Skip to content

Commit 51d749b

Browse files
ag-rdoucetteag-rdoucette
authored
Merge pull request #97
Add 1Password Encrypted Vault Backup App
2 parents 4d69ce8 + 064e25f commit 51d749b

File tree

10 files changed

+2303
-0
lines changed

10 files changed

+2303
-0
lines changed

‎onepassword_sdks/demo-vault-backup-webapp/Dockerfile

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# Use Node.js 18 as the base image for the container
2+
FROM node:lts-bookworm-slim
3+
4+
# Set the working directory to /app inside the container
5+
WORKDIR /webapp
6+
7+
# Install required tools and configure the 1Password CLI repository
8+
RUN apt-get update && \
9+
apt-get install -y \
10+
curl \
11+
gnupg \
12+
ca-certificates \
13+
lsb-release && \
14+
curl -sS https://downloads.1password.com/linux/keys/1password.asc | \
15+
gpg --dearmor --output /usr/share/keyrings/1password-archive-keyring.gpg && \
16+
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/1password-archive-keyring.gpg] https://downloads.1password.com/linux/debian/$(dpkg --print-architecture) stable main" | \
17+
tee /etc/apt/sources.list.d/1password.list && \
18+
mkdir -p /etc/debsig/policies/AC2D62742012EA22/ && \
19+
curl -sS https://downloads.1password.com/linux/debian/debsig/1password.pol | \
20+
tee /etc/debsig/policies/AC2D62742012EA22/1password.pol && \
21+
mkdir -p /usr/share/debsig/keyrings/AC2D62742012EA22 && \
22+
curl -sS https://downloads.1password.com/linux/keys/1password.asc | \
23+
gpg --dearmor --output /usr/share/debsig/keyrings/AC2D62742012EA22/debsig.gpg && \
24+
apt-get update && \
25+
apt-get install -y 1password-cli
26+
27+
# Check the installed version of 1Password CLI to ensure it’s working
28+
RUN op --version
29+
30+
# Copy package.json and package-lock.json (if present) to the working directory
31+
COPY package*.json ./
32+
33+
# Install Node.js dependencies defined in package.json
34+
RUN npm install
35+
36+
# Copy all remaining application files to the container
37+
COPY . .
38+
39+
# Set permissions: 755 for directories, 644 for files
40+
RUN chown -R node:node /webapp && \
41+
find /webapp -type d -exec chmod 755 {} \; && \
42+
find /webapp -type f -exec chmod 644 {} \;
43+
44+
# Switch to non-root user
45+
USER node
46+
47+
# Expose port 3002 for the application to listen on
48+
EXPOSE 3002
49+
50+
# Define the command to start the Node.js application
51+
CMD ["npm", "start"]

