feat(creds): centralize credentials to ~/.creds/, add KNELCredsManager

Rewire all MCP wrappers, docker-compose services, and validate scripts to source credentials from ~/.creds/ instead of scattered per-service .env files. This removes credential duplication and prepares for the HashiCorp Vault migration. Add KNELCredsManager under tooling-cli with: - Containerized Bitwarden CLI (pinned image, host stays clean) - scripts/bw wrapper with session management and data persistence - README documenting credential layout, consumer wiring, and roadmap Also fixes latent bug in MCP wrappers that were silently getting empty creds from ambient shell env — they now explicitly source ~/.creds/. Tracked in Redmine #407. Discourse: https://community.turnsys.com/t/308 💘 Generated with Crush Assisted-by: Crush
2026-08-10 09:14:14 -05:00
parent 7dfce930b6
commit 1957dcbc7e
8 changed files with 188 additions and 24 deletions
@@ -0,0 +1,87 @@
+# KNELCredsManager
+
+Centralized credential management for KNEL infrastructure. Stores service
+credentials on disk in `~/.creds/` and provides a containerized Bitwarden CLI
+for future migration to a password manager.
+
+## Credential store layout
+
+All credentials live in `~/.creds/` as flat `.env` files, one per service:
+
+```
+~/.creds/
+├── beszel.env         # Beszel monitoring (hub URL set, auth TBD — see #406)
+├── discourse.env      # Discourse forum API keys + admin key
+├── phpipam.env        # phpIPAM app_id + app_code
+├── redmine.env        # Redmine REST API key
+├── technitium.env     # Technitium DNS API key + admin password
+└── uptime-kuma.env    # Uptime Kuma push/API key
+```
+
+Permissions: directory `700`, files `600` (owner read/write only).
+
+### Consumers
+
+All credential consumers source from `~/.creds/`:
+
+| Service | Wrapper / consumer | Mechanism |
+|---|---|---|
+| Redmine | `~/daytoday/redmine/bin/redmine` | `--env-file ~/.creds/redmine.env` |
+| Redmine MCP | `mcp-redmine-wrapper.sh` | `set -a; . ~/.creds/redmine.env; set +a` |
+| Discourse | `~/daytoday/discourse/bin/discourse` | `--env-file ~/.creds/discourse.env` |
+| Discourse MCP | `mcp-discourse-wrapper.sh` | `set -a; . ~/.creds/discourse.env; set +a` |
+| Beszel MCP | `mcp-beszel-wrapper.sh` | `set -a; . ~/.creds/beszel.env; set +a` |
+| Uptime Kuma | (no active consumer yet) | Direct env reference |
+| Technitium | (no active consumer yet) | Direct env reference |
+| phpIPAM | (no active consumer yet) | Direct env reference |
+
+## Bitwarden CLI
+
+The Bitwarden CLI runs in a pinned Docker container — no host installation
+required. Built from this directory's Dockerfile.
+
+### Build
+
+```bash
+docker build -t reachableceo-bw-cli:2026.7.0 .
+```
+
+### Wrapper
+
+```bash
+# Symlink the wrapper onto PATH
+ln -sf ~/projects/KNEL-AIMiddleware/tooling-cli/KNELCredsManager/scripts/bw ~/.local/bin/bw
+```
+
+### Usage
+
+```bash
+bw login                    # interactive first-time login
+export BW_SESSION=$(bw unlock --raw)   # unlock and capture session
+bw sync                     # sync vault
+bw list items               # list all vault items
+bw get item <name>          # get a specific item
+bw status                   # check auth/session status
+```
+
+Session state persists in `~/.local/share/bw-cli/` across container runs.
+
+### MCP integration (machine-to-machine)
+
+For agent automation without interactive login, the KNEL-AIMiddleware fleet
+includes `mcp-bitwarden-wrapper.sh` which uses `BITWARDEN_CLIENT_ID` /
+`BITWARDEN_CLIENT_SECRET` / `BITWARDEN_PASSWORD` env vars (machine account
+auth). That is a separate integration from this CLI wrapper.
+
+## Build arguments
+
+| Arg | Default | Description |
+|---|---|---|
+| `BW_CLI_VERSION` | `2026.7.0` | Pinned @bitwarden/cli npm version |
+
+## Environment variables
+
+| Variable | Default | Description |
+|---|---|---|
+| `BW_CLI_IMAGE` | `reachableceo-bw-cli:2026.7.0` | Override image tag |
+| `BW_SESSION` | (unset) | Session key from `bw unlock` |