From bdf42bbbcfd4acb57aeb4f09a5438f9ad02f0e70 Mon Sep 17 00:00:00 2001 From: Your Name Date: Tue, 11 Aug 2026 16:44:51 -0700 Subject: [PATCH] claude: add secret/Vaultwarden credential-store tool + store-durable-creds directive --- home_root/.claude/CLAUDE.md | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/home_root/.claude/CLAUDE.md b/home_root/.claude/CLAUDE.md index b6f5499..04bd5c7 100644 --- a/home_root/.claude/CLAUDE.md +++ b/home_root/.claude/CLAUDE.md @@ -537,6 +537,26 @@ note says otherwise. On other boxes, check first.) `services/booth/` (`scripts/booth {new|add|url|ls|rm}`); user-level systemd on nh3-dev (`systemctl --user status booth.service`). +- **`secret` — Vaultwarden credential store (per dev box)** — a CLI for stashing + and looking up secrets that shouldn't live in a git repo, backed by + **`vaultwarden.phasefinal.com`** (the `infra-ops` org, visible from the operator's + primary account). On nh3-dev the CLI is + `~/development/eshpfi-management/services/secrets-broker/secret` (bw-backed; auth + bootstraps from `~/.config/secrets-broker/bootstrap.env`, `0600`). Usage: + `secret put (--file P | --stdin) [--folder C] [--field k=v]`, + `secret get [--field F] [--file OUT]` (the only command that prints a + value), `secret list [--prefix P]`, `secret backfill [--dry-run]` (scans THIS + box's `~/development/*/{env.sh,.env}` + `~/.config` creds and upserts each). + Items are hostname-namespaced (`/…`); small text → item note, small binary + → base64 hidden field, >6000 B → a bw attachment. **STANDING DIRECTIVE: store + durable credentials in the vault.** Any token / API key / cert / env-secret worth + keeping — not ephemeral, doesn't belong in git — should be `secret put` into the + vault so it survives and is findable, never left single-copy on a box. The one + exception is `bootstrap.env` itself (secrets-zero — it unlocks the vault, so it + can't live inside it; keep it `0600`). **Not a fleet service / no daemon** — each + new dev box duplicates this stack against its own local secrets (setup steps in + the service `README.md`). Details: auto-memory `reference_secrets_broker_cli`. + ## DevOps delegation For all DevOps work — deployments, infrastructure provisioning,