Felipe M.
1c3fec4797
git.nakama.town auth now goes through a credential helper that reads username/password from 1Password at request time via `op read`, so no secret is ever written to disk or the dotfiles repo. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
26 lines
714 B
Shell
26 lines
714 B
Shell
#!/usr/bin/env bash
|
|
# Git credential helper backed by the 1Password CLI.
|
|
#
|
|
# Scoped to specific hosts via credential.<url>.helper in ~/.gitconfig
|
|
# (see home/dot_gitconfig.tmpl) -- this script itself never sees a URL,
|
|
# it just answers with whatever OP_REF points at for the invoking host.
|
|
#
|
|
# Fields are read live from 1Password on every git operation, so no
|
|
# secret ever touches disk.
|
|
set -euo pipefail
|
|
|
|
op_ref="${GIT_CREDENTIAL_OP_REF:?GIT_CREDENTIAL_OP_REF must be set by the caller}"
|
|
|
|
case "${1:-}" in
|
|
get)
|
|
cat >/dev/null
|
|
echo "username=$(op read "${op_ref}/username")"
|
|
echo "password=$(op read "${op_ref}/password")"
|
|
;;
|
|
store|erase)
|
|
cat >/dev/null
|
|
;;
|
|
*)
|
|
exit 1
|
|
;;
|
|
esac
|