1Password Connect
Access your 1Password secrets using 1Password Connect
---
With 1Password Connect, you can securely access your 1Password items and vaults in your company's apps and cloud infrastructure using a private REST API or the 1Password CLI.
## ✨ Get started
Check out our [developer documentation](https://developer.1password.com/docs/connect/get-started) to get started. Or see our deployment examples [here](https://github.com/1Password/connect/tree/main/examples).
## 💙 Community & Support
- File an [issue](https://github.com/1Password/connect/issues) for bugs and feature requests.
- Join the [Developer Slack workspace](https://developer.1password.com/joinslack)
- Subscribe to the [Developer Newsletter](https://1password.com/dev-subscribe/)
================================================
FILE: docs/configuration.md
================================================
# Connect Server Configuration
The Connect server consists of 2 containers, `1password/connect-api` and `1password/connect-sync` running in the same network. The two containers require a shared volume to store an encrpyted copy of your data.
## Data Volume
- `/home/opuser/.op/data`: The default location of the shared volume
**Note**: If you use are setting the `XDG_DATA_HOME` environment variable to a path other than `/home/opuser` you will need to mount your data volume at that path as well.
## Environment variables
The following environment variable configuration options are available for both contains:
- `OP_SESSION`: path to the 1password-credentials.json file
- `OP_HTTP_PORT`: port used by the HTTP server
- `OP_LOG_LEVEL`: set the logging level of the container
- `XDG_DATA_HOME`: set the path where the `.op/data` directory should be created
- `OP_BUS_PORT`: the port used for listening to incoming bus connections from other containers (by default, this is a random free port)
- `OP_BUS_PEERS`: a comma-separated listed of `[hostname]:[bus port]` pairs of other containers to connect to (see _Manual bus configuration_ for more details)
All other configuration options are only relevant for the `1password/connect-api` container:
- `OP_HTTPS_PORT`: port used by the HTTP sever when TLS is configured (see below)
- `OP_SYNC_TIMEOUT`: define how long to wait for initial sync to complete
When using TLS with own certificate:
- `OP_TLS_KEY_FILE`: path to the private key file.
- `OP_TLS_CERT_FILE`: path to the certificate file. This should be the full certificate chain.
When using TLS with Let's Encrypt:
- `OP_TLS_USE_LETSENCRYPT`: should be set to any value.
- `OP_TLS_DOMAIN`: the (sub-)domain for which to request a certificate. The DNS-records for this domain must point to the Connect server.
## Manual bus configuration (v1.5.0 and above)
By default, the 2 containers automatically discover and connect to the shared bus. This discovery mechanism requires the `NET_BROADCAST` capability, which cannot always be granted to containers.
It is also possible to manually configure the shared bus:
1. Assign a static port for the bus by setting the `OP_BUS_PORT` environment variable to a free port for all containers.
2. Set the `OP_BUS_PEERS` environment variable for the api container to `[hostname]:[bus port]`, where hostname is the name of the sync container and bus port the value of `OP_BUS_PORT` for the sync container.
3. Set the `OP_BUS_PEERS` environment variable for the sync container to `[hostname]:[bus port]`, where hostname is the name of the api container and bus port the value of `OP_BUS_PORT` for the api container.
For example, if the containers are called `op-connect-api` and `op-connect-sync`. The configuration of `op-connect-api` would be:
```
OP_BUS_PORT=11223
OP_BUS_PEERS=op-connect-sync:11223
```
And for `op-connect-sync`:
```
OP_BUS_PORT=11223
OP_BUS_PEERS=op-connect-api:11223
```
================================================
FILE: docs/openapi/spec.yaml
================================================
openapi: "3.0.2"
info:
title: 1Password Connect
description: >-
REST API interface for 1Password Connect.
version: "1.7.1"
contact:
name: 1Password Integrations
email: support@1password.com
url: https://support.1password.com/
servers:
- url: http://localhost:8080/v1
tags:
- name: Items
description: Access and manage items inside 1Password Vaults
- name: Vaults
description: Access 1Password Vaults
- name: Activity
description: Access API Request Activity
components:
securitySchemes:
ConnectToken:
type: http
scheme: bearer
bearerFormat: JWT
schemas:
ErrorResponse:
type: object
properties:
status:
type: integer
description: HTTP Status Code
message:
type: string
description: A message detailing the error
File:
type: object
properties:
id:
type: string
description: ID of the file
name:
type: string
description: Name of the file
size:
type: integer
description: Size in bytes of the file
content_path:
type: string
description: Path of the Connect API that can be used to download the contents of this file.
readOnly: true
section:
type: object
description: For files that are in a section, this field describes the section.
properties:
id:
type: string
content:
type: string
format: byte
description: Base64-encoded contents of the file. Only set if size <= OP_MAX_INLINE_FILE_SIZE_KB kb and `inline_files` is set to `true`.
example:
id: 6r65pjq33banznomn7q22sj44e
name: foo.txt
size: 35
content_path: v1/vaults/ionaiwtdvgclrixbt6ztpqcxnq/items/p7eflcy7f5mk7vg6zrzf5rjjyu/files/6r65pjq33banznomn7q22sj44e/content
content: VGhlIGZ1dHVyZSBiZWxvbmdzIHRvIHRoZSBjdXJpb3VzLgo=
Vault:
type: object
properties:
id:
type: string
pattern: '^[\da-z]{26}$'
name:
type: string
description:
type: string
attributeVersion:
type: integer
description: The vault version
contentVersion:
type: integer
description: The version of the vault contents
items:
description: Number of active items in the vault
type: integer
type:
type: string
enum:
- USER_CREATED
- PERSONAL
- EVERYONE
- TRANSFER
createdAt:
type: string
format: date-time
readOnly: true
updatedAt:
type: string
format: date-time
readOnly: true
GeneratorRecipe:
description: The recipe is used in conjunction with the "generate" property to set the character set used to generate a new secure value
type: object
properties:
length:
type: integer
description: Length of the generated value
default: 32
minimum: 1
maximum: 64
characterSets:
type: array
items:
type: string
enum:
- LETTERS
- DIGITS
- SYMBOLS
minimum: 0
maximum: 3
uniqueItems: true
excludeCharacters:
type: string
description: "List of all characters that should be excluded from generated passwords."
example: "abc1"
Item:
type: object
required:
- vault
- category
properties:
id:
type: string
pattern: '^[\da-z]{26}$'
title:
type: string
vault:
type: object
required:
- id
properties:
id:
type: string
pattern: '^[\da-z]{26}$'
category:
type: string
enum:
- "LOGIN"
- "PASSWORD"
- "API_CREDENTIAL"
- "SERVER"
- "DATABASE"
- "CREDIT_CARD"
- "MEMBERSHIP"
- "PASSPORT"
- "SOFTWARE_LICENSE"
- "OUTDOOR_LICENSE"
- "SECURE_NOTE"
- "WIRELESS_ROUTER"
- "BANK_ACCOUNT"
- "DRIVER_LICENSE"
- "IDENTITY"
- "REWARD_PROGRAM"
- "DOCUMENT"
- "EMAIL_ACCOUNT"
- "SOCIAL_SECURITY_NUMBER"
- "MEDICAL_RECORD"
- "SSH_KEY"
- "CUSTOM"
urls:
type: array
items:
type: object
required:
- href
properties:
label:
type: string
primary:
type: boolean
href:
type: string
format: url
example:
- primary: true
href: https://example.com
- href: https://example.org
favorite:
type: boolean
default: false
tags:
type: array
items:
type: string
version:
type: integer
state:
type: string
readOnly: true
enum:
- "ARCHIVED"
- "DELETED"
createdAt:
type: string
format: date-time
readOnly: true
updatedAt:
type: string
format: date-time
readOnly: true
lastEditedBy:
type: string
readOnly: true
FullItem:
allOf:
- $ref: "#/components/schemas/Item"
- type: object
properties:
sections:
type: array
items:
type: object
properties:
id:
type: string
label:
type: string
fields:
type: array
items:
$ref: '#/components/schemas/Field'
files:
type: array
items:
$ref: '#/components/schemas/File'
Field:
type: object
required:
- id
- type
properties:
id:
type: string
section:
type: object
properties:
id:
type: string
type:
type: string
default: "STRING"
enum:
- "STRING"
- "EMAIL"
- "CONCEALED"
- "URL"
- "TOTP"
- "DATE"
- "MONTH_YEAR"
- "MENU"
purpose:
description: Some item types, Login and Password, have fields used for autofill. This property indicates that purpose and is required for some item types.