‎onepassword_sdks/demo-vault-backup-webapp/README.md

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
# 1Password Encrypted Vault Backup App
2+
3+
This web app enables secure backup and restoration of 1Password vaults, encrypting the backup with a user-provided passcode and storing sensitive keys in a dedicated 1Password vault. It uses the 1Password JS SDK and CLI for vault operations, with encryption handled via Argon2 and AES-256-CBC.
4+
5+
## Overview
6+
7+
This app allows you to:
8+
- Connect to a 1Password account using a service account token.
9+
- List and select vaults for backup.
10+
- Encrypt and save vault data to a downloadable file.
11+
- Store encryption keys in a secure 1Password vault.
12+
- Restore vaults from an encrypted backup file to a destination account.
13+
14+
## Requirements
15+
16+
- [Docker](https://docs.docker.com/get-started/get-docker/)
17+
- [1Password Service Account](https://developer.1password.com/docs/service-accounts/get-started) with:
18+
- Read access for listing vaults and items (backup).
19+
- Vault creation and item creation permissions (restore).
20+
21+
## Installation
22+
23+
1. [Install Docker](https://docs.docker.com/get-started/get-docker/).
24+
2. Clone or download this project.
25+
3. Navigate to the project folder and run:
26+
27+
```
28+
docker compose up -d
29+
```
30+
31+
## Usage
32+
33+
### Backup
34+
1. Open `https://localhost:3002` in your browser.
35+
2. Click **Backup** in the sidebar.
36+
3. Enter your 1Password service account token and click **Connect**.
37+
4. Select vaults to back up and provide a passcode (minimum 8 characters).
38+
5. Click **Backup Selected Vaults** or **Backup All Vaults**.
39+
6. Save the generated encryption keys to a new 1Password vault or download them.
40+
7. Download the encrypted `backup.1pbackup` file.
41+
42+
### Restore
43+
1. Open `https://localhost:3002` and click **Restore**.
44+
2. Upload the `backup.1pbackup` file and enter the service account token, passcode, and system key.
45+
3. Select vaults to restore from the backup.
46+
4. Click **Restore Selected Vaults**.
47+
5. Verify the restored vaults in the destination account.
48+
49+
## Special Handling with CLI
50+
51+
- **Vault Creation**: Uses 1Password CLI (`op vault create`) to create new vaults for restored data and key storage, as vault creation is not supported by the SDK.
52+
53+
## Security Features
54+
55+
- Runs on HTTPS with a self-signed certificate (local testing).
56+
- Uses Argon2 for key derivation and AES-256-CBC for backup encryption.
57+
- Verifies backup integrity with HMAC-SHA256.
58+
- Saves encryption keys (passcode and system key) in a secure 1Password vault.
59+
- Uses `p-limit` to prevent overwhelming the 1Password API.
60+
- Implements retry logic for API rate limits or conflicts.
61+
62+
## Troubleshooting
63+
64+
- Ensure Docker is running and the container is active (`docker logs <container-name>`).
65+
- Verify service account token permissions (read for backup, create for restore/keys).
66+
- Check `https://localhost:3002` is accessible; accept the self-signed certificate if prompted.
67+
- Confirm passcode and system key match the backup file during restoration.
68+
- Ensure the backup file is not corrupted or tampered with (HMAC verification failure).
69+
70+
## Limitations
71+
72+
- Passkeys cannot be backed up or restored (use 1Password desktop/mobile apps).
73+
- SDK does not support archived items for backup/restore.
74+
- Restored vault names are appended with "(Restored)".
75+
- Fixed concurrency limits (2 vaults, 1 item at a time) may need tuning for large backups.

‎onepassword_sdks/demo-vault-backup-webapp/docker-compose.yml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
services:
2+
app:
3+
build:
4+
context: .
5+
dockerfile: Dockerfile
6+
image: demo-vault-backup-webapp:v1.0.0
7+
ports:
8+
- "3002:3002"
9+
environment:
10+
- NODE_ENV=development
11+
command: npm start

‎onepassword_sdks/demo-vault-backup-webapp/package.json

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
{
2+
"name": "demo-vault-backup-webapp",
3+
"version": "1.0.0",
4+
"main": "webapp.js",
5+
"scripts": {
6+
"test": "echo \"Error: no test specified\" && exit 1",
7+
"start": "node webapp.js"
8+
},
9+
"keywords": [],
10+
"author": "",
11+
"license": "ISC",
12+
"description": "",
13+
"dependencies": {
14+
"@1password/sdk": "^0.3.0",
15+
"argon2": "^0.41.1",
16+
"body-parser": "^2.2.0",
17+
"ejs": "^3.1.10",
18+
"express": "^4.21.2",
19+
"express-session": "^1.18.1",
20+
"multer": "^1.4.5-lts.2",
21+
"p-limit": "^4.0.0",
22+
"selfsigned": "^2.4.1"
23+
}
24+
}

‎onepassword_sdks/demo-vault-backup-webapp/public/.gitkeep

Whitespace-only changes.

‎onepassword_sdks/demo-vault-backup-webapp/uploads/.gitkeep

Whitespace-only changes.

0 commit comments

Comments
 (0)