mrcharles
1957dcbc7e
Rewire all MCP wrappers, docker-compose services, and validate scripts to source credentials from ~/.creds/ instead of scattered per-service .env files. This removes credential duplication and prepares for the HashiCorp Vault migration. Add KNELCredsManager under tooling-cli with: - Containerized Bitwarden CLI (pinned image, host stays clean) - scripts/bw wrapper with session management and data persistence - README documenting credential layout, consumer wiring, and roadmap Also fixes latent bug in MCP wrappers that were silently getting empty creds from ambient shell env — they now explicitly source ~/.creds/. Tracked in Redmine #407. Discourse: https://community.turnsys.com/t/308 💘 Generated with Crush Assisted-by: Crush
88 lines
2.9 KiB
Markdown
88 lines
2.9 KiB
Markdown
# KNELCredsManager
|
|
|
|
Centralized credential management for KNEL infrastructure. Stores service
|
|
credentials on disk in `~/.creds/` and provides a containerized Bitwarden CLI
|
|
for future migration to a password manager.
|
|
|
|
## Credential store layout
|
|
|
|
All credentials live in `~/.creds/` as flat `.env` files, one per service:
|
|
|
|
```
|
|
~/.creds/
|
|
├── beszel.env # Beszel monitoring (hub URL set, auth TBD — see #406)
|
|
├── discourse.env # Discourse forum API keys + admin key
|
|
├── phpipam.env # phpIPAM app_id + app_code
|
|
├── redmine.env # Redmine REST API key
|
|
├── technitium.env # Technitium DNS API key + admin password
|
|
└── uptime-kuma.env # Uptime Kuma push/API key
|
|
```
|
|
|
|
Permissions: directory `700`, files `600` (owner read/write only).
|
|
|
|
### Consumers
|
|
|
|
All credential consumers source from `~/.creds/`:
|
|
|
|
| Service | Wrapper / consumer | Mechanism |
|
|
|---|---|---|
|
|
| Redmine | `~/daytoday/redmine/bin/redmine` | `--env-file ~/.creds/redmine.env` |
|
|
| Redmine MCP | `mcp-redmine-wrapper.sh` | `set -a; . ~/.creds/redmine.env; set +a` |
|
|
| Discourse | `~/daytoday/discourse/bin/discourse` | `--env-file ~/.creds/discourse.env` |
|
|
| Discourse MCP | `mcp-discourse-wrapper.sh` | `set -a; . ~/.creds/discourse.env; set +a` |
|
|
| Beszel MCP | `mcp-beszel-wrapper.sh` | `set -a; . ~/.creds/beszel.env; set +a` |
|
|
| Uptime Kuma | (no active consumer yet) | Direct env reference |
|
|
| Technitium | (no active consumer yet) | Direct env reference |
|
|
| phpIPAM | (no active consumer yet) | Direct env reference |
|
|
|
|
## Bitwarden CLI
|
|
|
|
The Bitwarden CLI runs in a pinned Docker container — no host installation
|
|
required. Built from this directory's Dockerfile.
|
|
|
|
### Build
|
|
|
|
```bash
|
|
docker build -t reachableceo-bw-cli:2026.7.0 .
|
|
```
|
|
|
|
### Wrapper
|
|
|
|
```bash
|
|
# Symlink the wrapper onto PATH
|
|
ln -sf ~/projects/KNEL-AIMiddleware/tooling-cli/KNELCredsManager/scripts/bw ~/.local/bin/bw
|
|
```
|
|
|
|
### Usage
|
|
|
|
```bash
|
|
bw login # interactive first-time login
|
|
export BW_SESSION=$(bw unlock --raw) # unlock and capture session
|
|
bw sync # sync vault
|
|
bw list items # list all vault items
|
|
bw get item <name> # get a specific item
|
|
bw status # check auth/session status
|
|
```
|
|
|
|
Session state persists in `~/.local/share/bw-cli/` across container runs.
|
|
|
|
### MCP integration (machine-to-machine)
|
|
|
|
For agent automation without interactive login, the KNEL-AIMiddleware fleet
|
|
includes `mcp-bitwarden-wrapper.sh` which uses `BITWARDEN_CLIENT_ID` /
|
|
`BITWARDEN_CLIENT_SECRET` / `BITWARDEN_PASSWORD` env vars (machine account
|
|
auth). That is a separate integration from this CLI wrapper.
|
|
|
|
## Build arguments
|
|
|
|
| Arg | Default | Description |
|
|
|---|---|---|
|
|
| `BW_CLI_VERSION` | `2026.7.0` | Pinned @bitwarden/cli npm version |
|
|
|
|
## Environment variables
|
|
|
|
| Variable | Default | Description |
|
|
|---|---|---|
|
|
| `BW_CLI_IMAGE` | `reachableceo-bw-cli:2026.7.0` | Override image tag |
|
|
| `BW_SESSION` | (unset) | Session key from `bw unlock` |
|