diff --git a/STATUS.md b/STATUS.md index eff2673..3ff2322 100644 --- a/STATUS.md +++ b/STATUS.md @@ -5,15 +5,24 @@ ## Current State -**Phase:** Orientation complete. Environment partially set up. Agent identity -provisioning execution is BLOCKED on user-provided prerequisites. +**Phase:** Bitwarden access operational. Container-based CLI (native Rust, no Node.js) deployed and verified. Agent identity provisioning unblocked on BW access — still needs Cloudron invite links and Gitea push credentials. **Primary task:** Redmine [#442](https://projects.knownelement.com/issues/442) — stand up first 3 AI agent identities (vp-techops, vp-secops, vp-techcompliance). ## What's Built -### This session (TSGCOO) +### This session (TSGCOO) — BW Infrastructure +- [x] **Bitwarden access operational** — container-based CLI using native Rust binary + (no Node.js at any layer, CMMC/ITAR/STIG-friendly) + - `docker/bw-native/Dockerfile` — minimal debian-slim + bw v2026.7.0 + - `scripts/bw-cli.sh` — host wrapper (auth lifecycle handled internally) + - `scripts/bw-entrypoint.sh` — container entrypoint (config, login, unlock, sync) + - `scripts/bw-install.sh` — one-command installer + - All scripts pass shellcheck (zero warnings, including info-level) + - Verified: `bw status` (unlocked, coo@turnsys.com @ pwvault.turnsys.com) +- [x] **Fixed `~/.config/bw/env`:** single-quoted all values (master password + has `$` chars that shell expansion corrupted), added `BW_SERVER` - [x] Full orientation — read all 7 planning docs, the provisioning automation, and the TSYSGroupAIOS template framework - [x] AGENTS.md created for org-buildout repo (committed) @@ -53,33 +62,35 @@ These are the prerequisites from `tsgcoo-bootstrap-prompt.md` §4. None are met. | # | Item | Status | Detail | |---|---|---|---| -| 1 | **Docker group membership** | BLOCKED | `docker` binary exists but TSGCOO is not in the docker group. `docker info` → permission denied on socket. Fix: `sudo usermod -aG docker TSGCOO` (requires re-login). | -| 2 | **Bitwarden CLI** | BLOCKED | `bw` not installed. Needed for all credential operations. Fix: install bw CLI, or rely on the provisioning Docker container (needs docker access first). | -| 3 | **BW credentials** | BLOCKED | `~/.config/bw/env` does not exist. Need BW_CLIENTID, BW_CLIENTSECRET, BW_PASSWORD for the dedicated COO BW account. | +| 1 | **Docker group membership** | RESOLVED | TSGCOO has docker access. All 20+ containers running. | +| 2 | **Bitwarden CLI** | RESOLVED | Container-based native Rust binary deployed. `bw` on PATH via `~/.local/bin/bw` wrapper. No Node.js. | +| 3 | **BW credentials** | RESOLVED | `~/.config/bw/env` exists with single-quoted values. Verified: `coo@turnsys.com` unlocked on `pwvault.turnsys.com`. Vault is empty (new account, not yet populated). | | 4 | **Cloudron invite links** | BLOCKED | `agents.yaml` does not exist (only `.example`). Need real invite URLs for vp-techops, vp-secops, vp-techcompliance (Q3) and optionally coo, svp-knel, svp-tctc (Q4). | | 5 | **Gitea push credentials** | BLOCKED | Cannot push to any repo (no auth). Need either BW-sourced Gitea token or manual credential setup. | | 6 | **Discourse admin access** | DEFERRED | Needed for VP SecOps category creation. Can be done after agent provisioning (assign to vp-techops). | ## What's Ready to Execute (once blockers resolved) -The provisioning pipeline is ready. Once items 1-5 are resolved: +BW access is operational. The remaining