type: string
enum:
- ""
- "USERNAME"
- "PASSWORD"
- "NOTES"
label:
type: string
value:
type: string
generate:
description: If value is not present then a new value should be generated for this field
type: boolean
default: false
recipe:
$ref: "#/components/schemas/GeneratorRecipe"
entropy:
description: For fields with a purpose of `PASSWORD` this is the entropy of the value
type: number
readOnly: true
APIRequest:
description: Represents a request that was made to the API. Including what Token was used and what resource was accessed.
type: object
properties:
requestId:
description: The unique id used to identify a single request.
type: string
format: uuid
timestamp:
description: The time at which the request was processed by the server.
type: string
format: date-time
readOnly: true
action:
type: string
enum:
- READ
- CREATE
- UPDATE
- DELETE
result:
type: string
enum:
- SUCCESS
- DENY
actor:
type: object
properties:
id:
type: string
format: uuid
account:
type: string
jti:
type: string
userAgent:
type: string
requestIp:
type: string
resource:
type: object
properties:
type:
type: string
enum:
- ITEM
- VAULT
vault:
type: object
properties:
id:
type: string
pattern: '^[\da-z]{26}$'
item:
type: object
properties:
id:
type: string
pattern: '^[\da-z]{26}$'
itemVersion:
type: integer
Patch:
type: array
items:
type: object
properties:
op:
type: string
enum: [ add, remove, replace ]
path:
type: string
description: An RFC6901 JSON Pointer pointing to the Item document, an Item Attribute, and Item Field by Field ID, or an Item Field Attribute
example: "/fields/06gnn2b95example10q91512p5/label"
value:
type: object
required:
- op
- path
ServiceDependency:
description: The state of a registered server dependency.
type: object
properties:
service:
type: string
status:
type: string
message:
type: string
description: Human-readable message for explaining the current state.
paths:
/activity:
get:
operationId: GetApiActivity
tags:
- Activity
summary: Retrieve a list of API Requests that have been made.
security:
- ConnectToken: [ ]
parameters:
- in: query
name: limit
schema:
type: integer
example: 10
default: 50
description: How many API Events should be retrieved in a single request.
- in: query
name: offset
schema:
type: integer
example: 50
default: 0
description: How far into the collection of API Events should the response start
responses:
"200":
description: OK
headers:
Content-Range:
description: An decription of what part of the collection has been returned as well as the total size.
schema:
type: string
example: 1-50/1134
content:
application/json:
schema:
type: array
items:
$ref: "#/components/schemas/APIRequest"
"401":
description: Invalid or missing token
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
example:
status: 401
message: Invalid token signature
/vaults:
get:
operationId: GetVaults
tags:
- Vaults
summary: Get all Vaults
security:
- ConnectToken: [ ]
parameters:
- in: query
name: filter
schema:
type: string
example: name eq "Some Vault Name"
description: Filter the Vault collection based on Vault name using SCIM eq filter
responses:
"200":
description: OK
content:
application/json:
schema:
type: array
items:
$ref: "#/components/schemas/Vault"
"401":
description: Invalid or missing token
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
example:
status: 401
message: Invalid token signature
/vaults/{vaultUuid}:
get:
operationId: GetVaultById
tags:
- Vaults
summary: Get Vault details and metadata
security:
- ConnectToken: [ ]
parameters:
- in: path
name: vaultUuid
schema:
type: string
pattern: '^[\da-z]{26}$'
required: true
description: The UUID of the Vault to fetch Items from
responses:
"200":
description: OK
content:
application/json:
schema:
$ref: "#/components/schemas/Vault"
"401":
description: Invalid or missing token
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
example:
status: 401
message: Invalid token signature
"403":
description: Unauthorized access
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
example:
status: 403
message: vault {vaultUuid} is not in scope
"404":
description: Vault not found
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
example:
status: 404
message: vault {itemUuid} not found
/vaults/{vaultUuid}/items:
get:
operationId: GetVaultItems
tags:
- Items
summary: Get all items for inside a Vault
security:
- ConnectToken: [ ]
parameters:
- in: path
name: vaultUuid
schema:
type: string
pattern: '^[\da-z]{26}$'
required: true
description: The UUID of the Vault to fetch Items from
- in: query
name: filter
schema:
type: string
example: title eq "Some Item Name"
description: Filter the Item collection based on Item name using SCIM eq filter
responses:
"200":
description: OK
content:
application/json:
schema:
type: array
items:
$ref: "#/components/schemas/Item"
"401":
description: Invalid or missing token
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
example:
status: 401
message: Invalid token signature
"404":
description: Vault not found
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
example:
status: 404
message: vault {vaultUuid} not found
post:
operationId: CreateVaultItem
tags:
- Items
summary: Create a new Item
security:
- ConnectToken: [ ]
parameters:
- in: path
name: vaultUuid
schema:
type: string
pattern: '^[\da-z]{26}$'
required: true
description: The UUID of the Vault to create an Item in
requestBody:
content:
application/json:
schema:
$ref: "#/components/schemas/FullItem"
responses:
"200":
description: OK
content:
application/json:
schema:
$ref: "#/components/schemas/FullItem"
"400":
description: Unable to create item due to invalid input
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
example:
status: 400
message: Invalid item category
"401":
description: Invalid or missing token
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
example:
status: 401
message: Invalid token signature
"403":
description: Unauthorized access
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
example:
status: 403
message: vault {vaultUuid} is not in scope
"404":
description: Item not found
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
examples:
vaultNotFound:
summary: Vault not found
value:
status: 404
message: vault {vaultUuid} not found
/vaults/{vaultUuid}/items/{itemUuid}:
get:
operationId: GetVaultItemById
tags:
- Items
summary: Get the details of an Item
security:
- ConnectToken: [ ]
parameters:
- in: path
name: vaultUuid
schema:
type: string
pattern: '^[\da-z]{26}$'
required: true
description: The UUID of the Vault to fetch Item from
- in: path
name: itemUuid
schema:
type: string
pattern: '^[\da-z]{26}$'
required: true
description: The UUID of the Item to fetch
responses:
"200":
description: OK
content:
application/json:
schema:
$ref: "#/components/schemas/FullItem"
"401":
description: Invalid or missing token
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
example:
status: 401
message: Invalid token signature
"403":
description: Unauthorized access
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
example:
status: 403
message: vault {vaultUuid} is not in scope
"404":
description: Item not found
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
examples:
itemNotFound:
summary: Item not found
value:
status: 404
message: item {itemUuid} not found
vaultNotFound:
summary: Vault not found
value:
status: 404
message: vault {vaultUuid} not found
put:
operationId: UpdateVaultItem
tags:
- Items
summary: Update an Item
security:
- ConnectToken: [ ]
parameters:
- in: path
name: vaultUuid
schema:
type: string
pattern: '^[\da-z]{26}$'
required: true
description: The UUID of the Item's Vault
- in: path
name: itemUuid
schema:
type: string
pattern: '^[\da-z]{26}$'
required: true
description: The UUID of the Item to update
requestBody:
content:
application/json:
schema:
$ref: "#/components/schemas/FullItem"
responses:
"200":
description: OK
content:
application/json:
schema:
$ref: "#/components/schemas/FullItem"
"400":
description: Unable to create item due to invalid input
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
example:
status: 400
message: The item doesn't have a {example field name} field.
