vh
53c3e8000e
Every agent on nh3-dev — Claude, Codex, Grok, Aider — needs the same answers: what runs here, how do I call it, what will bite me. Until now that lived in ~/.claude/CLAUDE.md, which only Claude sessions load, and it was interleaved with operator preferences that other families have no use for. Two-tier by design, matching the persistent-memory split: FLEETTOOLS.md is a 135-line index an agent reads whole, and each entry links to a detail file it opens only when it actually needs that tool. Reading the index costs about a fifth of reading the tree. Detail paths are absolute so they resolve from any working directory, since a non-Claude agent will cat the path rather than follow a markdown link. ~/FLEETTOOLS.md symlinks to the index for discovery. Rule zero is that live inventories get queried, not transcribed: Homepage /api/services, asset-engine /api/v1/services, LiteLLM /v1/models, and every FastAPI seat's /openapi.json. A copied service table would be stale within a month and this repo already has a standing rule against second copies that drift. Contents verified against the running fleet rather than copied from existing docs: binaries resolved on PATH, seven endpoints probed live, the LiteLLM roster counted at 40 models where the old note said ~30. No credentials are included; the vault and its CLI are pointed at instead.
1.6 KiB
secret — Vaultwarden credential store
CLI: secret (on PATH on nh3-dev; real path
~/development/eshpfi-management/services/secrets-broker/secret)
Backend: vaultwarden.phasefinal.com, the infra-ops org.
Auth bootstrap: ~/.config/secrets-broker/bootstrap.env (mode 0600).
secret list [--prefix P]
secret get <name> [--field F] [--file OUT] # the only command that prints a value
secret put <name> (--file P | --stdin) [--folder C] [--field k=v]
secret backfill [--dry-run] # scan THIS box's env.sh/.env/~/.config creds
Items are hostname-namespaced (<host>/…). Small text goes to the item note, small
binary to a base64 hidden field, anything over 6000 B becomes a bw attachment.
Standing directive (operator, 2026-08-11)
The vault is the credential source of truth — store durable secrets in it AND pull
the creds you need FROM it. Any token, API key, cert or env-secret that is not
ephemeral and does not belong in git should be secret put into the vault so it
survives and is findable, never left single-copy on a box. When a task needs a
credential, secret get it rather than reading an on-disk copy where practical.
The one exception is bootstrap.env itself — it unlocks the vault, so it cannot live
inside it. Keep it 0600.
Traps
- Not a fleet service, no daemon. Each dev box duplicates this stack against its own local secrets. Setup steps in the service README.
secret getoutput shape varies by item. Some items store a bare value, some storekey: <value>fields. A blindgrep '^key:'returns empty on a bare-value item — read the raw output first, then parse.