# KNELCredsManager

Centralized credential management for KNEL infrastructure. Stores service
credentials on disk in `~/.creds/` and provides a containerized Bitwarden CLI
for future migration to a password manager.

## Credential store layout

All credentials live in `~/.creds/` as flat `.env` files, one per service:

```
~/.creds/
├── beszel.env         # Beszel monitoring (hub URL set, auth TBD — see #406)
├── discourse.env      # Discourse forum API keys + admin key
├── phpipam.env        # phpIPAM app_id + app_code
├── redmine.env        # Redmine REST API key
├── technitium.env     # Technitium DNS API key + admin password
└── uptime-kuma.env    # Uptime Kuma push/API key
```

Permissions: directory `700`, files `600` (owner read/write only).

### Consumers

All credential consumers source from `~/.creds/`:

| Service | Wrapper / consumer | Mechanism |
|---|---|---|
| Redmine | `~/daytoday/redmine/bin/redmine` | `--env-file ~/.creds/redmine.env` |
| Redmine MCP | `mcp-redmine-wrapper.sh` | `set -a; . ~/.creds/redmine.env; set +a` |
| Discourse | `~/daytoday/discourse/bin/discourse` | `--env-file ~/.creds/discourse.env` |
| Discourse MCP | `mcp-discourse-wrapper.sh` | `set -a; . ~/.creds/discourse.env; set +a` |
| Beszel MCP | `mcp-beszel-wrapper.sh` | `set -a; . ~/.creds/beszel.env; set +a` |
| Uptime Kuma | (no active consumer yet) | Direct env reference |
| Technitium | (no active consumer yet) | Direct env reference |
| phpIPAM | (no active consumer yet) | Direct env reference |

## Bitwarden CLI

The Bitwarden CLI runs in a pinned Docker container — no host installation
required. Built from this directory's Dockerfile.

### Build

```bash
docker build -t reachableceo-bw-cli:2026.7.0 .
```

### Wrapper

```bash
# Symlink the wrapper onto PATH
ln -sf ~/projects/KNEL-AIMiddleware/tooling-cli/KNELCredsManager/scripts/bw ~/.local/bin/bw
```

### Usage

```bash
bw login                    # interactive first-time login
export BW_SESSION=$(bw unlock --raw)   # unlock and capture session
bw sync                     # sync vault
bw list items               # list all vault items
bw get item <name>          # get a specific item
bw status                   # check auth/session status
```

Session state persists in `~/.local/share/bw-cli/` across container runs.

### MCP integration (machine-to-machine)

For agent automation without interactive login, the KNEL-AIMiddleware fleet
includes `mcp-bitwarden-wrapper.sh` which uses `BITWARDEN_CLIENT_ID` /
`BITWARDEN_CLIENT_SECRET` / `BITWARDEN_PASSWORD` env vars (machine account
auth). That is a separate integration from this CLI wrapper.

## Build arguments

| Arg | Default | Description |
|---|---|---|
| `BW_CLI_VERSION` | `2026.7.0` | Pinned @bitwarden/cli npm version |

## Environment variables

| Variable | Default | Description |
|---|---|---|
| `BW_CLI_IMAGE` | `reachableceo-bw-cli:2026.7.0` | Override image tag |
| `BW_SESSION` | (unset) | Session key from `bw unlock` |