"401":
description: Invalid or missing token
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
example:
status: 401
message: Invalid token signature
"403":
description: Unauthorized access
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
example:
status: 403
message: vault {vaultUuid} is not in scope
"404":
description: Item not found
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
examples:
itemNotFound:
summary: Item not found
value:
status: 404
message: item {itemUuid} not found
vaultNotFound:
summary: Vault not found
value:
status: 404
message: vault {vaultUuid} not found
delete:
operationId: DeleteVaultItem
tags:
- Items
summary: Delete an Item
security:
- ConnectToken: [ ]
parameters:
- in: path
name: vaultUuid
schema:
type: string
pattern: '^[\da-z]{26}$'
required: true
description: The UUID of the Vault the item is in
- in: path
name: itemUuid
schema:
type: string
pattern: '^[\da-z]{26}$'
required: true
description: The UUID of the Item to update
responses:
"204":
description: Successfully deleted an item
"401":
description: Invalid or missing token
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
example:
status: 401
message: Invalid token signature
"403":
description: Unauthorized access
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
example:
status: 403
message: vault {vaultUuid} is not in scope
"404":
description: Item not found
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
examples:
vaultNotFound:
summary: Vault not found
value:
status: 404
message: vault {vaultUuid} not found
patch:
description: >
Applies a modified [RFC6902 JSON Patch](https://tools.ietf.org/html/rfc6902) document to an Item or ItemField. This endpoint only supports `add`, `remove` and `replace` operations.
When modifying a specific ItemField, the ItemField's ID in the `path` attribute of the operation object: `/fields/{fieldId}`
operationId: PatchVaultItem
tags:
- Items
summary: Update a subset of Item attributes
security:
- ConnectToken: [ ]
parameters:
- in: path
name: vaultUuid
schema:
type: string
pattern: '^[\da-z]{26}$'
required: true
description: The UUID of the Vault the item is in
- in: path
name: itemUuid
schema:
type: string
pattern: '^[\da-z]{26}$'
required: true
description: The UUID of the Item to update
requestBody:
content:
application/json:
schema:
$ref: "#/components/schemas/Patch"
examples:
ReplaceAllAttributes:
value:
- op: replace
path: "/"
value: { "title": "New Title", "favorite": true, "tags": [ "tag1", "tag2" ], "...": "Any attr from FullItem schema" }
summary: Replace an entire Item with new fields. Equivalent to a PUT request.
PatchItemAttr:
value:
- op: "replace"
path: "/favorite"
value: true
- op: "remove"
path: "/tags/1"
summary: Update specific Item attributes
PatchItemField:
value:
- op: "add"
path: "/fields"
value: { "label": "New Field", "type": "string", "value": "hunter2" }
summary: Add a new ItemField to the Item
PatchItemFieldWithID:
value:
- op: "replace"
path: "/fields/r9qxq7xnhfhukoxsc8ymqr0y11"
value: { "label": "Replacement Title", "type": "string", "value": "new value" }
- op: "remove"
path: "/fields/h2nl155dshi043yse7wa3u1hs7"
summary: Modify or remove an ItemField.
PatchItemFieldAttr:
value:
- op: "add"
path: "/fields/s2ju540zlna8bdj4uro7sj64rk/label"
value: "New field name"
- op: "remove"
path: "/fields/s2ju540zlna8bdj4uro7sj64rk/value"
summary: Modify a specific ItemField attribute.
responses:
"200":
description: OK - Item updated. If no Patch operations were provided, Item is unmodified.
content:
application/json:
schema:
$ref: "#/components/schemas/FullItem"
"401":
description: Invalid or missing token
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
example:
status: 401
message: Invalid token signature
"403":
description: Unauthorized access
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
example:
status: 403
message: vault {vaultUuid} is not in scope
"404":
description: Item not found
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
examples:
itemNotFound:
summary: Item not found
value:
status: 404
message: item {itemUuid} not found
vaultNotFound:
summary: Vault not found
value:
status: 404
message: vault {vaultUuid} not found
/vaults/{vaultUuid}/items/{itemUuid}/files:
get:
operationId: GetItemFiles
tags:
- Files
summary: Get all the files inside an Item
security:
- ConnectToken: [ ]
parameters:
- in: path
name: vaultUuid
schema:
type: string
format: uuid
required: true
description: The UUID of the Vault to fetch Items from
- in: path
name: itemUuid
schema:
type: string
format: uuid
required: true
description: The UUID of the Item to fetch files from
- in: query
name: inline_files
schema:
type: boolean
example: true
description: Tells server to return the base64-encoded file contents in the response.
responses:
"200":
description: OK
content:
application/json:
schema:
type: array
items:
$ref: "#/components/schemas/File"
"401":
description: Invalid or missing token
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
example:
status: 401
message: Invalid token signature
"404":
description: Item not found
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
examples:
itemNotFound:
summary: Item not found
value:
status: 404
message: item {itemUuid} not found
vaultNotFound:
summary: Vault not found
value:
status: 404
message: vault {vaultUuid} not found
"413":
description: File content too large to display
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
examples:
fileTooLarge:
summary: File too large
value:
status: 413
message: File is too large to inline in request. Use the /v1/vaults/{vaultUUID}/items/{itemUUID}/files/{fileUUID}/content endpoint instead.
/vaults/{vaultUuid}/items/{itemUuid}/files/{fileUuid}:
get:
operationId: GetDetailsOfFileById
tags:
- Files
summary: Get the details of a File
security:
- ConnectToken: [ ]
parameters:
- in: path
name: vaultUuid
schema:
type: string
format: uuid
required: true
description: The UUID of the Vault to fetch Item from
- in: path
name: itemUuid
schema:
type: string
format: uuid
required: true
description: The UUID of the Item to fetch File from
- in: path
name: fileUuid
schema:
type: string
format: uuid
required: true
description: The UUID of the File to fetch
- in: query
name: inline_files
schema:
type: boolean
example: true
description: Tells server to return the base64-encoded file contents in the response.
responses:
"200":
description: OK
content:
application/json:
schema:
$ref: "#/components/schemas/File"
"401":
description: Invalid or missing token
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
example:
status: 401
message: Invalid token signature
"403":
description: Unauthorized access
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
example:
status: 403
message: vault {vaultUuid} is not in scope
"404":
description: File not found
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
examples:
fileNotFound:
summary: File not found
value:
status: 404
message: file {fileUuid} not found
itemNotFound:
summary: Item not found
value:
status: 404
message: item {itemUuid} not found
vaultNotFound:
summary: Vault not found
value:
status: 404
message: vault {vaultUuid} not found
"413":
description: File content too large to display
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
examples:
fileTooLarge:
summary: File too large
value:
status: 413
message: File is too large to inline in request. Use the /v1/vaults/{vaultUUID}/items/{itemUUID}/files/{fileUUID}/content endpoint instead.
