feat: add home-assistant-dashboard-conventions skill + update multiple skills

- New: smart-home/home-assistant-dashboard-conventions (Mushroom cards, view tabs, no Bubble Cards) - Updated: rke2, ceph, galera, proxmox, brainstorming, compound-learning, 1password-cli, smart-home-automation skills - New references: ceph-cluster-administration, docker-volume-forensics, ceph-crush-weight, ceph-ec-mixed-size
2026-07-14 18:35:16 +00:00
parent e9cc106625
commit 01bd921ced
37 changed files with 6133 additions and 126 deletions
@@ -149,6 +149,97 @@ SSHKEY    → Requires --reveal + file redirect for private key usage
 NOTES     → --field 'notesPlain'
 ```

+## Creating Items with Custom Fields
+
+`op item create` supports arbitrary custom fields via `key=value` syntax:
+
+```bash
+# Login item (username + password)
+op item create --title="app-db" --vault "$VAULT_ID" \
+  --category=Login \
+  username=appuser password="$(openssl rand -base64 32)"
+
+# Password item with multiple custom fields
+op item create --title="app-security" --vault "$VAULT_ID" \
+  --category=Password \
+  password="$PRIMARY_SECRET" \
+  "internal_token=$TOKEN1" \
+  "jwt_secret=$TOKEN2" \
+  "secret_key=$TOKEN3" \
+  "lfs_jwt_secret=$TOKEN4"
+```
+
+Custom fields appear as labeled fields in the 1P item and are retrievable via `op item get --fields field_name`.
+
+## ⚠️ Pitfall: API Credential Item Creation — Two-Step Required
+
+When creating an `API Credential` item, `op item create` does NOT
+populate the `credential` (token) field even when passing
+`credential=VALUE` as a parameter. The item is created with `username`
+and `url` populated, but the `credential` field stays empty.
+
+**Two-step required:**
+
+```bash
+# Step 1: Create the item (username + url are set, credential is NOT)
+op item create --category="API Credential" \
+  --title="My API Token" --vault="Hermes" \
+  username="myuser" url="https://api.example.com"
+
+# Step 2: Edit to set the credential field
+op item edit "<ITEM_ID>" --vault="Hermes" \
+  credential="ACTUAL_TOKEN_VALUE"
+```
+
+**Contrast with Login category:** `op item create --category="Login"`
+correctly populates both `username` and `password` in a single step —
+the two-step issue is specific to the `API Credential` category.
+
+```bash
+# This works in one step (Login category):
+op item create --category="Login" \
+  --title="My Service" --vault="Hermes" \
+  username="admin" password="s3cret" --url="https://service.example.com"
+```
+
+**Verification:**
+```bash
+op item get "<ITEM_ID>" --vault "Hermes" --fields credential --reveal
+# Should output the actual token value
+```
+
+## ⚠️ Accessing Vaults Outside Local Service Account Scope
+
+The local `op` service account may only have access to certain vaults (e.g. "Hermes"). Other vaults (e.g. "Kubernetes ESO" used by External Secrets Operator in K8s) are invisible:
+
+```bash
+op vault list
+# ID                            NAME
+# 5ythsz37hf3xminhq33drg55tm    Hermes
+# "Kubernetes ESO" NOT listed
+```
+
+### Workaround: Use the ESO Service Account Token
+
+Extract the ESO token from K8s and use it as `OP_SERVICE_ACCOUNT_TOKEN`:
+
+```bash
+# Get ESO token from K8s secret
+ESO_TOKEN=$(kubectl get secret onepassword-token -n external-secrets \
+  -o jsonpath="{.data.token}" | base64 -d)
+
+# Use it for op commands
+OP_SERVICE_ACCOUNT_TOKEN="$ESO_TOKEN" op vault list
+# ID                            NAME
+# 334ykdtj5kar3jlpcrztjvx2fu    Kubernetes ESO
+
+# Now create/read items in that vault
+OP_SERVICE_ACCOUNT_TOKEN="$ESO_TOKEN" \
+  op item create --title="app-db" --vault "334ykdtj5kar3jlpcrztjvx2fu" ...
+```
+
+⚠️ **Vault NAME may not resolve with service accounts.** Use the vault ID (e.g. `334ykdtj5kar3jlpcrztjvx2fu`) instead of the name ("Kubernetes ESO") — service accounts sometimes can't resolve vault names, only IDs.
+
 ## Related Support Files

 | File | Purpose |