TSYS Group COO
dce7164889
Replace the Node.js @bitwarden/cli dependency with the pre-compiled native Rust binary (v2026.7.0) for CMMC/ITAR/STIG audit readiness. The Node.js dependency tree was a significant attack surface that would fail security audits. Infrastructure: - docker/bw-native/Dockerfile: minimal debian-slim + native bw binary - scripts/bw-cli.sh: host wrapper handling full auth lifecycle (config, API-key login, unlock, sync) inside the container - scripts/bw-entrypoint.sh: container entrypoint for auth lifecycle - scripts/bw-install.sh: one-command installer (download, build, deploy) Root causes fixed: - ~/.config/bw/env values now single-quoted (master password has $ chars that shell expansion corrupted, truncating 32→16 chars) - Added BW_SERVER for self-hosted instance (pwvault.turnsys.com) - Entrypoint bw config server tolerates re-run (|| true) All scripts pass shellcheck with zero warnings including info-level. Verified: bw status (unlocked, coo@turnsys.com), generate, list items. 💘 Generated with Crush Assisted-by: Crush:glm-5.2
45 lines
1.5 KiB
Bash
Executable File
45 lines
1.5 KiB
Bash
Executable File
#!/bin/sh
|
|
# bw-entrypoint.sh — Bitwarden auth lifecycle, runs inside the container.
|
|
#
|
|
# Mounted at /opt/bw/entrypoint.sh by the host-side wrapper (bw-cli.sh).
|
|
# Handles: server config, API-key login, vault unlock, sync.
|
|
# Then execs the real bw command with BW_SESSION set.
|
|
#
|
|
# API key authentication does NOT require TOTP. The API key itself is
|
|
# obtained from an authenticated web vault session, so 2FA is already
|
|
# satisfied at key-generation time.
|
|
#
|
|
# This script intentionally uses /bin/sh (not bash) for minimal container
|
|
# compatibility. shellcheck directive below silences the "not bash" note.
|
|
# shellcheck shell=sh
|
|
|
|
set -e
|
|
|
|
BW_SERVER="${BW_SERVER:-https://pwvault.turnsys.com}"
|
|
|
|
# Suppress BW CLI data-dir creation noise and telemetry.
|
|
export BW_NO_SENTRY=true
|
|
|
|
# --- Step 1: Configure server (fails harmlessly if already logged in) ---
|
|
bw config server "$BW_SERVER" >/dev/null 2>&1 || true
|
|
|
|
# --- Step 2: Login via API key (silently skips if already authenticated) ---
|
|
bw login --apikey >/dev/null 2>&1 || true
|
|
|
|
# --- Step 3: Unlock the vault ---
|
|
printf '%s' "$BW_PASSWORD" > /tmp/.bwpw
|
|
SESS=$(bw unlock --passwordfile /tmp/.bwpw --raw 2>/dev/null)
|
|
rm -f /tmp/.bwpw
|
|
if [ -z "$SESS" ]; then
|
|
echo "bw: unlock failed. Check BW_PASSWORD in ~/.config/bw/env" >&2
|
|
echo " Values must be single-quoted; \$ chars get mangled if unquoted." >&2
|
|
exit 1
|
|
fi
|
|
|
|
# --- Step 4: Sync ---
|
|
bw sync --session "$SESS" >/dev/null 2>&1 || true
|
|
|
|
# --- Step 5: Execute the requested command ---
|
|
export BW_SESSION="$SESS"
|
|
exec bw "$@"
|