op-deploy

op-deploy

A SSH deployer for Docker Compose, designed to securely sync files, inject secrets from 1Password, and run deployments without the overhead of traditional DevOps tooling.

• Get started with 1Password Service Accounts

Features

• 🔐 1Password integration
  • Fetch secrets from one or more vaults
  • Automatically convert item fields into environment variables
• 🚀 SSH-based deployment
  • Supports password, SSH key, or SSH keys stored in 1Password
• 📂 File synchronization
  • Uploads your local project directory to a remote destination
  • Only updates files when modified
• 🐳 Docker Compose support
  • Runs docker compose up -d remotely
• 🌱 Environment variable injection
  • Pass env vars via CLI flags
  • Merge CLI envs with 1Password secrets
• 🔁 Optional Git checkout
  • Deploy a specific branch, tag, or commit before running Compose

Requirements

On the local machine:

• Docker or Go (depending on install method)
• 1Password Service Account token (optional but recommended)

On the remote server:

• Docker
• Docker Compose (v2: docker compose)
• SSH access
• Enough user permissions to run Docker

Installation

a) Docker

docker pull ghcr.io/archsocket/op-deploy:latest

b) Go Install

go install github.com/archsocket/op-deploy@latest

c) Direct Binary Download

https://github.com/archsocket/op-deploy/releases/download/{VERSION}/op-env_{OS}_{ARCH}

Usage

op-deploy run [flags]

Required flags

Flags

SSH Configuration

If no SSH credentials are provided, op-deploy will attempt to load an SSH key from 1Password.

1Password

Secret Mapping

Secrets are converted into environment variables using this format:

<ITEM_TITLE>_<FIELD_TITLE>

Example:

All keys are uppercased and sanitized.

Deployment Options

You can specify --env multiple times.

Example

op-deploy run \
  --local-dir ./app \
  --remote-dir /srv/app \
  --address example.com \
  --user deploy \
  --vault production \
  --env APP_ENV=production \
  --ref main

How It Works

1. Connects to the remote host via SSH
2. Loads secrets from:
   • CLI --env flags
   • Selected 1Password vaults
3. Syncs the local project directory to the remote destination
4. (Optional) Checks out the specified Git reference
5. Runs:

docker compose up -d

Secrets are streamed securely via stdin using --env-file /dev/stdin.

Security Notes

• Secrets are never written to disk on the remote server
• SSH keys can be sourced directly from 1Password
• Uses your system’s known_hosts file for SSH verification