Repository navigation
1Password: allowed browsers, autostart and SSH agent for every desktop user - #52
Merged
Merged
Conversation
…p user
Zen's extension could not be unlocked by the desktop app: 1Password
rejects browsers it does not know ("UnknownBrowser ... isn't a supported
browser") unless their binary is listed in
/etc/1password/custom_allowed_browsers. customAllowedBrowsers writes it.
System authentication only works once the app has been unlocked with the
account password after it starts, so autostart.enable (default on) starts
it minimised to the tray at every desktop login.
sshAgent.enable (default on) points ssh at ~/.1password/agent.sock only
for users whose socket exists, so users and root without the agent keep
their usual agent and key files.
Polkit is enabled with the module: system authentication and the CLI
and SSH approvals are polkit actions.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
andrewthomaslee
enabled auto-merge (squash)
November 14, 2026 23:49
andrewthomaslee
added a commit
to external-systems/home
that referenced
this pull request
Nov 14, 2026
…nt (#58) ## What - `clanServices/machine-type/pc.nix`: `hostSpec.services.onepassword.customAllowedBrowsers = ["zen"]`. - `flake.lock`: bumps `modules` to 02a60ca (external-systems/modules#52). ## Why The 1Password desktop app rejected Zen as an unknown browser, so Zen's extension needed its own password. modules#52 also adds, for every desktop user on pc machines: - a login autostart that runs `1password --silent`, so system authentication works after the first unlock; - the 1Password SSH agent in `/etc/ssh/ssh_config`, used only once a user has turned the agent on in the app (`Match exec "test -S %d/.1password/agent.sock"`). ## Checks - `fmt`: no changes. - `check`: all checks passed (exit 0), including every machine's evaluation. - Evaluated kamrui-h1: `/etc/1password/custom_allowed_browsers` = `zen`; the ssh_config Match block is present; polkit owners `netsa`, `wife`. 1Password is enabled on beelink, ghost, hp-notebook, kamrui-h1 and nixos, and not on euc-hel-0. ## Reviewer notes - Merge order: modules#52 (merged), then this PR. - After deploying, each user needs to: 1. Quit 1Password once from its ⋮ menu so it reads the allowed-browsers file. 2. Turn on Settings → General → "Keep 1Password in the system tray". 3. Optionally turn on Settings → Developer → "Set up the SSH Agent". 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
flake-parts/nixosModules/onepassword.nix: three new options underhostSpec.services.onepassword, all system-wide so every desktop user gets them, current and future:customAllowedBrowsers(default[]): writes/etc/1password/custom_allowed_browsers(root-owned, mode 0755).autostart.enable(defaulttrue): adds/etc/xdg/autostart/1password.desktop, which runs1password --silent. A user's own~/.config/autostart/1password.desktop("Start at login" in the app) has the same name, so it takes precedence instead of starting a second copy.sshAgent.enable(defaulttrue): adds to/etc/ssh/ssh_configSSH_AUTH_SOCK. The block is added withmkAfter, so it ends at nixpkgs' ownHost *and cannot capture other global options.security.polkit.enable = true: system authentication and the CLI and SSH approvals are polkit actions.tests/fixtures/nixos.nix: setscustomAllowedBrowsers.vm-tests/onepassword.nix: new VM test covering the allowed-browsers file (owner, mode, content), the autostart entry, the polkit owners, andssh -Gbefore and after a user's agent socket exists, as alice, bob and root. It also checks that global options after the Match block still apply.Why
UnknownBrowser(.../zen) isn't a supported browser, which the allowed-browsers file fixes.~/.1password/agent.sock). Keys not stored in 1Password still work, because ssh falls back to its default identity files.Checks
fmt: no changes.check: all checks passed (exit 0).vm-test --check onepassword: evaluates and fits the caps (1 VM, 2048 MiB, 2 vCPUs).vm-test onepassword: passed (41 s, booted on euc-hel-0). The first run failed because a bare host has no polkit; that's why polkit is now enabled by the module.Reviewer notes
nix flake update modules,customAllowedBrowsers = ["zen"]inclanServices/machine-type/pc.nix).🤖 Generated with Claude Code