Proton Pass Setup

Credentials come from Proton Pass, not flat files — every credential this walkthrough creates from here on, starting with the Infomaniak account itself, goes straight into a vault rather than sitting in a browser or a note somewhere first.

1. Install

brew install --cask proton-pass
brew install protonpass/tap/pass-cli
brew install yq jq

The app for actually holding and viewing items (including anything pass-cli itself can't write, like TOTP fields); the CLI for scripting everything else.

2. Log in

pass-cli login

Once per machine — after that, every pass-cli command in this walkthrough just works.

3. Pick a vault name and a prefix

A vault to hold this project's credentials, separate from personal ones — this project's own is named Tech, commands elsewhere in this walkthrough use <vault> as a placeholder for whatever you name yours. Nothing to create by hand yet; the script below creates the vault too, if it doesn't already exist.

Also pick a short tag for this project's items — any consistent identifier works. Every item name below and throughout this walkthrough is <prefix>-<name>, so multiple projects' credentials stay distinguishable in the same vault instead of colliding on generic names.

4. Create the vault and its items

scripts/proton-pass-setup.sh creates the vault (skipped if it already exists) and every item this project needs as an empty shell, reading the item list from scripts/proton-pass-items.yaml — add or remove items there, not in the script itself:

VAULT=<vault> PREFIX=<prefix> scripts/proton-pass-setup.sh

What each item is for is covered where it actually gets filled in — Provider Setup and Security architecture — not repeated here.