blockers are: +- **Cloudron invite links** (item 4) — needed to run the provisioning pipeline +- **Gitea push credentials** (item 5) — needed to push repos to Gitea + +Once item 4 is resolved: ```bash -# 1. Log into Bitwarden -. ~/.config/bw/env -bw login --apikey -export BW_SESSION=$(bw unlock --raw) +# BW is already operational via the container wrapper +bw status # verify access -# 2. Fill in the manifest +# Fill in the manifest cd ~/projects/agent-identity-provisioning cp agents.yaml.example agents.yaml # Edit: replace REPLACE_WITH_TOKEN with real Cloudron invite links -# 3. Set BW creds for the container +# Set BW creds for the container cp .env.example .env -# Fill in BW_CLIENTID, BW_CLIENTSECRET, BW_PASSWORD +# Fill in from ~/.config/bw/env -# 4. Build and run (provisions all Q3 agents) +# Build and run (provisions all Q3 agents) docker compose up --build # Or provision one agent at a time (recommended for first run) diff --git a/WORKING.md b/WORKING.md new file mode 100644 index 0000000..779b560 --- /dev/null +++ b/WORKING.md @@ -0,0 +1,12 @@ +# WORKING.md — Active Session Tracker + +Agent work only. User actions (deploy, review, UAT) are NOT tracked here. +The human decides when the work is "done". + +## Current Tasks + +(none — all agent work is committed) + + diff --git a/docker/bw-native/.gitignore b/docker/bw-native/.gitignore new file mode 100644 index 0000000..182c76a --- /dev/null +++ b/docker/bw-native/.gitignore @@ -0,0 +1 @@ +bw diff --git a/docker/bw-native/Dockerfile b/docker/bw-native/Dockerfile new file mode 100644 index 0000000..e970084 --- /dev/null +++ b/docker/bw-native/Dockerfile @@ -0,0 +1,23 @@ +# Dockerfile — Native Bitwarden CLI (Rust binary, no Node.js) +# +# Builds a minimal container image around the pre-compiled native bw CLI +# binary from the official Bitwarden GitHub releases. The binary is a +# Rust executable with glibc dependencies. No Node.js runtime is +# included or required. +# +# Build prerequisites: +# 1. Download the native binary: +# https://github.com/bitwarden/clients/releases/download/cli-v2026.7.0/bw-linux-2026.7.0.zip +# 2. Unzip and place the `bw` executable next to this Dockerfile. +# 3. Build: docker build -t reachableceo-bw-native:2026.7.0 . +# +# Or use the installer: scripts/bw-install.sh + +FROM debian:bookworm-slim + +RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/* + +COPY bw /usr/local/bin/bw +RUN chmod +x /usr/local/bin/bw + +ENTRYPOINT ["bw"] diff --git a/docs/JOURNAL.md b/docs/JOURNAL.md new file mode 100644 index 0000000..589bce0 --- /dev/null +++ b/docs/JOURNAL.md @@ -0,0 +1,43 @@ +# JOURNAL.md — Append-Only Decision & Pattern Log + +> This file is append-only. Never delete or reorder existing entries. +> Add one dated section per significant change: what changed, why, the pattern +> used, any challenges, and the commit hash. + +## 2026-08-13 + +### Bitwarden CLI rebuilt on native Rust binary (no Node.js) +- **What:** Replaced the Node.js-based `@bitwarden/cli` npm package with the + pre-compiled native Rust binary (`bw-linux-2026.7.0.zip` from GitHub releases). + Built a minimal Docker image (debian-slim + ca-certificates, no Node.js). + Added a host-side wrapper (`scripts/bw-cli.sh`) that handles the full auth + lifecycle (server config, API-key login, vault unlock, sync) inside the + container on every invocation. +- **Why:** Charles mandated zero Node.js in TSYS Group infrastructure for + security audit readiness (CMMC L3 / ITAR / STIG). The