docs: production architecture (mermaid), KNELBMS integration, README

Component + sequence + rotation-flow diagrams; consumer pattern; KNELBMS secrets-flow table + provisioning sequence; README to prod standard. Ticket: https://projects.knownelement.com/issues/832
2026-09-06 19:03:32 -05:00
parent 68ba03c1af
commit 9e0cf6aa33
3 changed files with 190 additions and 3 deletions
@@ -1,5 +1,43 @@
-# KNELSecretsManager (ARCHIVED — moved to KNEL/secrets)
+# KNELSecretsManager

-This body of work moved to **[KNEL/secrets](https://git.knownelement.com/KNEL/secrets)** per the 2026-09-03 repo split ([#769](https://projects.knownelement.com/issues/769)); content was ported as `legacy-knelsecretsmanager/` (secret-scanned clean — placeholders only).
+Fleet secrets management: a **pure-Go Bitwarden/Vaultwarden CLI** (`smcli`)
+in a house container, backed by the self-hosted TSGCOO vault. No upstream
+Rust `bw` binary, no Node runtime, no `.creds` text files — those patterns
+are retired (ADR-003; founder rulings #829/#832).

-This repo is historical. New secrets-management work happens in KNEL/secrets (#770).
+- Docs: [docs/architecture.md](docs/architecture.md) (diagrams, crypto, rotation program)
+- KNELBMS integration: [docs/integration-knelbms.md](docs/integration-knelbms.md)
+- Redmine: https://projects.knownelement.com/issues/832 (build) / #829 (migration+rotation)
+
+## Quick start (lane)
+
+```bash
+# TSGCOO account (COO-area chats; docker group, no sudo)
+/data2/TSGCOO/.local/bin/sm status
+
+# reachableceo crossover
+~/projects/KNEL/OAM/.tools/sm env creds/cloudron   # export URI/USERNAME/PASSWORD + keys
+~/projects/KNEL/OAM/.tools/sm get creds/librenms --field password
+~/projects/KNEL/OAM/.tools/sm setfield creds/<item> <KEY> <newvalue>   # rotation updates
+```
+
+## Layout
+
+| Path | What |
+|---|---|
+| `cli/cmd/smcli/` | the Go CLI (crypto, API, commands) |
+| `docker/Dockerfile.cli` | golang build → alpine runtime (CA certs, non-root) |
+| `docker/compose.yaml` | always-hot service `ukrrs-secretsmgr-cli` (digest-pinned) |
+| `archive/rust-bw-era/` | retired upstream-binary wrapper scripts |
+| `docs/ADR-003-GoCLI.md` | decision record |
+
+## Rules (binding)
+
+- Secrets live ONLY in the TSGCOO Bitwarden vault, accessed ONLY via this
+  CLI (container `ukrrs-secretsmgr-cli`, shims above). No textfile creds,
+  no upstream bw CLI — anywhere.
+- All work product is authored by Cloudron account identities
+  (ic-builder / ic-reviewer / manager-tsg / vptechops); the founder
+  account (ReachableCEO) reviews and approves.
+- Production-affecting rotations follow the CR gating + cross-linking
+  house rules (GLPI CR deep link in the PR/ticket; evidence on solve).