.org/t/cant-commit-with-git-after-installing-1password/34021
      extraConfig = {
        gpg.ssh.program = if pkgs.stdenv.isDarwin
          then "${pkgs._1password-gui}/Applications/1Password.app/Contents/MacOS/op-ssh-sign"
          else "op-ssh-sign";
          # else "${pkgs._1password-gui}/bin/op-ssh-sign";
        # FIXME: should handle wsl2 as well, which wants to run the shell script from the installed
        # windows version of 1password:
        #    /mnt/c/Users/$WINDOWS_USERNAME/AppData/Local/1Password/app/8/op-ssh-sign-wsl
        gpg.ssh.allowedSignersFile = "~/.ssh/allowed_signers";
        gpg.format = "ssh";
  }