mrcharles
ecffb4e598
Consolidate the discourse-cli source into tooling-cli/discourse/
(CLI source, Dockerfile, README, AGENTS.md, validate.sh) with all
documentation rewritten to invoke the container via raw docker run
and credentials from the centralized ~/.creds/discourse.env store.
No bin/ wrapper, no system-dependent paths in the docs.
Removes the old discourse-cli/ subdirectory and updates the
KNELCredsManager consumer table to reference the container directly.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
KNELCredsManager
Centralized credential management for KNEL infrastructure. Stores service
credentials on disk in ~/.creds/ and provides a containerized Bitwarden CLI
for future migration to a password manager.
Credential store layout
All credentials live in ~/.creds/ as flat .env files, one per service:
~/.creds/
├── beszel.env # Beszel monitoring (hub URL set, auth TBD — see #406)
├── discourse.env # Discourse forum API keys + admin key
├── phpipam.env # phpIPAM app_id + app_code
├── redmine.env # Redmine REST API key
├── technitium.env # Technitium DNS API key + admin password
└── uptime-kuma.env # Uptime Kuma push/API key
Permissions: directory 700, files 600 (owner read/write only).
Consumers
All credential consumers source from ~/.creds/:
| Service | Wrapper / consumer | Mechanism |
|---|---|---|
| Redmine | ~/daytoday/redmine/bin/redmine |
--env-file ~/.creds/redmine.env |
| Redmine MCP | mcp-redmine-wrapper.sh |
set -a; . ~/.creds/redmine.env; set +a |
| Discourse | discourse-cli container (tooling-cli/discourse/) |
docker run --env-file ~/.creds/discourse.env |
| Discourse MCP | mcp-discourse-wrapper.sh |
set -a; . ~/.creds/discourse.env; set +a |
| Beszel MCP | mcp-beszel-wrapper.sh |
set -a; . ~/.creds/beszel.env; set +a |
| Uptime Kuma | (no active consumer yet) | Direct env reference |
| Technitium | (no active consumer yet) | Direct env reference |
| phpIPAM | (no active consumer yet) | Direct env reference |
Bitwarden CLI
The Bitwarden CLI runs in a pinned Docker container — no host installation required. Built from this directory's Dockerfile.
Build
docker build -t reachableceo-bw-cli:2026.7.0 .
Wrapper
# Symlink the wrapper onto PATH
ln -sf ~/projects/KNEL-AIMiddleware/tooling-cli/KNELCredsManager/scripts/bw ~/.local/bin/bw
Usage
bw login # interactive first-time login
export BW_SESSION=$(bw unlock --raw) # unlock and capture session
bw sync # sync vault
bw list items # list all vault items
bw get item <name> # get a specific item
bw status # check auth/session status
Session state persists in ~/.local/share/bw-cli/ across container runs.
MCP integration (machine-to-machine)
For agent automation without interactive login, the KNEL-AIMiddleware fleet
includes mcp-bitwarden-wrapper.sh which uses BITWARDEN_CLIENT_ID /
BITWARDEN_CLIENT_SECRET / BITWARDEN_PASSWORD env vars (machine account
auth). That is a separate integration from this CLI wrapper.
Build arguments
| Arg | Default | Description |
|---|---|---|
BW_CLI_VERSION |
2026.7.0 |
Pinned @bitwarden/cli npm version |
Environment variables
| Variable | Default | Description |
|---|---|---|
BW_CLI_IMAGE |
reachableceo-bw-cli:2026.7.0 |
Override image tag |
BW_SESSION |
(unset) | Session key from bw unlock |