ic-builder
9e0cf6aa33
Component + sequence + rotation-flow diagrams; consumer pattern; KNELBMS secrets-flow table + provisioning sequence; README to prod standard. Ticket: https://projects.knownelement.com/issues/832
44 lines
1.8 KiB
Markdown
44 lines
1.8 KiB
Markdown
# KNELSecretsManager
|
|
|
|
Fleet secrets management: a **pure-Go Bitwarden/Vaultwarden CLI** (`smcli`)
|
|
in a house container, backed by the self-hosted TSGCOO vault. No upstream
|
|
Rust `bw` binary, no Node runtime, no `.creds` text files — those patterns
|
|
are retired (ADR-003; founder rulings #829/#832).
|
|
|
|
- Docs: [docs/architecture.md](docs/architecture.md) (diagrams, crypto, rotation program)
|
|
- KNELBMS integration: [docs/integration-knelbms.md](docs/integration-knelbms.md)
|
|
- Redmine: https://projects.knownelement.com/issues/832 (build) / #829 (migration+rotation)
|
|
|
|
## Quick start (lane)
|
|
|
|
```bash
|
|
# TSGCOO account (COO-area chats; docker group, no sudo)
|
|
/data2/TSGCOO/.local/bin/sm status
|
|
|
|
# reachableceo crossover
|
|
~/projects/KNEL/OAM/.tools/sm env creds/cloudron # export URI/USERNAME/PASSWORD + keys
|
|
~/projects/KNEL/OAM/.tools/sm get creds/librenms --field password
|
|
~/projects/KNEL/OAM/.tools/sm setfield creds/<item> <KEY> <newvalue> # rotation updates
|
|
```
|
|
|
|
## Layout
|
|
|
|
| Path | What |
|
|
|---|---|
|
|
| `cli/cmd/smcli/` | the Go CLI (crypto, API, commands) |
|
|
| `docker/Dockerfile.cli` | golang build → alpine runtime (CA certs, non-root) |
|
|
| `docker/compose.yaml` | always-hot service `ukrrs-secretsmgr-cli` (digest-pinned) |
|
|
| `archive/rust-bw-era/` | retired upstream-binary wrapper scripts |
|
|
| `docs/ADR-003-GoCLI.md` | decision record |
|
|
|
|
## Rules (binding)
|
|
|
|
- Secrets live ONLY in the TSGCOO Bitwarden vault, accessed ONLY via this
|
|
CLI (container `ukrrs-secretsmgr-cli`, shims above). No textfile creds,
|
|
no upstream bw CLI — anywhere.
|
|
- All work product is authored by Cloudron account identities
|
|
(ic-builder / ic-reviewer / manager-tsg / vptechops); the founder
|
|
account (ReachableCEO) reviews and approves.
|
|
- Production-affecting rotations follow the CR gating + cross-linking
|
|
house rules (GLPI CR deep link in the PR/ticket; evidence on solve).
|