Node.js bw CLI + dependency tree is a significant attack surface that would fail audits. + The native Rust binary has zero runtime dependencies. +- **Root causes fixed during this work:** + 1. `~/.config/bw/env` values were unquoted — the master password contains + `$` characters that shell expansion corrupted (32-char password truncated + to 16 chars on every `source` call). Fixed by single-quoting all values. + 2. Missing `BW_SERVER` variable — the container defaulted to + `vault.bitwarden.com` (Bitwarden cloud) but the org uses a self-hosted + instance at `pwvault.turnsys.com`. Added `BW_SERVER` to the env file. + 3. Container entrypoint `bw config server` fails on re-run (returns exit 1 + when already logged in). Fixed with `|| true`. +- **Pattern:** Host wrapper (`scripts/bw-cli.sh`) installed as `~/.local/bin/bw` + invokes Docker container (`reachableceo-bw-native:2026.7.0`) with mounted + `scripts/bw-entrypoint.sh` that handles auth lifecycle, then execs the + requested `bw` subcommand. All execution inside containers; host stays clean. +- **Files added:** + - `docker/bw-native/Dockerfile` — image build definition + - `docker/bw-native/.gitignore` — excludes the 141MB binary from git + - `scripts/bw-cli.sh` — host wrapper (installed as `~/.local/bin/bw`) + - `scripts/bw-entrypoint.sh` — container entrypoint (auth lifecycle) + - `scripts/bw-install.sh` — one-command installer (download, build, install) + - `WORKING.md` — task tracker + - `docs/JOURNAL.md` — this file +- **Shellcheck:** All scripts pass with zero warnings (including info-level). +- **Verified against:** `bw status` (unlocked, coo@turnsys.com), + `bw generate`, `bw list items`, `bw list collections`. diff --git a/scripts/bw-cli.sh b/scripts/bw-cli.sh new file mode 100755 index 0000000..b13bbe3 --- /dev/null +++ b/scripts/bw-cli.sh @@ -0,0 +1,75 @@ +#!/usr/bin/env bash +# bw-cli.sh — Bitwarden CLI host wrapper (container-based, native Rust binary). +# +# Provides transparent `bw` access on hosts where the CLI is not installed +# natively. Runs the pre-compiled Rust bw binary inside a minimal Docker +# container (debian-slim + ca-certificates, NO Node.js). +# +# All tool execution happens inside the container. Nothing runs on the host +# except this wrapper, which only invokes docker. +# +# Usage: +# bw-cli.sh status Check vault status +# bw-cli.sh list items List vault items +# bw-cli.sh list collections List collections +# bw-cli.sh get password "Item" Retrieve a password +# bw-cli.sh get totp "Item" Retrieve a TOTP code +# bw-cli.sh get item "Item" Full item JSON +# bw-cli.sh generate -ulns Generate a password +# +# Install to ~/.local/bin/bw via: +# scripts/bw-install.sh +# +# Environment overrides: +# BW_ENV_FILE Path to credentials (default: ~/.config/bw/env) +# BW_IMAGE Docker image (default: reachableceo-bw-native:2026.7.0) +# BW_VOLUME Docker volume for persisted login state +# (default: tsys-bw-cli-state) +# BW_LIB_DIR Directory containing entrypoint.sh (default: ~/.local/share/bw) + +set -euo pipefail + +BW_ENV_FILE="${BW_ENV_FILE:-$HOME/.config/bw/env}" +BW_IMAGE="${BW_IMAGE:-reachableceo-bw-native:2026.7.0}" +BW_VOLUME="${BW_VOLUME:-tsys-bw-cli-state}" +BW_LIB_DIR="${BW_LIB_DIR:-$HOME/.local/share/bw}" + +# --- Validate prerequisites --- +if [ ! -f "$BW_ENV_FILE" ]; then + echo "bw: credential file not found: $BW_ENV_FILE" >&2 + echo " expected BW_CLIENTID, BW_CLIENTSECRET, BW_PASSWORD, BW_SERVER" >&2 + exit 1 +fi + +if ! docker image