diff options
Diffstat (limited to 'docs/DEPLOY.md')
| -rw-r--r-- | docs/DEPLOY.md | 30 |
1 files changed, 19 insertions, 11 deletions
diff --git a/docs/DEPLOY.md b/docs/DEPLOY.md index 5281fb6..bd08da2 100644 --- a/docs/DEPLOY.md +++ b/docs/DEPLOY.md @@ -121,25 +121,33 @@ The TUI remembers the server and user (never the password) in a successful login. Precedence: `--socket`/`--user`, then `BOKFD_SOCKET`/ `BOKFD_USER`, then that file. -For a credential read from a root-only file, unlocked with `sudo`, create an -admin-scoped token on the host and store it on the client machine: +For credentials from a Bitwarden/Vaultwarden item, use the user-space +launcher — nothing runs as root: + +```sh +install -m 755 scripts/bokftui-bw ~/.local/bin/bokftui-bw +BOKF_BW_ITEM=bokf bokftui-bw +``` + +`bokftui-bw` works with `rbw` (its agent keeps the vault unlocked for the +session) or the official Bitwarden CLI `bw`, where the session key is cached +in `~/.cache/bokf/bw-session` (mode 0600) so the master password is only +asked when the session expires. It reads the item's password, or the custom +field named by `BOKF_BW_FIELD`, and execs the TUI. + +Prefer a scoped, revocable API token over the account password: create one +on the host, put it in a custom field (e.g. `token`) of the item, then: ```sh docker compose exec -e BOKFD_PASSWORD='<pw>' bokfd \ bokfctl --user admin --org 1 token.create \ '{"label":"tui-laptop","scopes":["read","write","admin"]}' -# on the client machine: -sudo install -d -m 700 /etc/bokf -sudo sh -c 'umask 077; printf "%s\n" "bokf_..." > /etc/bokf/tui-token' -install -m 755 scripts/bokftui-sudo ~/bin/bokftui-sudo -bokftui-sudo +BOKF_BW_KIND=token BOKF_BW_FIELD=token BOKF_BW_ITEM=bokf bokftui-bw ``` -`bokftui-sudo` runs `sudo -v`, reads `/etc/bokf/tui-token` (falling back to -`/etc/bokf/tui-password`), exports the credential and execs `bokftui` as -your user; with `BOKFD_TOKEN` set the TUI logs in without showing the login -screen. Revoke the token with `token.revoke` when a machine goes away. +With `BOKFD_TOKEN` set the TUI logs in without showing the login screen. +Revoke the token with `token.revoke` when a machine goes away. ## TLS and external users |