Lantern

A guiding light for when you go dark. Automatically passes your chosen secrets to family members, inside 1Password.

Lantern talks to 1Password only through the official CLI (op) and the official SDK (@1password/sdk). It is free, self-hosted, and open source.

It works by using a 1Password service account token with Create vaults access only; it should not have access to your other vaults. Each POST /run creates a special vault for every family member if they do not already have one (default title Lantern). The clock is 1Password login time (last_auth_at), not a timer this app stores, and not an email/SMS check-in. If they are overdue and that vault has items, Lantern grants view-only access to every family member, renames it to Lantern plus their first name (for example Lantern - Ember), and creates a new empty Lantern vault for the inactive person.

Instructions

1. Host the Docker image on your local network. The image needs to always be running and NEVER be reverse proxied or exposed to the public. If you use Unraid, install Lantern from Community Applications.
2. Log in to your 1Password dashboard on the web to create a service account. Navigate to Developer → Directory → Service Account.
3. Create a new service account named Lantern (or anything you choose). IMPORTANT: Only give your service account the Allow creation of new vaults permission. Do NOT give it access to any vaults.
4. Save your service account token and set OP_SERVICE_ACCOUNT_TOKEN.
5. Generate a long random string and set RUN_TOKEN. You must send this token when calling POST /run.
6. Set a scheduler to run POST /run once a day, or set AUTO_RUN to true to use the built-in scheduler.
7. Everyone in your family should now have their own personal Lantern vault. That vault is shared with all family members if the owner does not log in to 1Password within the INACTIVE_AFTER_DAYS you set.

Endpoint Example:

curl.exe -X POST http://localhost:6346/run -H "Authorization: Bearer <RUN_TOKEN>"

Notifications

You can use n8n (or your preferred workflow scheduler) to notify family members of events by sending emails, SMS, push notifications, a webhook, or even the official Grok Bot. When you call POST /run you will receive a JSON array containing all notify events, or empty [] if none. Each event has notify (warning or shared), email, and name. Warning events also include daysLeft (1–3).

A family with several people can take time to process, so make sure to set your HTTP timeout to a few minutes. Any errors or warnings are printed in the Lantern log.

Return Example:

[
  { "notify": "warning", "email": "ember@example.com", "name": "Ember Voss", "daysLeft": 2 },
  { "notify": "shared", "email": "nix@example.com", "name": "Nix Thorne" }
]

Settings

Dev Environment

npm install
$Env:OP_SERVICE_ACCOUNT_TOKEN = "ops_your-token-here"
$Env:RUN_TOKEN = "a-long-random-string"
npm start

Limitations

An admin can delete anyone's Lantern vault (live or already opened), add themselves or others to it, and change permissions from the 1Password dashboard. View-only grants after a vault is shared do not stop that. Trust your admins, or do not put secrets they can view, edit, or destroy.

Disclaimer

Use at your own risk. This is not a will, a backup, or an official 1Password product. Test it yourself, keep your own copies of anything that matters, and do not rely on it as your only plan. You are responsible for the token, the schedule, and what happens when a vault is shared.

License

MIT.

Support

Bitcoin: bc1qzjrleryk7pmyyhw9xpg9dysvygztstk8u7qehn