/vaults/{vaultUuid}/items/{itemUuid}/files/{fileUuid}/content:
parameters:
- in: path
name: vaultUuid
schema:
type: string
format: uuid
required: true
description: The UUID of the Vault the item is in
- in: path
name: itemUuid
schema:
type: string
format: uuid
required: true
description: The UUID of the Item the File is in
- in: path
name: fileUuid
required: true
schema:
type: string
description: UUID of the file to get content from
get:
operationId: DownloadFileByID
tags:
- Files
summary: Get the content of a File
security:
- ConnectToken: [ ]
responses:
"200":
description: "Success"
content:
application/octet-stream:
schema:
type: string
format: binary
headers:
Content-Disposition:
schema:
type: string
example: attachment; filename="privkey.pem"
Content-Length:
schema:
type: string
example: "6432"
"401":
description: Invalid or missing token
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
example:
status: 401
message: Invalid token signature
"404":
description: File not found
content:
application/json:
schema:
$ref: "#/components/schemas/ErrorResponse"
examples:
fileNotFound:
summary: File not found
value:
status: 404
message: file {fileUuid} not found
itemNotFound:
summary: Item not found
value:
status: 404
message: item {itemUuid} not found
vaultNotFound:
summary: Vault not found
value:
status: 404
message: vault {vaultUuid} not found
/heartbeat:
get:
operationId: GetHeartbeat
tags:
- Health
summary: Ping the server for liveness
servers:
- url: http://localhost:8080
responses:
"200":
description: OK
content:
text/plain:
schema:
type: string
example: .
/health:
get:
operationId: GetServerHealth
tags:
- Health
summary: Get state of the server and its dependencies.
servers:
- url: http://localhost:8080
responses:
"200":
description: OK
content:
application/json:
schema:
type: object
required: [ "name", "version" ]
properties:
name:
type: string
version:
type: string
description: The Connect server's version
dependencies:
type: array
items:
$ref: "#/components/schemas/ServiceDependency"
examples:
WaitingForAPIRequest:
value:
name: 1Password Connect API
version: 1.2.1
dependencies:
- service: sync
status: "TOKEN_NEEDED"
- service: sqlite
status: "ACTIVE"
message: "Connected to./1password.sqlite"
summary: API server waiting for first authenticated request
/metrics:
get:
operationId: GetPrometheusMetrics
tags:
- Metrics
description: See Prometheus documentation for a complete data model.
summary: Query server for exposed Prometheus metrics
servers:
- url: http://localhost:8080
responses:
"200":
description: Successfully returned Prometheus metrics
content:
text/plain:
schema:
type: string
example: |
# HELP go_gc_duration_seconds A summary of the pause duration of garbage collection cycles.
# TYPE go_gc_duration_seconds summary
go_gc_duration_seconds{quantile="0"} 2.9153e-05
go_gc_duration_seconds{quantile="0.25"} 6.2832e-05
go_gc_duration_seconds{quantile="0.5"} 9.7187e-05
go_gc_duration_seconds{quantile="0.75"} 0.000112967
go_gc_duration_seconds{quantile="1"} 0.000215819
go_gc_duration_seconds_sum 0.001376862
go_gc_duration_seconds_count 14
================================================
FILE: examples/aws-ecs-fargate/README.md
================================================
# AWS ECS with Fargate
The CloudFormation document in this folder will create the following resources, along with the necessary rules, groups, and policies to make them work.
The result is a publicly accessible hostname (via HTTPS) that routes requests to a 1Password Connect instance running in AWS Fargate. You can use your own VPC and subnets, or optionally set up DNS records automatically with Route 53.
To customize further, like deploying into an existing ECS cluster, use this CloudFormation as a starting point and tweak it with a text editor or Amazon's CloudFormation Designer tool.
## Networking Resources
- An ACM certificate for HTTPS
- An ALB (Application Load Balancer) with HTTPS
- A VPC (optional, if you don’t provide your own)
- 2 Public subnets (optional, if you don’t provide your own)
- An Internet Gateway (optional, if creating a VPC)
- Route 53 DNS records (optional, if you provide a hosted zone ID)
## ECS Resources
- An ECS Cluster
- Task Definition
- `1password/connect-api` container
- `1password/connect-sync` container
- Service Discovery for internal routing
## Getting Started
When [importing this CloudFormation template](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-using-console-create-stack-template.html), you’ll be prompted to provide the following:
- **CredentialsJson**: The plain JSON contents of your `1password-credentials.json` file. The template will encode this to base64 and store it securely in AWS Secrets Manager.
- **DomainName**: A fully qualified domain name for the ALB (e.g., `connect.example.com`). This is required for HTTPS.
- **Route53HostedZoneID** (optional): If you’re using Route 53, provide the hosted zone ID to automatically create DNS records. Leave blank to set up DNS manually with your registrar.
- **VPCID**, **PublicSubnets** (optional): Provide these if you want to use an existing VPC and subnets. Leave as default to create a new VPC.
- **VPCCIDR** (optional): Sets the CIDR for a new VPC if you’re creating one; ignored if using an existing VPC.
### DNS Setup (If Not Using Route 53)
If you leave `Route53HostedZoneID` blank, the deployment will pause at the `HTTPSCertificate` creation step, waiting for DNS validation:
1. Check the ACM console for the certificate (status: `Pending validation`).
2. Add the provided CNAME record to your DNS registrar to validate the certificate.
3. Wait for the certificate to be issued (status: `Issued`), then the deployment will continue.
4. After deployment, use the `ExternalUrl` output (or `CNAME Name` and `CNAME Value`) to create an `A` (with alias) or `CNAME` record in your registrar to point to the ALB.
For more details, see the deployment note in the template description.
================================================
FILE: examples/aws-ecs-fargate/connect-server.yaml
================================================
AWSTemplateFormatVersion: 2010-09-09
Description: >-
Sets up 1Password Connect on Fargate with an ALB for HTTPS ingress, in a public VPC subnet.
Note: If you leave Route53HostedZoneID blank, deployment will pause at HTTPSCertificate creation.
Check the ACM console for a CNAME record to add to your DNS registrar for validation, then wait for the certificate to be issued.
