VP TechOpsandvptechops
01b0eed9fc
Adds the dockerized bw deployment in production use on the TSGCOO orchestration host since 2026-08-13: pinned debian-slim image carrying the pre-compiled bw binary, an in-container auth lifecycle entrypoint (config, API-key login, unlock, sync), a transparent host wrapper, and a one-command installer. ADR-002 records the decision and supersedes ADR-001 for BW CLI purposes: hosts keep zero language runtimes. Known caveat documented: the upstream "native" binary is a Node.js SEA, so Node is embedded in the image though absent from all hosts. Shellcheck clean (zero warnings incl. info-level).
76 lines
2.6 KiB
Bash
Executable File
76 lines
2.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# bw-cli.sh — Bitwarden CLI host wrapper (container-based, native Rust binary).
|
|
#
|
|
# Provides transparent `bw` access on hosts where the CLI is not installed
|
|
# natively. Runs the pre-compiled Rust bw binary inside a minimal Docker
|
|
# container (debian-slim + ca-certificates, NO Node.js).
|
|
#
|
|
# All tool execution happens inside the container. Nothing runs on the host
|
|
# except this wrapper, which only invokes docker.
|
|
#
|
|
# Usage:
|
|
# bw-cli.sh status Check vault status
|
|
# bw-cli.sh list items List vault items
|
|
# bw-cli.sh list collections List collections
|
|
# bw-cli.sh get password "Item" Retrieve a password
|
|
# bw-cli.sh get totp "Item" Retrieve a TOTP code
|
|
# bw-cli.sh get item "Item" Full item JSON
|
|
# bw-cli.sh generate -ulns Generate a password
|
|
#
|
|
# Install to ~/.local/bin/bw via:
|
|
# scripts/bw-install.sh
|
|
#
|
|
# Environment overrides:
|
|
# BW_ENV_FILE Path to credentials (default: ~/.config/bw/env)
|
|
# BW_IMAGE Docker image (default: reachableceo-bw-native:2026.7.0)
|
|
# BW_VOLUME Docker volume for persisted login state
|
|
# (default: tsys-bw-cli-state)
|
|
# BW_LIB_DIR Directory containing entrypoint.sh (default: ~/.local/share/bw)
|
|
|
|
set -euo pipefail
|
|
|
|
BW_ENV_FILE="${BW_ENV_FILE:-$HOME/.config/bw/env}"
|
|
BW_IMAGE="${BW_IMAGE:-reachableceo-bw-native:2026.7.0}"
|
|
BW_VOLUME="${BW_VOLUME:-tsys-bw-cli-state}"
|
|
BW_LIB_DIR="${BW_LIB_DIR:-$HOME/.local/share/bw}"
|
|
|
|
# --- Validate prerequisites ---
|
|
if [ ! -f "$BW_ENV_FILE" ]; then
|
|
echo "bw: credential file not found: $BW_ENV_FILE" >&2
|
|
echo " expected BW_CLIENTID, BW_CLIENTSECRET, BW_PASSWORD, BW_SERVER" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if ! docker image inspect "$BW_IMAGE" >/dev/null 2>&1; then
|
|
echo "bw: Docker image not found: $BW_IMAGE" >&2
|
|
echo " build it: scripts/bw-install.sh" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [ ! -f "$BW_LIB_DIR/entrypoint.sh" ]; then
|
|
echo "bw: entrypoint script missing: $BW_LIB_DIR/entrypoint.sh" >&2
|
|
echo " install via: scripts/bw-install.sh" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# --- Load credentials (values are single-quoted in env file) ---
|
|
set -a
|
|
# shellcheck source=/dev/null
|
|
. "$BW_ENV_FILE"
|
|
set +a
|
|
|
|
# --- Create persistent volume for BW CLI login state ---
|
|
docker volume create "$BW_VOLUME" >/dev/null 2>&1 || true
|
|
|
|
# --- Run bw inside the container ---
|
|
docker run --rm -i \
|
|
-e BW_CLIENTID \
|
|
-e BW_CLIENTSECRET \
|
|
-e BW_PASSWORD \
|
|
-e BW_SERVER \
|
|
-v "$BW_VOLUME:/root/.config/Bitwarden CLI" \
|
|
-v "$BW_LIB_DIR/entrypoint.sh:/opt/bw/entrypoint.sh:ro" \
|
|
--entrypoint sh \
|
|
"$BW_IMAGE" \
|
|
/opt/bw/entrypoint.sh "$@"
|