# KNELSecretsManager

Fleet secrets management: a **pure-Go Bitwarden/Vaultwarden CLI** (`smcli`)
in a house container, backed by the self-hosted TSGCOO vault. No upstream
Rust `bw` binary, no Node runtime, no `.creds` text files — those patterns
are retired (ADR-003; founder rulings #829/#832).

- Docs: [docs/architecture.md](docs/architecture.md) (diagrams, crypto, rotation program)
- KNELBMS integration: [docs/integration-knelbms.md](docs/integration-knelbms.md)
- Redmine: https://projects.knownelement.com/issues/832 (build) / #829 (migration+rotation)

## Quick start (lane)

```bash
# TSGCOO account (COO-area chats; docker group, no sudo)
/data2/TSGCOO/.local/bin/sm status

# reachableceo crossover
~/projects/KNEL/OAM/.tools/sm env creds/cloudron   # export URI/USERNAME/PASSWORD + keys
~/projects/KNEL/OAM/.tools/sm get creds/librenms --field password
~/projects/KNEL/OAM/.tools/sm setfield creds/<item> <KEY> <newvalue>   # rotation updates
```

## Layout

| Path | What |
|---|---|
| `cli/cmd/smcli/` | the Go CLI (crypto, API, commands) |
| `docker/Dockerfile.cli` | golang build → alpine runtime (CA certs, non-root) |
| `docker/compose.yaml` | always-hot service `ukrrs-secretsmgr-cli` (digest-pinned) |
| `archive/rust-bw-era/` | retired upstream-binary wrapper scripts |
| `docs/ADR-003-GoCLI.md` | decision record |

## Rules (binding)

- Secrets live ONLY in the TSGCOO Bitwarden vault, accessed ONLY via this
  CLI (container `ukrrs-secretsmgr-cli`, shims above). No textfile creds,
  no upstream bw CLI — anywhere.
- All work product is authored by Cloudron account identities
  (ic-builder / ic-reviewer / manager-tsg / vptechops); the founder
  account (ReachableCEO) reviews and approves.
- Production-affecting rotations follow the CR gating + cross-linking
  house rules (GLPI CR deep link in the PR/ticket; evidence on solve).