vpengops
e067eee330
The login grant requested offline_access but the issued refresh_token was parsed and discarded: every access token died with the ~1h Vaultwarden TTL, and consumers (all lanes) hit HTTP 401 on sync until a human re-logged in. - persist refresh_token in state (0600, same file) - add refresh grant (grant_type=refresh_token, rotated token saved) - on 401 for authed calls: refresh once, retry the request - persistTokens() keeps the rest of the state intact Build verified in golang:1.23-alpine (vet + gofmt clean). After deploy, one `sm login` issues a refresh token (~30d, rotated on use) and sessions self-heal from then on.
KNELSecretsManager
Fleet secrets management: a pure-Go Bitwarden/Vaultwarden CLI (smcli)
in a house container, backed by the self-hosted TSGCOO vault. No upstream
Rust bw binary, no Node runtime, no .creds text files — those patterns
are retired (ADR-003; founder rulings #829/#832).
- Docs: docs/architecture.md (diagrams, crypto, rotation program)
- KNELBMS integration: docs/integration-knelbms.md
- Redmine: https://projects.knownelement.com/issues/832 (build) / #829 (migration+rotation)
Quick start (lane)
# TSGCOO account (COO-area chats; docker group, no sudo)
/data2/TSGCOO/.local/bin/sm status
# reachableceo crossover
~/projects/KNEL/OAM/.tools/sm env creds/cloudron # export URI/USERNAME/PASSWORD + keys
~/projects/KNEL/OAM/.tools/sm get creds/librenms --field password
~/projects/KNEL/OAM/.tools/sm setfield creds/<item> <KEY> <newvalue> # rotation updates
Layout
| Path | What |
|---|---|
cli/cmd/smcli/ |
the Go CLI (crypto, API, commands) |
docker/Dockerfile.cli |
golang build → alpine runtime (CA certs, non-root) |
docker/compose.yaml |
always-hot service ukrrs-secretsmgr-cli (digest-pinned) |
archive/rust-bw-era/ |
retired upstream-binary wrapper scripts |
docs/ADR-003-GoCLI.md |
decision record |
Rules (binding)
- Secrets live ONLY in the TSGCOO Bitwarden vault, accessed ONLY via this
CLI (container
ukrrs-secretsmgr-cli, shims above). No textfile creds, no upstream bw CLI — anywhere. - All work product is authored by Cloudron account identities (ic-builder / ic-reviewer / manager-tsg / vptechops); the founder account (ReachableCEO) reviews and approves.
- Production-affecting rotations follow the CR gating + cross-linking house rules (GLPI CR deep link in the PR/ticket; evidence on solve).