From 31ea8d85c83f6d0c185fd9c4a9ceaef12226d3f6 Mon Sep 17 00:00:00 2001 From: Anders Betts Date: Thu, 17 Sep 2026 22:35:14 +0200 Subject: scripts: replace sudo credential wrapper with a Bitwarden launcher brw/bw lookup in user space; optional token via custom field --- docs/DEPLOY.md | 30 +++++++++++++++++++----------- 1 file changed, 19 insertions(+), 11 deletions(-) (limited to 'docs/DEPLOY.md') diff --git a/docs/DEPLOY.md b/docs/DEPLOY.md index 5281fb6..bd08da2 100644 --- a/docs/DEPLOY.md +++ b/docs/DEPLOY.md @@ -121,25 +121,33 @@ The TUI remembers the server and user (never the password) in a successful login. Precedence: `--socket`/`--user`, then `BOKFD_SOCKET`/ `BOKFD_USER`, then that file. -For a credential read from a root-only file, unlocked with `sudo`, create an -admin-scoped token on the host and store it on the client machine: +For credentials from a Bitwarden/Vaultwarden item, use the user-space +launcher — nothing runs as root: + +```sh +install -m 755 scripts/bokftui-bw ~/.local/bin/bokftui-bw +BOKF_BW_ITEM=bokf bokftui-bw +``` + +`bokftui-bw` works with `rbw` (its agent keeps the vault unlocked for the +session) or the official Bitwarden CLI `bw`, where the session key is cached +in `~/.cache/bokf/bw-session` (mode 0600) so the master password is only +asked when the session expires. It reads the item's password, or the custom +field named by `BOKF_BW_FIELD`, and execs the TUI. + +Prefer a scoped, revocable API token over the account password: create one +on the host, put it in a custom field (e.g. `token`) of the item, then: ```sh docker compose exec -e BOKFD_PASSWORD='' bokfd \ bokfctl --user admin --org 1 token.create \ '{"label":"tui-laptop","scopes":["read","write","admin"]}' -# on the client machine: -sudo install -d -m 700 /etc/bokf -sudo sh -c 'umask 077; printf "%s\n" "bokf_..." > /etc/bokf/tui-token' -install -m 755 scripts/bokftui-sudo ~/bin/bokftui-sudo -bokftui-sudo +BOKF_BW_KIND=token BOKF_BW_FIELD=token BOKF_BW_ITEM=bokf bokftui-bw ``` -`bokftui-sudo` runs `sudo -v`, reads `/etc/bokf/tui-token` (falling back to -`/etc/bokf/tui-password`), exports the credential and execs `bokftui` as -your user; with `BOKFD_TOKEN` set the TUI logs in without showing the login -screen. Revoke the token with `token.revoke` when a machine goes away. +With `BOKFD_TOKEN` set the TUI logs in without showing the login screen. +Revoke the token with `token.revoke` when a machine goes away. ## TLS and external users -- cgit v1.3