inspect "$BW_IMAGE" >/dev/null 2>&1; then + echo "bw: Docker image not found: $BW_IMAGE" >&2 + echo " build it: scripts/bw-install.sh" >&2 + exit 1 +fi + +if [ ! -f "$BW_LIB_DIR/entrypoint.sh" ]; then + echo "bw: entrypoint script missing: $BW_LIB_DIR/entrypoint.sh" >&2 + echo " install via: scripts/bw-install.sh" >&2 + exit 1 +fi + +# --- Load credentials (values are single-quoted in env file) --- +set -a +# shellcheck source=/dev/null +. "$BW_ENV_FILE" +set +a + +# --- Create persistent volume for BW CLI login state --- +docker volume create "$BW_VOLUME" >/dev/null 2>&1 || true + +# --- Run bw inside the container --- +docker run --rm -i \ + -e BW_CLIENTID \ + -e BW_CLIENTSECRET \ + -e BW_PASSWORD \ + -e BW_SERVER \ + -v "$BW_VOLUME:/root/.config/Bitwarden CLI" \ + -v "$BW_LIB_DIR/entrypoint.sh:/opt/bw/entrypoint.sh:ro" \ + --entrypoint sh \ + "$BW_IMAGE" \ + /opt/bw/entrypoint.sh "$@" diff --git a/scripts/bw-entrypoint.sh b/scripts/bw-entrypoint.sh new file mode 100755 index 0000000..22a224a --- /dev/null +++ b/scripts/bw-entrypoint.sh @@ -0,0 +1,44 @@ +#!/bin/sh +# bw-entrypoint.sh — Bitwarden auth lifecycle, runs inside the container. +# +# Mounted at /opt/bw/entrypoint.sh by the host-side wrapper (bw-cli.sh). +# Handles: server config, API-key login, vault unlock, sync. +# Then execs the real bw command with BW_SESSION set. +# +# API key authentication does NOT require TOTP. The API key itself is +# obtained from an authenticated web vault session, so 2FA is already +# satisfied at key-generation time. +# +# This script intentionally uses /bin/sh (not bash) for minimal container +# compatibility. shellcheck directive below silences the "not bash" note. +# shellcheck shell=sh + +set -e + +BW_SERVER="${BW_SERVER:-https://pwvault.turnsys.com}" + +# Suppress BW CLI data-dir creation noise and telemetry. +export BW_NO_SENTRY=true + +# --- Step 1: Configure server (fails harmlessly if already logged in) --- +bw config server "$BW_SERVER" >/dev/null 2>&1 || true + +# --- Step 2: Login via API key (silently skips if already authenticated) --- +bw login --apikey >/dev/null 2>&1 || true + +# --- Step 3: Unlock the vault --- +printf '%s' "$BW_PASSWORD" > /tmp/.bwpw +SESS=$(bw unlock --passwordfile /tmp/.bwpw --raw 2>/dev/null) +rm -f /tmp/.bwpw +if [ -z "$SESS" ]; then + echo "bw: unlock failed. Check BW_PASSWORD in ~/.config/bw/env" >&2 + echo " Values must be single-quoted; \$ chars get mangled if unquoted." >&2 + exit 1 +fi + +# --- Step 4: Sync --- +bw sync --session "$SESS" >/dev/null 2>&1 || true + +# --- Step 5: Execute the requested command --- +export BW_SESSION="$SESS" +exec bw "$@" diff --git a/scripts/bw-install.sh b/scripts/bw-install.sh new file mode 100755 index 0000000..32e7b5f --- /dev/null +++ b/scripts/bw-install.sh @@ -0,0 +1,125 @@ +#!/usr/bin/env bash +# bw-install.sh — Install the container-based Bitwarden CLI wrapper. +# +# Downloads the native Rust bw binary, builds the Docker image, and installs +# the host-side wrapper plus container entrypoint to the user's local paths. +# No Node.js is involved at any layer. +# +# Usage: +# bw-install.sh Download, build, and install everything +# bw-install.sh --check Verify installation status without changes +# +# Prerequisites: +# - docker on PATH +# - BW env file at ~/.config/bw/env (see prereq-check.sh in TSYSGroupAIOS) +# +# After install, ~/.local/bin/bw provides transparent CLI access. Add +# ~/.local/bin to PATH if not already (most distros do this