Erich Blume
a5765f9cf2
## Summary
- Adds `mise run op-backup` task that encrypts a 1Password .1pux export with `age` using the master password + secret key as passphrase, SCPs to indri for borgmatic pickup, then deletes the plaintext
- Adds `age` to the Brewfile
- Borgmatic already backs up `/Users/erichblume/Documents` on indri, which covers the `1password-backup/` subdirectory — no config change needed
## Disaster recovery
1. Restore borgmatic archive to retrieve the `.age` file
2. Open Emergency Kit from safety deposit box
3. `age --decrypt <file>.age > export.1pux` (passphrase: `{master_password}:{secret_key}`)
4. Open `.1pux` with 1Password or unzip to inspect
## Usage
```
# Export all vaults from 1Password desktop app as .1pux, then:
mise run op-backup ~/Documents/1Password-export.1pux
# Or run without args for interactive prompt:
mise run op-backup
```
## Test plan
- [ ] `brew install age`
- [ ] Export a test vault from 1Password as .1pux
- [ ] Run `mise run op-backup` with the export path
- [ ] Verify encrypted file appears on indri at `~/Documents/1password-backup/`
- [ ] Verify plaintext .1pux is deleted from gilbert
- [ ] Test decryption: `age --decrypt <file>.age > test.1pux` with password:secret_key
- [ ] Verify decrypted .1pux can be opened/unzipped
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/136
9 lines
499 B
Ruby
9 lines
499 B
Ruby
# CLI tools for blumeops management
|
|
brew "actionlint" # GitHub/Forgejo Actions workflow linter
|
|
brew "age" # File encryption for 1Password backup (op-backup)
|
|
brew "argocd" # ArgoCD CLI for GitOps management
|
|
brew "bat" # Syntax-highlighted file concatenation
|
|
brew "mise" # Task runner and toolchain manager
|
|
brew "tea" # Gitea/Forgejo CLI for forge.ops.eblu.me
|
|
brew "flyctl" # Fly.io CLI for public proxy management
|
|
brew "podman" # Container CLI (uses VM on macOS, for building/pushing images)
|