Files

T

vh 850a1976d5 feat(secrets-broker): nh3-dev backfill complete (25/25) + attachment + resilient run

Scope corrected to per-dev-box (CC sessions on this box), not a fleet service; each
box duplicates the stack and backs up its own local secrets, hostname-namespaced.

CLI:
- backfill is local-only (scan this box's ~/development/*/{env.sh,.env} + ~/.config
  credentials; exclude bootstrap.env/examples/AIPA-Data archives).
- large files (>6000 B) route to a bw ATTACHMENT instead of the note field
  (Vaultwarden caps notes at ~10000 encrypted chars); get/verify read it back.
- backfill catches per-item failures and continues (bw errors raise BwError,
  main converts to a clean exit); idempotent upsert makes re-runs safe.

Backfilled all 25 nh3-dev secret files into the infra-ops org's Default collection
(folder = hostname), every one round-trip verified (2 large via attachment, 23 via
note). README added for duplicating the stack to new dev boxes. Contract scope +
data-model sections updated (bw, org/collection, per-box).

2026-08-11 16:35:06 -07:00

2.9 KiB

Raw Blame History

secrets-broker

Per-dev-box credential store + backup over the PFI Vaultwarden (vaultwarden.phasefinal.com). Lets the CC sessions on a dev box stash and look up secrets — API keys, tokens, env.sh / .env files, TLS keys — that shouldn't live in git and are otherwise single-copy on the box.

Not a fleet service. Each dev box runs its own copy of this stack against its own local secrets; items are hostname-namespaced (<hostname>/…) in the shared infra-ops org so they don't collide. No daemon — the secret CLI shells out to bw per call (~a few seconds; fine for occasional session use).

Files

File	What
`secret`	the CLI (`put` / `get` / `list` / `backfill`) — copy this to each box
`secrets-broker.contract.md`	the spec
`~/.config/secrets-broker/bootstrap.env`	per-box service-account creds, `0600`, never committed

Set up on a new dev box

Install bw (user-prefix, no sudo):

npm install -g @bitwarden/cli --prefix "$HOME/.local"   # -> ~/.local/bin/bw

Provision creds (operator): the service account already exists (infra-ops@phasefinal.com); drop its creds into the bootstrap file:

mkdir -p ~/.config/secrets-broker && chmod 700 ~/.config/secrets-broker
$EDITOR ~/.config/secrets-broker/bootstrap.env   # RBW_EMAIL, RBW_MASTER_PW, BW_CLIENTID, BW_CLIENTSECRET
chmod 600 ~/.config/secrets-broker/bootstrap.env

(RBW_* names are historical — bw reads them the same.)

Copy the CLI and point at the vault:

cp secret ~/.local/bin/secret          # or run in place
bw config server https://vaultwarden.phasefinal.com

Back up this box's secrets:

secret backfill --dry-run   # review what it would store
secret backfill             # write + round-trip-verify each

Usage

secret put myproj/.env --file ./env.sh --folder $(hostname)   # upsert a secret
secret put api/some-token --stdin                             # from stdin
secret get myproj/.env                                        # -> note body (stdout)
secret get certs/foo.pem --field content_b64 --file foo.pem   # binary -> 0600 file
secret list --prefix $(hostname)/                             # names + metadata only
secret backfill [--dry-run]                                   # this box's local secrets

Notes

bootstrap.env is the one secret that can't be vaulted (secrets-zero) — it's excluded from backfill. Keep it 0600; it's this box's crown jewel.
Values are only ever printed by an explicit get; list / --dry-run show names + metadata (sha256, synced_at, source_path) only.
Upsert is idempotent (keyed by name) — re-running backfill refreshes, never duplicates. Safe to re-run if a run is interrupted.
The Vaultwarden DB is in the pg_dump backup set; the store itself is durable.

2.9 KiB Raw Blame History