via ~/.profile). + +set -euo pipefail + +HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +REPO_ROOT="$(cd "$HERE/.." && pwd)" + +BW_VERSION="2026.7.0" +BW_IMAGE="reachableceo-bw-native:${BW_VERSION}" +BW_BINARY_URL="https://github.com/bitwarden/clients/releases/download/cli-v${BW_VERSION}/bw-linux-${BW_VERSION}.zip" + +INSTALL_BIN="${HOME}/.local/bin" +INSTALL_LIB="${HOME}/.local/share/bw" +BUILD_DIR="" + +# --- Helpers --- +log_info() { printf '\033[0;34m›\033[0m %s\n' "$*"; } +log_ok() { printf '\033[0;32m✓\033[0m %s\n' "$*"; } +log_warn() { printf '\033[1;33m⚠\033[0m %s\n' "$*" >&2; } +log_error() { printf '\033[0;31m✗\033[0m %s\n' "$*" >&2; } +log_step() { printf '\n\033[1m== %s ==\033[0m\n' "$*"; } +die() { log_error "$*"; exit 1; } + +# --- Cleanup on exit --- +cleanup() { + [ -n "$BUILD_DIR" ] && rm -rf "$BUILD_DIR" +} +trap cleanup EXIT + +# --- Check mode --- +if [ "${1:-}" = "--check" ]; then + log_step "BW CLI installation check" + if command -v docker >/dev/null 2>&1; then + log_ok "docker on PATH" + else + log_error "docker not on PATH" + fi + if docker image inspect "$BW_IMAGE" >/dev/null 2>&1; then + log_ok "Docker image ${BW_IMAGE} exists" + else + log_error "Docker image ${BW_IMAGE} missing" + fi + if [ -x "${INSTALL_BIN}/bw" ]; then + log_ok "Host wrapper at ${INSTALL_BIN}/bw" + else + log_error "Host wrapper at ${INSTALL_BIN}/bw missing" + fi + if [ -f "${INSTALL_LIB}/entrypoint.sh" ]; then + log_ok "Entrypoint at ${INSTALL_LIB}/entrypoint.sh" + else + log_error "Entrypoint at ${INSTALL_LIB}/entrypoint.sh missing" + fi + exit 0 +fi + +# --- Prerequisites --- +command -v docker >/dev/null 2>&1 || die "docker not found on PATH" + +log_step "Installing container-based Bitwarden CLI (native Rust, no Node.js)" + +# --- Step 1: Download and extract the native binary --- +BUILD_DIR=$(mktemp -d) +log_info "Downloading bw ${BW_VERSION} native binary..." + +docker run --rm -v "${BUILD_DIR}:/build" alpine:3.20 \ + sh -c "apk add --no-cache unzip >/dev/null 2>&1 && \ + wget -q -O /build/bw.zip '${BW_BINARY_URL}' && \ + unzip -o /build/bw.zip -d /build/ && \ + rm /build/bw.zip && \ + chmod +x /build/bw" + +[ -f "${BUILD_DIR}/bw" ] || die "download failed: bw binary not found" +log_ok "Downloaded native binary" + +# --- Step 2: Build the Docker image --- +log_info "Building Docker image ${BW_IMAGE}..." + +DOCKERFILE_DIR="${REPO_ROOT}/docker/bw-native" +if [ ! -f "${DOCKERFILE_DIR}/Dockerfile" ]; then + die "Dockerfile not found: ${DOCKERFILE_DIR}/Dockerfile" +fi + +cp "${BUILD_DIR}/bw" "${DOCKERFILE_DIR}/bw" +docker build -t "$BW_IMAGE" "$DOCKERFILE_DIR" +rm -f "${DOCKERFILE_DIR}/bw" +log_ok "Built image ${BW_IMAGE}" + +# --- Step 3: Install host-side wrapper and entrypoint --- +mkdir -p "$INSTALL_BIN" "$INSTALL_LIB" + +cp "${HERE}/bw-cli.sh" "${INSTALL_BIN}/bw" +chmod 755 "${INSTALL_BIN}/bw" +log_ok "Installed wrapper to ${INSTALL_BIN}/bw" + +cp "${HERE}/bw-entrypoint.sh" "${INSTALL_LIB}/entrypoint.sh" +chmod 755 "${INSTALL_LIB}/entrypoint.sh" +log_ok "Installed entrypoint to ${INSTALL_LIB}/entrypoint.sh" + +# --- Step 4: Verify --- +log_info "Verifying installation..." +if "${INSTALL_BIN}/bw" --version >/dev/null 2>&1; then + log_ok "bw CLI is operational" +else + log_warn "bw wrapper installed but verification call failed" + log_warn "check ~/.config/bw/env credentials and try: bw status" +fi + +log_step "Installation complete" +log_info "Usage: bw status | bw list items | bw get password \"Item Name\""