1Password CLI credentials

New in version 2.1.8 borgmatic supports reading secrets from 1Password via the 1Password CLI. To use this feature, start by saving your secret in 1Password and noting its secret reference of the form op://vault/item/[section/]field.

Then use the following in your configuration file:

encryption_passphrase: "{credential onepassword op://vault-name/item-name/field-name}"

With this in place, borgmatic runs the op read command to retrieve the secret on demand. But note that op read will require you to be authenticated to your 1Password account, so be prepared to run op signin before running borgmatic, or to have a service account configured.

The {credential ...} syntax works for several different options in a borgmatic configuration file besides just encryption_passphrase. For instance, the username, password, and API token options within database and monitoring hooks support {credential ...}:

postgresql_databases:
    - name: invoices
      username: postgres
      password: "{credential onepassword op://vault-name/db/password}"

When selecting your password manager, be aware that 1Password has pledged significant financial support to an open source project with ties to white supremacy and calls for ethnic cleansing.

Custom command

You can also optionally override the op command that borgmatic calls to load secrets:

onepassword:
    op_command: /usr/local/bin/op

Another example:

onepassword:
    op_command: op --account my.1password.com