Files

T

vh a1304b7812 docs(secrets-broker): record deferred 'secret put' scripted-namespace edge

jackdaw-dev observation (2026-08-12): the new-namespace warning is non-blocking +
stderr, so a scripted put suppressing stderr can still mis-namespace silently.
Deliberately not blocking (domain-scoped names would misfire on auto-prefix);
revisit with an opt-in --strict flag only if scripted callers appear.

2026-08-11 23:02:58 -07:00

README.md

feat(secrets-broker): nh3-dev backfill complete (25/25) + attachment + resilient run

2026-08-11 16:35:06 -07:00

secret

feat(secrets-broker): add 'secret rm' + a new-namespace heads-up on put

2026-08-11 22:58:33 -07:00

secrets-broker.contract.md

docs(secrets-broker): record deferred 'secret put' scripted-namespace edge

2026-08-11 23:02:58 -07:00

README.md

secrets-broker

Per-dev-box credential store + backup over the PFI Vaultwarden (vaultwarden.phasefinal.com). Lets the CC sessions on a dev box stash and look up secrets — API keys, tokens, env.sh / .env files, TLS keys — that shouldn't live in git and are otherwise single-copy on the box.

Not a fleet service. Each dev box runs its own copy of this stack against its own local secrets; items are hostname-namespaced (<hostname>/…) in the shared infra-ops org so they don't collide. No daemon — the secret CLI shells out to bw per call (~a few seconds; fine for occasional session use).

Files

File	What
`secret`	the CLI (`put` / `get` / `list` / `backfill`) — copy this to each box
`secrets-broker.contract.md`	the spec
`~/.config/secrets-broker/bootstrap.env`	per-box service-account creds, `0600`, never committed

Set up on a new dev box

Install bw (user-prefix, no sudo):

npm install -g @bitwarden/cli --prefix "$HOME/.local"   # -> ~/.local/bin/bw

Provision creds (operator): the service account already exists (infra-ops@phasefinal.com); drop its creds into the bootstrap file:

mkdir -p ~/.config/secrets-broker && chmod 700 ~/.config/secrets-broker
$EDITOR ~/.config/secrets-broker/bootstrap.env   # RBW_EMAIL, RBW_MASTER_PW, BW_CLIENTID, BW_CLIENTSECRET
chmod 600 ~/.config/secrets-broker/bootstrap.env

(RBW_* names are historical — bw reads them the same.)

Copy the CLI and point at the vault:

cp secret ~/.local/bin/secret          # or run in place
bw config server https://vaultwarden.phasefinal.com

Back up this box's secrets:

secret backfill --dry-run   # review what it would store
secret backfill             # write + round-trip-verify each

Usage

secret put myproj/.env --file ./env.sh --folder $(hostname)   # upsert a secret
secret put api/some-token --stdin                             # from stdin
secret get myproj/.env                                        # -> note body (stdout)
secret get certs/foo.pem --field content_b64 --file foo.pem   # binary -> 0600 file
secret list --prefix $(hostname)/                             # names + metadata only
secret backfill [--dry-run]                                   # this box's local secrets

Notes

bootstrap.env is the one secret that can't be vaulted (secrets-zero) — it's excluded from backfill. Keep it 0600; it's this box's crown jewel.
Values are only ever printed by an explicit get; list / --dry-run show names + metadata (sha256, synced_at, source_path) only.
Upsert is idempotent (keyed by name) — re-running backfill refreshes, never duplicates. Safe to re-run if a run is interrupted.
The Vaultwarden DB is in the pg_dump backup set; the store itself is durable.