# Makes the params look nice in the AWS console
Metadata:
AWS::CloudFormation::Interface:
ParameterGroups:
- Label:
default: Network & Credentials Setup
Parameters:
- VPCID
- VPCCIDR
- PublicSubnets
- Route53HostedZoneID
- DomainName
- CredentialsJson
ParameterLabels:
VPCID:
default: VPC ID
VPCCIDR:
default: VPC CIDR
PublicSubnets:
default: Public Subnets
Route53HostedZoneID:
default: Route 53 Hosted Zone
DomainName:
default: 1Password Connect Server domain name
CredentialsJson:
default: 1Password Credentials JSON
# Stuff you can tweak when you deploy
Parameters:
VPCID:
Type: String
Description: Got a VPC ID? Toss it here, or leave it blank to make a new one
Default: ""
VPCCIDR:
Type: String
Description: CIDR for a new VPC if we're making one
Default: 10.0.0.0/16
PublicSubnets:
Type: CommaDelimitedList
Description: List of public subnet IDs, need at least 2 if you're using an existing VPC
Default: ""
Route53HostedZoneID:
Type: String
Description: Route 53 hosted zone ID for creating DNS records (leave empty to set up manually)
Default: ""
DomainName:
Type: String
Description: Domain name for the ALB (e.g., connect.example.com), must be in Route 53 if hosted zone is provided
MinLength: 1
ConstraintDescription: Need to provide a domain name for HTTPS
CredentialsJson:
Type: String
Description: Your 1password-credentials.json as plain JSON
NoEcho: true
MinLength: 1
ConstraintDescription: gotta have something here
# Check if we need to whip up a new VPC or create DNS records
Conditions:
CreateVPC: !Equals [!Ref VPCID, ""]
CreateRoute53Records: !Not [!Equals [!Ref Route53HostedZoneID, ""]]
OutputDNSRecordContent: !Not [Condition: CreateRoute53Records]
# Predefined CIDRs for the VPC and subnets
Mappings:
SubnetConfig:
VPC:
CIDR: '10.0.0.0/16'
PublicOne:
CIDR: '10.0.1.0/24'
PublicTwo:
CIDR: '10.0.2.0/24'
Resources:
# Secret to store the base64-encoded credentials
CredentialsSecret:
Type: AWS::SecretsManager::Secret
Properties:
Name: !Sub 'CredentialsSecret-${AWS::StackName}'
SecretString: !Base64 { "Fn::Sub": "${CredentialsJson}" }
# VPC stuff if we need to make one
VPC:
Condition: CreateVPC
Type: AWS::EC2::VPC
Properties:
EnableDnsSupport: true
EnableDnsHostnames: true
CidrBlock: !Ref VPCCIDR
PublicSubnetOne: # first subnet for the VPC
Condition: CreateVPC
Type: AWS::EC2::Subnet
Properties:
AvailabilityZone: !Select [0, !GetAZs '']
VpcId: !Ref VPC
CidrBlock: !FindInMap ['SubnetConfig', 'PublicOne', 'CIDR']
MapPublicIpOnLaunch: true
PublicSubnetTwo: # second subnet for the VPC
Condition: CreateVPC
Type: AWS::EC2::Subnet
Properties:
AvailabilityZone: !Select [1, !GetAZs '']
VpcId: !Ref VPC
CidrBlock: !FindInMap ['SubnetConfig', 'PublicTwo', 'CIDR']
MapPublicIpOnLaunch: true
InternetGateway: # need this for internet access in the new VPC
Condition: CreateVPC
Type: AWS::EC2::InternetGateway
GatewayAttachement:
Condition: CreateVPC
Type: AWS::EC2::VPCGatewayAttachment
Properties:
VpcId: !Ref VPC
InternetGatewayId: !Ref InternetGateway
PublicRouteTable:
Condition: CreateVPC
Type: AWS::EC2::RouteTable
Properties:
VpcId: !Ref VPC
PublicRoute: # sets up the route to the internet
Condition: CreateVPC
DependsOn: GatewayAttachement
Type: AWS::EC2::Route
Properties:
RouteTableId: !Ref PublicRouteTable
DestinationCidrBlock: '0.0.0.0/0'
GatewayId: !Ref InternetGateway
PublicSubnetOneRouteTableAssociation:
Condition: CreateVPC
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
SubnetId: !Ref PublicSubnetOne
RouteTableId: !Ref PublicRouteTable
PublicSubnetTwoRouteTableAssociation:
Condition: CreateVPC
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
SubnetId: !Ref PublicSubnetTwo
RouteTableId: !Ref PublicRouteTable
# ECS cluster to run stuff
ECSCluster:
Type: AWS::ECS::Cluster
# SGs for Fargate and ALB
LoadBalancerSG:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Access to the public facing load balancer
VpcId: !If [CreateVPC, !Ref VPC, !Ref VPCID]
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 443
ToPort: 443
CidrIp: 0.0.0.0/0
Description: HTTPS from anywhere
SecurityGroupEgress:
- IpProtocol: tcp
FromPort: 8080
ToPort: 8080
CidrIp: !If
- CreateVPC
- !GetAtt VPC.CidrBlock
- 0.0.0.0/0
FargateContainerSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Access to the Fargate containers
VpcId: !If [CreateVPC, !Ref VPC, !Ref VPCID]
EcsSecurityGroupIngressFromPublicALB:
Type: AWS::EC2::SecurityGroupIngress
Properties:
Description: Ingress from the public ALB
GroupId: !Ref FargateContainerSecurityGroup
IpProtocol: tcp
FromPort: 8080
ToPort: 8080
SourceSecurityGroupId: !Ref LoadBalancerSG
EcsSecurityGroupIngressFromSelf:
Type: AWS::EC2::SecurityGroupIngress
Properties:
Description: Ingress for sync container communication
GroupId: !Ref FargateContainerSecurityGroup
IpProtocol: tcp
FromPort: 8081
ToPort: 8081
SourceSecurityGroupId: !Ref FargateContainerSecurityGroup
EcsSecurityGroupEgress:
Type: AWS::EC2::SecurityGroupEgress
Properties:
GroupId: !Ref FargateContainerSecurityGroup
IpProtocol: tcp
FromPort: 443
ToPort: 443
CidrIp: 0.0.0.0/0
Description: HTTPS to external services (e.g., Docker Hub)
# ALB setup
LoadBalancer:
Type: AWS::ElasticLoadBalancingV2::LoadBalancer
Properties:
Scheme: internet-facing
LoadBalancerAttributes:
- Key: idle_timeout.timeout_seconds
Value: '30'
Subnets: !If
- CreateVPC
- [!Ref PublicSubnetOne, !Ref PublicSubnetTwo]
- !Ref PublicSubnets
SecurityGroups: [!Ref LoadBalancerSG]
HTTPSCertificate:
Type: AWS::CertificateManager::Certificate
Properties:
DomainName: !Ref DomainName
ValidationMethod: DNS
DomainValidationOptions: !If
- CreateRoute53Records
- - DomainName: !Ref DomainName
HostedZoneId: !Ref Route53HostedZoneID
- !Ref AWS::NoValue
HTTPSListener:
DependsOn:
- LoadBalancer
- HTTPSCertificate
Type: AWS::ElasticLoadBalancingV2::Listener
Properties:
DefaultActions:
- TargetGroupArn: !Ref ConnectTargetGroup
Type: forward
LoadBalancerArn: !Ref LoadBalancer
Port: 443
Protocol: HTTPS
SslPolicy: ELBSecurityPolicy-TLS13-1-2-Res-2021-06
Certificates:
- CertificateArn: !Ref HTTPSCertificate
ConnectTargetGroup:
Type: AWS::ElasticLoadBalancingV2::TargetGroup
DependsOn:
- LoadBalancer
Properties:
HealthCheckIntervalSeconds: 6
HealthCheckPath: /heartbeat
HealthCheckProtocol: HTTP
HealthCheckTimeoutSeconds: 5
HealthyThresholdCount: 2
TargetType: ip
Name: connect
Port: 8080
Protocol: HTTP
UnhealthyThresholdCount: 2
VpcId: !If [CreateVPC, !Ref VPC, !Ref VPCID]
TargetGroupAttributes:
- Key: deregistration_delay.timeout_seconds
Value: 60
