reachableceo/org-buildout
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: container-based Bitwarden CLI using native Rust binary (no Node.js)

Browse Source 
Replace the Node.js @bitwarden/cli dependency with the pre-compiled
native Rust binary (v2026.7.0) for CMMC/ITAR/STIG audit readiness.
The Node.js dependency tree was a significant attack surface that
would fail security audits.

Infrastructure:
- docker/bw-native/Dockerfile: minimal debian-slim + native bw binary
- scripts/bw-cli.sh: host wrapper handling full auth lifecycle
  (config, API-key login, unlock, sync) inside the container
- scripts/bw-entrypoint.sh: container entrypoint for auth lifecycle
- scripts/bw-install.sh: one-command installer (download, build, deploy)

Root causes fixed:
- ~/.config/bw/env values now single-quoted (master password has $
  chars that shell expansion corrupted, truncating 32→16 chars)
- Added BW_SERVER for self-hosted instance (pwvault.turnsys.com)
- Entrypoint bw config server tolerates re-run (|| true)

All scripts pass shellcheck with zero warnings including info-level.
Verified: bw status (unlocked, coo@turnsys.com), generate, list items.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2
This commit is contained in:
TSYS Group COO
2026-09-07 14:51:13 -05:00
parent 2c91545c0f
commit dce7164889
8 changed files with 349 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
STATUS.md
+26 -15
View File
@@ -5,15 +5,24 @@
## Current State
**Phase:** Orientation complete. Environment partially set up. Agent identity
provisioning execution is BLOCKED on user-provided prerequisites.
**Phase:** Bitwarden access operational. Container-based CLI (native Rust, no Node.js) deployed and verified. Agent identity provisioning unblocked on BW access — still needs Cloudron invite links and Gitea push credentials.
**Primary task:** Redmine [#442](https://projects.knownelement.com/issues/442) —
stand up first 3 AI agent identities (vp-techops, vp-secops, vp-techcompliance).
## What's Built
### This session (TSGCOO)
### This session (TSGCOO) — BW Infrastructure
- [x] **Bitwarden access operational** — container-based CLI using native Rust binary
(no Node.js at any layer, CMMC/ITAR/STIG-friendly)
- `docker/bw-native/Dockerfile` — minimal debian-slim + bw v2026.7.0
- `scripts/bw-cli.sh` — host wrapper (auth lifecycle handled internally)
- `scripts/bw-entrypoint.sh` — container entrypoint (config, login, unlock, sync)
- `scripts/bw-install.sh` — one-command installer
- All scripts pass shellcheck (zero warnings, including info-level)
- Verified: `bw status` (unlocked, coo@turnsys.com @ pwvault.turnsys.com)
- [x] **Fixed `~/.config/bw/env`:** single-quoted all values (master password
has `$` chars that shell expansion corrupted), added `BW_SERVER`
- [x] Full orientation — read all 7 planning docs, the provisioning automation,
and the TSYSGroupAIOS template framework
- [x] AGENTS.md created for org-buildout repo (committed)
@@ -53,33 +62,35 @@ These are the prerequisites from `tsgcoo-bootstrap-prompt.md` §4. None are met.
| # | Item | Status | Detail |
|---|---|---|---|
| 1 | **Docker group membership** | BLOCKED | `docker` binary exists but TSGCOO is not in the docker group. `docker info` → permission denied on socket. Fix: `sudo usermod -aG docker TSGCOO` (requires re-login). |
| 2 | **Bitwarden CLI** | BLOCKED | `bw` not installed. Needed for all credential operations. Fix: install bw CLI, or rely on the provisioning Docker container (needs docker access first). |
| 3 | **BW credentials** | BLOCKED | `~/.config/bw/env` does not exist. Need BW_CLIENTID, BW_CLIENTSECRET, BW_PASSWORD for the dedicated COO BW account. |
| 1 | **Docker group membership** | RESOLVED | TSGCOO has docker access. All 20+ containers running. |
| 2 | **Bitwarden CLI** | RESOLVED | Container-based native Rust binary deployed. `bw` on PATH via `~/.local/bin/bw` wrapper. No Node.js. |
| 3 | **BW credentials** | RESOLVED | `~/.config/bw/env` exists with single-quoted values. Verified: `coo@turnsys.com` unlocked on `pwvault.turnsys.com`. Vault is empty (new account, not yet populated). |
| 4 | **Cloudron invite links** | BLOCKED | `agents.yaml` does not exist (only `.example`). Need real invite URLs for vp-techops, vp-secops, vp-techcompliance (Q3) and optionally coo, svp-knel, svp-tctc (Q4). |
| 5 | **Gitea push credentials** | BLOCKED | Cannot push to any repo (no auth). Need either BW-sourced Gitea token or manual credential setup. |
| 6 | **Discourse admin access** | DEFERRED | Needed for VP SecOps category creation. Can be done after agent provisioning (assign to vp-techops). |
## What's Ready to Execute (once blockers resolved)
The provisioning pipeline is ready. Once items 1-5 are resolved:
BW access is operational. The remaining blockers are:
- **Cloudron invite links** (item 4) — needed to run the provisioning pipeline
- **Gitea push credentials** (item 5) — needed to push repos to Gitea
Once item 4 is resolved:
```bash
# 1. Log into Bitwarden
. ~/.config/bw/env
bw login --apikey
export BW_SESSION=$(bw unlock --raw)
# BW is already operational via the container wrapper
bw status # verify access
# 2. Fill in the manifest
# Fill in the manifest
cd ~/projects/agent-identity-provisioning
cp agents.yaml.example agents.yaml
# Edit: replace REPLACE_WITH_TOKEN with real Cloudron invite links
# 3. Set BW creds for the container
# Set BW creds for the container
cp .env.example .env
# Fill in BW_CLIENTID, BW_CLIENTSECRET, BW_PASSWORD
# Fill in from ~/.config/bw/env
# 4. Build and run (provisions all Q3 agents)
# Build and run (provisions all Q3 agents)
docker compose up --build
# Or provision one agent at a time (recommended for first run)