feat(hermes): 1Password integration for routine credentials - #88
Merged
Conversation
Phase-1: op CLI via install-and-remember + security-1password skill. Phase-2: native secret source backend (pending PR #36896 merge). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…UUID - Remove ANTHROPIC_TOKEN, HERMES_DASHBOARD_BASIC_AUTH_PASSWORD/SECRET, HINDSIGHT_API_KEY from compose env block — they move to /opt/data/.env on silverstone (not visible in Portainer UI, no redeploy to rotate) - Remove HERMES_TUNNEL_ID interpolation; hardcode UUID inline like media.yaml - Add OP_SERVICE_ACCOUNT_TOKEN to .env tier (1Password integration) - Only cross-container secrets remain in Portainer: CAMOFOX_SHARED_KEY, HERMES_API_SERVER_KEY - Update spec to match two-tier secret split Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
OP_SERVICE_ACCOUNT_TOKENenv var tohermes-gateway;opCLI is installed at container runtime by the officialsecurity-1passwordHermes skill via install-and-rememberWhat's in this PR
docs/superpowers/specs/2026-07-02-hermes-1password-integration-design.md— full design specArchitecture
OP_SERVICE_ACCOUNT_TOKEN(Portainer env var) → hermes-gateway container →security-1passwordskill installsopCLI + forwards token to terminal sessions → routines callop read "op://hermes/<item>/<field>"on demand.Infrastructure secrets (ANTHROPIC_TOKEN, CAMOFOX_SHARED_KEY, dashboard keys) remain in Portainer unchanged.
Phase 2
Documents migration path to native startup resolution when PR NousResearch/hermes-agent#36896 merges.
Test plan
🤖 Generated with Claude Code