# DNS record for the ALB (if using Route 53)
DNSRecord:
Condition: CreateRoute53Records
Type: AWS::Route53::RecordSet
Properties:
HostedZoneId: !Ref Route53HostedZoneID
Comment: DNS record pointing to load balancer for 1Password Connect
Name: !Ref DomainName
Type: A
AliasTarget:
DNSName: !GetAtt LoadBalancer.DNSName
HostedZoneId: !GetAtt LoadBalancer.CanonicalHostedZoneID
# Service discovery for internal routing
ServiceDiscoveryNamespace:
Type: AWS::ServiceDiscovery::PrivateDnsNamespace
Properties:
Description: Private DNS namespace for 1Password Connect
Vpc: !If [CreateVPC, !Ref VPC, !Ref VPCID]
Name: onepassword
ConnectServiceDiscovery:
Type: AWS::ServiceDiscovery::Service
DependsOn:
- ServiceDiscoveryNamespace
Properties:
DnsConfig:
DnsRecords:
- TTL: 60
Type: SRV
Name: connect
NamespaceId: !Ref ServiceDiscoveryNamespace
HealthCheckCustomConfig:
FailureThreshold: 1
# IAM roles for ECS
ECSRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Service: ecs-tasks.amazonaws.com
Action: sts:AssumeRole
Policies:
- PolicyName: ECSFargatePermissions
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- ec2:AttachNetworkInterface
- ec2:CreateNetworkInterface
- ec2:DeleteNetworkInterface
- ec2:DescribeNetworkInterfaces
- ec2:DetachNetworkInterface
- elasticloadbalancing:RegisterTargets
- elasticloadbalancing:DeregisterTargets
- elasticloadbalancing:DescribeTargetHealth
Resource: '*'
ECSTaskExecutionRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Service: ecs-tasks.amazonaws.com
Action: sts:AssumeRole
Policies:
- PolicyName: AmazonECSTaskExecutionRolePolicy
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- ecr:GetAuthorizationToken
- ecr:BatchCheckLayerAvailability
- ecr:GetDownloadUrlForLayer
- ecr:BatchGetImage
- logs:CreateLogStream
- logs:PutLogEvents
Resource: '*'
- PolicyName: SecretAccess
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- secretsmanager:GetSecretValue
Resource: !Sub 'arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:CredentialsSecret-${AWS::StackName}*'
# Logs in CloudWatch
CloudWatchLogsGroup:
Type: AWS::Logs::LogGroup
Properties:
LogGroupName: onepassword-connect
RetentionInDays: 30
# Task def for the Connect containers
TaskDefinition:
Type: AWS::ECS::TaskDefinition
DependsOn:
- ECSTaskExecutionRole
- CloudWatchLogsGroup
Properties:
Cpu: 256
Memory: 512
NetworkMode: awsvpc
RequiresCompatibilities:
- FARGATE
ExecutionRoleArn: !Ref ECSTaskExecutionRole
TaskRoleArn: !Ref ECSRole
Volumes:
- Name: connect-data
ContainerDefinitions:
- Name: connect-api
Image: 1password/connect-api:latest
PortMappings:
- ContainerPort: 8080
Protocol: tcp
MountPoints:
- ContainerPath: /home/opuser/.op/data
SourceVolume: connect-data
Secrets:
- Name: OP_SESSION
ValueFrom: !Ref CredentialsSecret
LogConfiguration:
LogDriver: awslogs
Options:
awslogs-group: !Ref CloudWatchLogsGroup
awslogs-region: !Ref AWS::Region
awslogs-stream-prefix: connect-api
- Name: connect-sync
Image: 1password/connect-sync:latest
MountPoints:
- ContainerPath: /home/opuser/.op/data
SourceVolume: connect-data
Environment:
- Name: OP_HTTP_PORT
Value: '8081'
Secrets:
- Name: OP_SESSION
ValueFrom: !Ref CredentialsSecret
LogConfiguration:
LogDriver: awslogs
Options:
awslogs-group: !Ref CloudWatchLogsGroup
awslogs-region: !Ref AWS::Region
awslogs-stream-prefix: connect-sync
# ECS service to run the containers
ConnectService:
Type: AWS::ECS::Service
DependsOn:
- LoadBalancer
- HTTPSListener
Properties:
ServiceName: connect
Cluster: !Ref ECSCluster
LaunchType: FARGATE
NetworkConfiguration:
AwsvpcConfiguration:
AssignPublicIp: ENABLED
SecurityGroups:
- !Ref FargateContainerSecurityGroup
Subnets: !If
- CreateVPC
- [!Ref PublicSubnetOne, !Ref PublicSubnetTwo]
- !Ref PublicSubnets
TaskDefinition: !Ref TaskDefinition
LoadBalancers:
- ContainerName: connect-api
ContainerPort: 8080
TargetGroupArn: !Ref ConnectTargetGroup
ServiceRegistries:
- ContainerName: connect-api
ContainerPort: 8080
RegistryArn: !GetAtt ConnectServiceDiscovery.Arn
# Stuff you'll need after deployment
Outputs:
CNAMEName:
Condition: OutputDNSRecordContent
Description: Name of a DNS record to point to the load balancer (use with CNAME Value for manual setup)
Value: !Sub ${DomainName}.
CNAMEValue:
Condition: OutputDNSRecordContent
Description: Value of a DNS record to point to the load balancer (use with CNAME Name for manual setup)
Value: !Sub ${LoadBalancer.DNSName}.
ExternalUrl:
Description: The URL of the external load balancer
Value: !Join ['', ['https://', !GetAtt LoadBalancer.DNSName]]
Export:
Name: !Join [':', [!Ref AWS::StackName, 'ExternalUrl']]
================================================
FILE: examples/beta/aws-ecs-apigateway-cfn/README.md
================================================
# AWS ECS with Fargate and API Gateway
The CloudFormation document in this folder will create the following resources, along with the necessary rules, groups, and policies to make them work.
The result is a publicly accessible hostname (via HTTPS) that routes requests to a 1Password Connect instance running in AWS Fargate, using API Gateway for secure ingress. You can use your own VPC and subnets.
To customize further, like deploying into an existing ECS cluster, use this CloudFormation as a starting point and tweak it with a text editor or Amazon's CloudFormation Designer tool.
## Networking Resources
- A VPC Link for API Gateway to route to the Fargate service
- An API Gateway with HTTPS
- A VPC (optional, if you don’t provide your own)
- 2 Public subnets (optional, if you don’t provide your own)
- An Internet Gateway (optional, if creating a VPC)
## ECS Resources
- An ECS Cluster
- Task Definition
- `1password/connect-api` container
- `1password/connect-sync` container
- Service Discovery for internal routing
## Getting Started
When [importing this CloudFormation template](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-using-console-create-stack-template.html), you’ll be prompted to provide the following:
- **CredentialsJson**: The plain JSON contents of your `1password-credentials.json` file (e.g., `{"token":"your-token"}`). The template will encode this to base64 and store it securely in AWS Secrets Manager.
- **VPCID**, **PublicSubnets** (optional): Provide these if you want to use an existing VPC and subnets. Leave as default to create a new VPC.
- **VPCCIDR** (optional): Sets the CIDR for a new VPC if you’re creating one; ignored if using an existing VPC.
For more details, see the deployment note in the template description.
