TSYS Group COO
8c90d6809b
Replace npm-based @bitwarden/cli with the pre-compiled native Rust bw
binary (v2026.7.0) to eliminate Node.js from the credential management
layer for CMMC/ITAR/STIG audit readiness.
Changes:
- Dockerfile: download native bw binary instead of npm install; add
python3-pip for Playwright dependencies
- bw_helper.py: renamed from bw-helper.py (Python can't import hyphens);
added BW_SERVER config for self-hosted instance; use --passwordfile
for unlock (more reliable with native binary); removed TOTP from
login flow (API key auth does not require it)
- provision-agent.py: pass BW_SERVER env var to BitwardenHelper
- docker-compose.yml: add BW_SERVER env var
- .env.example: add BW_SERVER, document TOTP as optional
Verified: dry-run passes, bw status/auth/generate all work inside
the provisioner container against pwvault.turnsys.com.
💘 Generated with Crush
Assisted-by: Crush:glm-5.2
16 lines
451 B
YAML
16 lines
451 B
YAML
services:
|
|
provision:
|
|
build: .
|
|
container_name: tsys-agent-provisioner
|
|
environment:
|
|
- BW_CLIENTID=${BW_CLIENTID}
|
|
- BW_CLIENTSECRET=${BW_CLIENTSECRET}
|
|
- BW_PASSWORD=${BW_PASSWORD}
|
|
- BW_SERVER=${BW_SERVER:-https://pwvault.turnsys.com}
|
|
- BW_TOTP_SECRET=${BW_TOTP_SECRET:-}
|
|
- HEADFUL=${HEADFUL:-false}
|
|
volumes:
|
|
- ./agents.yaml:/app/agents.yaml:ro
|
|
- ./state:/app/state
|
|
network_mode: host
|