# secret — Vaultwarden credential store

**CLI:** `secret` (on PATH on nh3-dev; real path
`~/development/eshpfi-management/services/secrets-broker/secret`)
**Backend:** `vaultwarden.phasefinal.com`, the `infra-ops` org.
**Auth bootstrap:** `~/.config/secrets-broker/bootstrap.env` (mode 0600).

```sh
secret list [--prefix P]
secret get  <name> [--field F] [--file OUT]      # the only command that prints a value
secret put  <name> (--file P | --stdin) [--folder C] [--field k=v]
secret backfill [--dry-run]                      # scan THIS box's env.sh/.env/~/.config creds
```

Items are hostname-namespaced (`<host>/…`). Small text goes to the item note, small
binary to a base64 hidden field, anything over 6000 B becomes a bw attachment.

## Standing directive (operator, 2026-08-11)

**The vault is the credential source of truth — store durable secrets in it AND pull
the creds you need FROM it.** Any token, API key, cert or env-secret that is not
ephemeral and does not belong in git should be `secret put` into the vault so it
survives and is findable, never left single-copy on a box. When a task needs a
credential, `secret get` it rather than reading an on-disk copy where practical.

The one exception is `bootstrap.env` itself — it unlocks the vault, so it cannot live
inside it. Keep it 0600.

## Traps

- **Not a fleet service, no daemon.** Each dev box duplicates this stack against its
  own local secrets. Setup steps in the service README.
- **`secret get` output shape varies by item.** Some items store a bare value, some
  store `key: <value>` fields. A blind `grep '^key:'` returns empty on a bare-value
  item — read the raw output first, then parse.