================================================
FILE: examples/beta/aws-ecs-apigateway-cfn/connect-server.yaml
================================================
AWSTemplateFormatVersion: 2010-09-09
Description: Sets up 1Password Connect on Fargate with API Gateway, stores 1password-credentials.json in Secrets Manager, and makes a VPC if you don’t give one
# Makes the params look nice in the AWS console
Metadata:
AWS::CloudFormation::Interface:
ParameterGroups:
- Label:
default: Network & Credentials Setup
Parameters:
- VPCID
- VPCCIDR
- PublicSubnets
- CredentialsJson
ParameterLabels:
CredentialsJson:
default: 1Password Credentials JSON
VPCID:
default: VPC ID
VPCCIDR:
default: VPC CIDR
PublicSubnets:
default: Public Subnets
# Parameters you can tweak when you deploy
Parameters:
VPCID:
Type: String
Description: Got a VPC ID? Toss it here, or leave it blank to make a new one
Default: ""
VPCCIDR:
Type: String
Description: CIDR for a new VPC if we're making one
Default: 10.0.0.0/16
PublicSubnets:
Type: CommaDelimitedList
Description: List of public subnet IDs, need at least 2 if you're using an existing VPC
Default: ""
CredentialsJson:
Type: String
Description: Your 1password-credentials.json as plain JSON
NoEcho: true
MinLength: 1
ConstraintDescription: gotta have something here
# Check if we need to whip up a new VPC
Conditions:
CreateVPC:
Fn::Equals:
- !Ref VPCID
- ""
# Predefined CIDRs for the VPC and subnets
Mappings:
SubnetConfig:
VPC:
CIDR: '10.0.0.0/16'
PublicOne:
CIDR: '10.0.1.0/24'
PublicTwo:
CIDR: '10.0.2.0/24'
Resources:
# Secret to store the base64-encoded credentials
CredentialsSecret:
Type: AWS::SecretsManager::Secret
Properties:
Name: !Sub 'CredentialsSecret-${AWS::StackName}'
SecretString: !Base64 { "Fn::Sub": "${CredentialsJson}" }
# VPC stuff if we need to make one
VPC:
Condition: CreateVPC
Type: AWS::EC2::VPC
Properties:
CidrBlock: !Ref VPCCIDR
EnableDnsSupport: true
EnableDnsHostnames: true
PublicSubnetOne:
Condition: CreateVPC
Type: AWS::EC2::Subnet
Properties:
AvailabilityZone:
Fn::Select:
- 0
- Fn::GetAZs: ''
VpcId: !Ref VPC
CidrBlock: !FindInMap ['SubnetConfig', 'PublicOne', 'CIDR']
MapPublicIpOnLaunch: true
PublicSubnetTwo:
Condition: CreateVPC
Type: AWS::EC2::Subnet
Properties:
AvailabilityZone:
Fn::Select:
- 1
- Fn::GetAZs: ''
VpcId: !Ref VPC
CidrBlock: !FindInMap ['SubnetConfig', 'PublicTwo', 'CIDR']
MapPublicIpOnLaunch: true
InternetGateway:
Condition: CreateVPC
Type: AWS::EC2::InternetGateway
GatewayAttachment:
Condition: CreateVPC
Type: AWS::EC2::VPCGatewayAttachment
Properties:
VpcId: !Ref VPC
InternetGatewayId: !Ref InternetGateway
PublicRouteTable:
Condition: CreateVPC
Type: AWS::EC2::RouteTable
Properties:
VpcId: !Ref VPC
PublicRoute:
Condition: CreateVPC
DependsOn: GatewayAttachment
Type: AWS::EC2::Route
Properties:
RouteTableId: !Ref PublicRouteTable
DestinationCidrBlock: '0.0.0.0/0'
GatewayId: !Ref InternetGateway
PublicSubnetOneRouteTableAssociation:
Condition: CreateVPC
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
SubnetId: !Ref PublicSubnetOne
RouteTableId: !Ref PublicRouteTable
PublicSubnetTwoRouteTableAssociation:
Condition: CreateVPC
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
SubnetId: !Ref PublicSubnetTwo
RouteTableId: !Ref PublicRouteTable
# ECS cluster to run stuff
ECSCluster:
Type: AWS::ECS::Cluster
Properties:
CapacityProviders:
- FARGATE
DefaultCapacityProviderStrategy:
- CapacityProvider: FARGATE
Weight: 1
# SGs for Fargate and API Gateway
FargateContainerSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Access to the Fargate containers
VpcId: !If [CreateVPC, !Ref VPC, !Ref VPCID]
ApiGatewaySecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: API Gateway traffic for 1Password Connect
VpcId: !If [CreateVPC, !Ref VPC, !Ref VPCID]
# Security group rules
ApiGatewayEgress: # lets API Gateway talk to Fargate
Type: AWS::EC2::SecurityGroupEgress
Properties:
GroupId: !Ref ApiGatewaySecurityGroup
IpProtocol: tcp
FromPort: 8080
ToPort: 8080
DestinationSecurityGroupId: !Ref FargateContainerSecurityGroup
ConnectIngress:
Type: AWS::EC2::SecurityGroupIngress
Properties:
GroupId: !Ref FargateContainerSecurityGroup
IpProtocol: tcp
FromPort: 8080
ToPort: 8080
SourceSecurityGroupId: !Ref ApiGatewaySecurityGroup
ConnectSelfIngress:
Type: AWS::EC2::SecurityGroupIngress
Properties:
Description: Ingress from other containers in the same security group
GroupId: !Ref FargateContainerSecurityGroup
IpProtocol: -1
SourceSecurityGroupId: !Ref FargateContainerSecurityGroup
ConnectPublicEgress:
Type: AWS::EC2::SecurityGroupEgress
Properties:
GroupId: !Ref FargateContainerSecurityGroup
IpProtocol: tcp
FromPort: 443
ToPort: 443
CidrIp: 0.0.0.0/0
Description: HTTPS to external services (e.g., Docker Hub)
# IAM roles for ECS
ECSTaskExecutionRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Service: ecs-tasks.amazonaws.com
Action: sts:AssumeRole
Policies:
- PolicyName: AmazonECSTaskExecutionRolePolicy
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- ecr:GetAuthorizationToken
- ecr:BatchCheckLayerAvailability
- ecr:GetDownloadUrlForLayer
- ecr:BatchGetImage
- logs:CreateLogStream
- logs:PutLogEvents
Resource: '*'
- PolicyName: SecretAccess
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- secretsmanager:GetSecretValue
Resource: !Sub 'arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:CredentialsSecret-${AWS::StackName}*'
ECSRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Service: ecs-tasks.amazonaws.com
Action: sts:AssumeRole
Policies:
- PolicyName: ECSPermissions
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- ec2:AttachNetworkInterface
- ec2:CreateNetworkInterface
- ec2:DeleteNetworkInterface
- ec2:DescribeNetworkInterfaces
- ec2:DetachNetworkInterface
Resource: '*'
# Logs in CloudWatch
CloudWatchLogsGroup:
Type: AWS::Logs::LogGroup
Properties:
LogGroupName: onepassword-connect
RetentionInDays: 30
# Service discovery for internal routing
ServiceDiscoveryNamespace:
Type: AWS::ServiceDiscovery::PrivateDnsNamespace
Properties:
Description: Private DNS namespace for 1Password Connect
Vpc: !If [CreateVPC, !Ref VPC, !Ref VPCID]
Name: onepassword
ConnectServiceDiscovery:
Type: AWS::ServiceDiscovery::Service
DependsOn:
- ServiceDiscoveryNamespace
Properties:
DnsConfig:
DnsRecords:
- TTL: 60
Type: SRV
Name: connect
NamespaceId: !Ref ServiceDiscoveryNamespace
HealthCheckCustomConfig:
FailureThreshold: 1
# Task def for the Connect containers
TaskDefinition:
Type: AWS::ECS::TaskDefinition
DependsOn:
- ECSTaskExecutionRole
- CredentialsSecret
- CloudWatchLogsGroup
Properties:
Cpu: 256
Memory: 512
NetworkMode: awsvpc
