TSYS Group COO
8c90d6809b
Replace npm-based @bitwarden/cli with the pre-compiled native Rust bw
binary (v2026.7.0) to eliminate Node.js from the credential management
layer for CMMC/ITAR/STIG audit readiness.
Changes:
- Dockerfile: download native bw binary instead of npm install; add
python3-pip for Playwright dependencies
- bw_helper.py: renamed from bw-helper.py (Python can't import hyphens);
added BW_SERVER config for self-hosted instance; use --passwordfile
for unlock (more reliable with native binary); removed TOTP from
login flow (API key auth does not require it)
- provision-agent.py: pass BW_SERVER env var to BitwardenHelper
- docker-compose.yml: add BW_SERVER env var
- .env.example: add BW_SERVER, document TOTP as optional
Verified: dry-run passes, bw status/auth/generate all work inside
the provisioner container against pwvault.turnsys.com.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
30 lines
909 B
Docker
30 lines
909 B
Docker
FROM mcr.microsoft.com/playwright:v1.52.0-noble
|
|
|
|
RUN apt-get update && \
|
|
apt-get install -y --no-install-recommends \
|
|
jq \
|
|
unzip \
|
|
wget \
|
|
python3-pip \
|
|
libzbar0 \
|
|
libzbar-dev \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
# Install Bitwarden CLI — native Rust binary (no Node.js/npm)
|
|
# Same CLI interface as the npm package but zero runtime dependencies.
|
|
ARG BW_CLI_VERSION=2026.7.0
|
|
RUN wget -q -O /tmp/bw.zip \
|
|
"https://github.com/bitwarden/clients/releases/download/cli-v${BW_CLI_VERSION}/bw-linux-${BW_CLI_VERSION}.zip" && \
|
|
unzip -o /tmp/bw.zip -d /usr/local/bin/ && \
|
|
chmod +x /usr/local/bin/bw && \
|
|
rm /tmp/bw.zip
|
|
|
|
# Install Python dependencies
|
|
COPY requirements.txt /tmp/
|
|
RUN python3 -m pip install --no-cache-dir --break-system-packages -r /tmp/requirements.txt
|
|
|
|
WORKDIR /app
|
|
COPY . .
|
|
|
|
ENTRYPOINT ["python3", "/app/provision-agent.py"]
|