vh
3b7e10cd29
Current state rewritten to session-end: secrets-broker LIVE (secret CLI + 25-item backfill + rm/warn), stonehenge-park /park service repo stood up (vor-plan+vor-ui), dots-tts extracted to tts-stack; NEXT PROJECT = wgtunnel (WireGuard over a plane's wifi). Two detail files added; 2 oldest T&A entries archived. Handoff written to /tmp/infra-ops-handoff.md for the post-clear pickup.
3.2 KiB
[2026-08-10→12] secrets-broker — per-box Vaultwarden credential store, SHIPPED + consumer-confirmed.
What. A per-dev-box credential store over the fleet Vaultwarden (vaultwarden.phasefinal.com,
on ana-docker, DB on pfi-postgres, in the pg_dump backup set). The secret CLI at eshpfi
services/secrets-broker/secret (also installed to ~/.local/bin/secret, on PATH for all sessions):
put / get / list / rm / backfill. Stores into the infra-ops org's Default collection (org
shared to the operator's primary account, so he sees items too), folder = hostname, item name =
<host>/<path>, title-derived slug. Small text → item note; small binary → base64 hidden field;
>6000 B → a bw attachment (Vaultwarden caps notes at ~10000 encrypted chars); sha256 + source
metadata fields; idempotent upsert keyed by name.
Auth. Bootstraps from ~/.config/secrets-broker/bootstrap.env (0600): apikey login
(BW_CLIENTID/BW_CLIENTSECRET) + master-password unlock (--passwordenv) → per-invocation
session. That file is secrets-zero (it unlocks the vault, can't live in it) and is excluded from
backfill.
Client = bw, NOT rbw. rbw was the operator's first choice but its register returned an
undebuggable 400 against this Vaultwarden despite valid creds (a direct client_credentials grant +
both prelogin paths return 200; rbw emits no HTTP logs). Switched to the official bw CLI
(user-prefix npm install) — clean unattended flow, full write support (org collections + attachments).
Backfill. Local-only (each box backs up itself; NOT a fleet daemon). Scanned nh3-dev's
~/development/*/{env.sh,.env} + ~/.config credential files, 25 items stored + round-trip
verified (2 large via attachment). Excludes bootstrap.env / .example / ~/AIPA-Data archives /
cargo noise.
Post-launch (jackdaw-dev feedback). Added secret rm <name> (bw soft-delete to trash,
recoverable) — closes the "no delete path, append-only" gap; and a new-top-level-namespace warning
on put (stderr, non-blocking) — catches a typo'd/missing host prefix at store time. Chose
warn-not-auto-prefix because domain-scoped names (gitea/…, certs/…) would misfire on auto-prefix.
Deferred edge recorded in the contract: the warning is non-blocking, so a scripted put suppressing
stderr can still mis-namespace — add an opt-in --strict only if scripted callers appear.
Standing directive (now GLOBAL in ~/.claude/CLAUDE.md): the vault is the credential source of
truth — secret put durable secrets into it AND secret get the creds a task needs FROM it
rather than reading on-disk copies. Dogfooded by pulling the gitea vh token from the vault to create
vh/stonehenge-park.
Deploy shape. Not a service / no daemon — per-box; a new dev box duplicates the stack
(services/secrets-broker/README.md): npm-install bw to ~/.local, drop a per-box bootstrap.env,
secret backfill. Commits: 41359ea (CLI + contract), 850a197 (backfill 25/25 + attachment +
resilient run), a249073 (rm + namespace warning), a1304b7 (deferred-edge contract note).
Consumer-confirmed end-to-end by jackdaw-dev.
Auto-memory: reference_secrets_broker_cli.