RequiresCompatibilities:
- FARGATE
ExecutionRoleArn: !Ref ECSTaskExecutionRole
TaskRoleArn: !Ref ECSRole
Volumes:
- Name: data
ContainerDefinitions:
- Name: connect-api
Image: 1password/connect-api:latest
PortMappings:
- ContainerPort: 8080
Protocol: tcp
MountPoints:
- ContainerPath: /home/opuser/.op/data
SourceVolume: data
Secrets:
- Name: OP_SESSION
ValueFrom: !Ref CredentialsSecret
LogConfiguration:
LogDriver: awslogs
Options:
awslogs-group: !Ref CloudWatchLogsGroup
awslogs-region: !Ref AWS::Region
awslogs-stream-prefix: connect-api
- Name: connect-sync
Image: 1password/connect-sync:latest
MountPoints:
- ContainerPath: /home/opuser/.op/data
SourceVolume: data
Environment:
- Name: OP_HTTP_PORT
Value: '8081'
Secrets:
- Name: OP_SESSION
ValueFrom: !Ref CredentialsSecret
LogConfiguration:
LogDriver: awslogs
Options:
awslogs-group: !Ref CloudWatchLogsGroup
awslogs-region: !Ref AWS::Region
awslogs-stream-prefix: connect-sync
# ECS service to run the containers
ConnectService:
Type: AWS::ECS::Service
DependsOn:
- TaskDefinition
- ApiGatewayStage
- ConnectServiceDiscovery
- FargateContainerSecurityGroup
Properties:
ServiceName: connect
Cluster: !Ref ECSCluster
LaunchType: FARGATE
DesiredCount: 1
TaskDefinition: !Ref TaskDefinition
NetworkConfiguration:
AwsvpcConfiguration:
AssignPublicIp: ENABLED
SecurityGroups:
- !Ref FargateContainerSecurityGroup
Subnets: !If
- CreateVPC
- [!Ref PublicSubnetOne, !Ref PublicSubnetTwo]
- !Ref PublicSubnets
ServiceRegistries:
- ContainerName: connect-api
ContainerPort: 8080
RegistryArn: !GetAtt ConnectServiceDiscovery.Arn
# API Gateway setup
VpcLink:
Type: AWS::ApiGatewayV2::VpcLink
Properties:
Name: connect-vpc-link
SecurityGroupIds:
- !Ref ApiGatewaySecurityGroup
SubnetIds: !If
- CreateVPC
- [!Ref PublicSubnetOne, !Ref PublicSubnetTwo]
- !Ref PublicSubnets
ApiGateway:
Type: AWS::ApiGatewayV2::Api
Properties:
Name: onepassword-connect
ProtocolType: HTTP
Description: API Gateway for 1Password Connect
ApiGatewayIntegration:
Type: AWS::ApiGatewayV2::Integration
DependsOn:
- ApiGateway
- VpcLink
Properties:
ApiId: !Ref ApiGateway
IntegrationType: HTTP_PROXY
IntegrationMethod: ANY
ConnectionType: VPC_LINK
ConnectionId: !Ref VpcLink
IntegrationUri: !GetAtt ConnectServiceDiscovery.Arn
PayloadFormatVersion: 1.0
ApiGatewayRoute:
Type: AWS::ApiGatewayV2::Route
DependsOn:
- ApiGateway
- ApiGatewayIntegration
Properties:
ApiId: !Ref ApiGateway
RouteKey: $default
AuthorizationType: NONE
Target: !Join
- /
- - integrations
- !Ref ApiGatewayIntegration
ApiGatewayStage:
Type: AWS::ApiGatewayV2::Stage
DependsOn:
- ApiGateway
- ApiGatewayRoute
Properties:
StageName: $default
ApiId: !Ref ApiGateway
AutoDeploy: true
Outputs:
ExternalUrl:
Description: The URL of the API Gateway for 1Password Connect
Value: !GetAtt ApiGateway.ApiEndpoint
Export:
Name: !Join [ ':', [ !Ref AWS::StackName, 'ExternalUrl' ] ]
================================================
FILE: examples/beta/azure-container-apps-arm/README.md
================================================
# Deploy 1Password Connect Server on Azure Container Apps using the Azure Portal
_Learn how to deploy 1Password Connect Server on the [Azure Container Apps](https://azure.microsoft.com/en-us/products/container-apps/#overview) service._
This deployment consists of two [containers](https://learn.microsoft.com/en-us/azure/container-apps/containers): One for the Connect API and another for Connect Sync. There's also an [ingress](https://learn.microsoft.com/en-us/azure/container-apps/ingress-overview) for the API container. There are a few benefits to deploying 1Password Connect Server on Azure Container Apps:
- **Low cost:** For standard deployments, the service will host your Connect Server for ~$16 USD/month (as of January 2024). Container Apps pricing is variable based on activity, and you can learn more on [Microsoft's pricing page](https://azure.microsoft.com/en-us/pricing/details/container-apps/).
- **Automatic DNS record management:** You don't need to manage a DNS record. Azure Container Apps automatically provides a unique one for your Connect Server domain.
- **Automatic TLS certificate management:** Azure Container Apps automatically handles TLS certificate management on your behalf.
## Before you begin
Before you begin, ensure you have an Azure account with permission to create a Container App. You'll also need the `1password-credentials.json` file for your 1Password Connect Server, which contains the credentials for authenticating the server.
> [!NOTE]
> If you don't have an Azure account, you can sign up for a free trial with starting credit: https://azure.microsoft.com/free/
## Step 1: Download the template file
1. Download the [ARM(Azure Resource Manager) template](./aca-op-connect-server-template.json) file using the download icon at the top right.
## Step 2: Create the Container App
1. Sign in to the Azure Portal and go to the [Deploy a custom template](https://portal.azure.com/#create/Microsoft.Template) page.
2. Click **Build your own template in the editor**.
3. Click **Load file** and upload the template file you downloaded earlier. Then click **Save**.
4. Fill out the following fields:
- **Subscription** : Choose the subscription you prefer.
- **Resource group**: Choose an existing Resource Group or create a new one using **Create new** button.
- **Region**: Choose the region you prefer.
- **Container App Name**: Enter a name you'd like to use, default will be `op-connect-con-app`.
- **Container App Env Name**: Enter a name you'd like to use, default will be `op-connect-con-env`.
- **Container App Log Analytics Name**: Enter a name you'd like to use, default will be `op-connect-con-app-log-analytics`.
- **Credentials** : Paste the entire contents of the `1password-credentials.json` file.
5. Click **Review + create**.
6. Once the validation succeeds, click **Create**. It is expected to take a couple of minutes to complete the deployment.
## Step 3: Test your Connect Server
Once your deployment is complete, click **Go to resource group** and click on the container app you created.
To test if your Connect Server is online, choose **Overview** in your application's sidebar, then copy your **Application Url** link. This is your **Connect Server URL**. Use your 1Password Connect access token to interact with the API (e.g., via a `curl` request or a client application) to verify that your Connect Server is connected to your 1Password account.
```sh
curl --silent --show-error --request GET --header "Accept: application/json" \
--header "Authorization: Bearer mF_9.B5f-4.1JqM" \
https://op-connect.example.com/v1/vaults
```