vh
3b7e10cd29
Current state rewritten to session-end: secrets-broker LIVE (secret CLI + 25-item backfill + rm/warn), stonehenge-park /park service repo stood up (vor-plan+vor-ui), dots-tts extracted to tts-stack; NEXT PROJECT = wgtunnel (WireGuard over a plane's wifi). Two detail files added; 2 oldest T&A entries archived. Handoff written to /tmp/infra-ops-handoff.md for the post-clear pickup.
46 lines
3.2 KiB
Markdown
46 lines
3.2 KiB
Markdown
`[2026-08-10→12]` **secrets-broker — per-box Vaultwarden credential store, SHIPPED + consumer-confirmed.**
|
|
|
|
**What.** A per-dev-box credential store over the fleet Vaultwarden (`vaultwarden.phasefinal.com`,
|
|
on ana-docker, DB on pfi-postgres, in the pg_dump backup set). The `secret` CLI at eshpfi
|
|
`services/secrets-broker/secret` (also installed to `~/.local/bin/secret`, on PATH for all sessions):
|
|
`put / get / list / rm / backfill`. Stores into the **`infra-ops` org's Default collection** (org
|
|
shared to the operator's primary account, so he sees items too), folder = hostname, item name =
|
|
`<host>/<path>`, title-derived slug. Small text → item note; small binary → base64 hidden field;
|
|
**>6000 B → a bw attachment** (Vaultwarden caps notes at ~10000 encrypted chars); sha256 + source
|
|
metadata fields; idempotent upsert keyed by name.
|
|
|
|
**Auth.** Bootstraps from `~/.config/secrets-broker/bootstrap.env` (0600): apikey login
|
|
(`BW_CLIENTID`/`BW_CLIENTSECRET`) + master-password unlock (`--passwordenv`) → per-invocation
|
|
session. That file is **secrets-zero** (it unlocks the vault, can't live in it) and is excluded from
|
|
backfill.
|
|
|
|
**Client = `bw`, NOT `rbw`.** rbw was the operator's first choice but its `register` returned an
|
|
undebuggable 400 against this Vaultwarden despite valid creds (a direct `client_credentials` grant +
|
|
both prelogin paths return 200; rbw emits no HTTP logs). Switched to the official `bw` CLI
|
|
(user-prefix npm install) — clean unattended flow, full write support (org collections + attachments).
|
|
|
|
**Backfill.** Local-only (each box backs up itself; NOT a fleet daemon). Scanned nh3-dev's
|
|
`~/development/*/{env.sh,.env}` + `~/.config` credential files, **25 items stored + round-trip
|
|
verified** (2 large via attachment). Excludes bootstrap.env / `.example` / `~/AIPA-Data` archives /
|
|
cargo noise.
|
|
|
|
**Post-launch (jackdaw-dev feedback).** Added **`secret rm <name>`** (bw soft-delete to trash,
|
|
recoverable) — closes the "no delete path, append-only" gap; and a **new-top-level-namespace warning**
|
|
on `put` (stderr, non-blocking) — catches a typo'd/missing host prefix at store time. Chose
|
|
warn-not-auto-prefix because domain-scoped names (`gitea/…`, `certs/…`) would misfire on auto-prefix.
|
|
Deferred edge recorded in the contract: the warning is non-blocking, so a scripted put suppressing
|
|
stderr can still mis-namespace — add an opt-in `--strict` only if scripted callers appear.
|
|
|
|
**Standing directive (now GLOBAL in `~/.claude/CLAUDE.md`):** the vault is the credential source of
|
|
truth — **`secret put` durable secrets into it AND `secret get` the creds a task needs FROM it**
|
|
rather than reading on-disk copies. Dogfooded by pulling the gitea `vh` token from the vault to create
|
|
`vh/stonehenge-park`.
|
|
|
|
**Deploy shape.** Not a service / no daemon — per-box; a new dev box duplicates the stack
|
|
(`services/secrets-broker/README.md`): npm-install `bw` to `~/.local`, drop a per-box `bootstrap.env`,
|
|
`secret backfill`. Commits: `41359ea` (CLI + contract), `850a197` (backfill 25/25 + attachment +
|
|
resilient run), `a249073` (rm + namespace warning), `a1304b7` (deferred-edge contract note).
|
|
Consumer-confirmed end-to-end by jackdaw-dev.
|
|
|
|
Auto-memory: `reference_secrets_broker_cli`.
|