olli/omarchy-supplement
Watch
1
0
Fork
You've already forked omarchy-supplement
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
No description
25 commits 1 branch 0 tags 67 KiB
  • Shell 100%
Find a file
Exact
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Oliver Kaup e637fce6fb sops: fetch the age key from Bitwarden Secrets Manager 
Reaching the ansible-all-2 age key through the personal vault with `bw`
does not work unattended: the CLI and the desktop app keep separate
sessions and Linux has no unlock bridge between them. Secrets Manager is
the machine-scoped path - a token per project, and sops asks for the key
through SOPS_AGE_KEY_CMD, so it is never written to disk.

install-sops-key.sh installs bws and the helper, pins bitwarden.eu (bws
defaults to bitwarden.com), stores the token in ~/.config/sops/bws.conf
and exports SOPS_AGE_KEY_CMD via environment.d. The token prompt is
opt-in (--configure) or comes from BWS_ACCESS_TOKEN for re-runs.
2026-10-28 22:52:56 +01:00
.vscode Keyboard layout indicator 2026-05-01 14:04:31 +09:00
bashrc-folder-loader.sh bashrc folder loader with bashrc and sh files, snippet will be updated if present 2026-03-22 20:24:30 +01:00
install-all.sh sops: fetch the age key from Bitwarden Secrets Manager 2026-10-28 22:52:56 +01:00
install-anytype.sh install-all: report failures, fix exec bits, resolve vpn/resolvconf conflict 2026-10-21 22:07:55 +02:00
install-bitwarden.sh install-all: report failures, fix exec bits, resolve vpn/resolvconf conflict 2026-10-21 22:07:55 +02:00
install-dns-utils.sh install-all: report failures, fix exec bits, resolve vpn/resolvconf conflict 2026-10-21 22:07:55 +02:00
install-dotfiles.sh tmux: clone resurrect/continuum checkouts, stow from main 2026-10-28 22:52:48 +01:00
install-keymapp.sh install-all: report failures, fix exec bits, resolve vpn/resolvconf conflict 2026-10-21 22:07:55 +02:00
install-locale.sh Omarchy 4 quattro modernization 2026-09-04 06:18:13 +09:00
install-podman.sh install-all: report failures, fix exec bits, resolve vpn/resolvconf conflict 2026-10-21 22:07:55 +02:00
install-signal.sh install-all: report failures, fix exec bits, resolve vpn/resolvconf conflict 2026-10-21 22:07:55 +02:00
install-sops-key.sh sops: fetch the age key from Bitwarden Secrets Manager 2026-10-28 22:52:56 +01:00
install-stow.sh install-all: report failures, fix exec bits, resolve vpn/resolvconf conflict 2026-10-21 22:07:55 +02:00
install-tmux-resurrect.sh tmux: clone resurrect/continuum checkouts, stow from main 2026-10-28 22:52:48 +01:00
install-vpn-widget.sh Rework dotfiles bootstrap, fix install blockers, add README 2026-10-22 01:08:03 +02:00
install-wireguard.sh install-all: report failures, fix exec bits, resolve vpn/resolvconf conflict 2026-10-21 22:07:55 +02:00
install-yubikey-sshkey.sh Rework dotfiles bootstrap, fix install blockers, add README 2026-10-22 01:08:03 +02:00
install-yubikey.sh updates to vpn, keyboard, yubikey for quattro, add signal and podman 2026-09-28 21:21:02 +02:00
install-zen-browser.sh install-all: report failures, fix exec bits, resolve vpn/resolvconf conflict 2026-10-21 22:07:55 +02:00
README.md sops: fetch the age key from Bitwarden Secrets Manager 2026-10-28 22:52:56 +01:00
remove-omarchy-webapps.sh removed patch-waybar.sh, should be in stow managed dotfiles 2026-09-04 05:42:26 +09:00

README.md

omarchy-supplement

Post-install scripts for Omarchy.

The flow (first-time setup)

  • Clone omarchy-supplement
  • Insert YubiKey
  • Run ./install-all.sh — executes every script in dependency order and summarizes failures at the end; all scripts are idempotent and failed steps can be re-run individually
  • The YubiKey resident SSH key authenticates the private dotfiles repo (fallback: the Codeberg mirror)
  • Bitwarden is installed along the way; afterwards, manually:
    • Log in at bitwarden.eu (master password + YubiKey 2FA)
    • Enable the SSH agent: Bitwarden Settings → SSH agent
  • From then on the "Bitwarden SSH key" vault item authenticates all repos (the ssh config wiring this up comes from the dotfiles via stow); the resident keys stay registered on Forgejo and Codeberg as break-glass

SOPS age key (ansible-all-2)

install-sops-key.sh installs bws (Bitwarden Secrets Manager CLI) and a helper that sops calls through SOPS_AGE_KEY_CMD. The age private key stays in Bitwarden and is fetched at decrypt time, so it is never stored on disk.

This replaces fetching it from the personal vault with bw: the CLI and the desktop app keep separate sessions, and the biometric bridge that would let the CLI reuse an unlocked desktop app exists on Windows and macOS only.

Setup per account (web vault, once):

  1. Organization → Secrets Manager → project, e.g. homelab
  2. Secret SOPS_AGE_KEY = the AGE-SECRET-KEY-… line
  3. Machine account on that project with Can read → create an access token

Then per machine:

./install-sops-key.sh --configure   # paste token; press Enter to accept the
                                    # default secret name SOPS_AGE_KEY

BWS_SERVER_URL defaults to https://vault.bitwarden.eu; bws would otherwise talk to bitwarden.com and fail with an auth error. The token lands in ~/.config/sops/bws.conf (0600), and SOPS_AGE_KEY_CMD is exported via ~/.config/environment.d/60-sops-age-key.conf — log out and back in before sops sees it.

Unattended/CI: set BWS_ACCESS_TOKEN and BWS_SECRET_ID and run the script without --configure.