hantim/hantim-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cache bitwarden secrets in env vars to skip unlock on repeated runs

Browse Source
This commit is contained in:
Timothy Kim
2026-03-16 21:22:53 -04:00
parent 9d999c319d
commit 99a4a4b3ea
2 changed files with 44 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/new-app.sh
+25 -14
View File
@@ -54,23 +54,34 @@ if ! command -v dig &>/dev/null; then
exit 1
fi
# --- Get Gitea API token from Bitwarden ---
# --- Get secrets (cached in env vars, or fetch from Bitwarden) ---
if bw status 2>/dev/null | grep -q '"status":"unauthenticated"'; then
echo "Log in to Bitwarden:"
bw login
if [ -n "${HANTIM_GITEA_TOKEN:-}" ] && [ -n "${HANTIM_VULTR_API_KEY:-}" ] && [ -n "${HANTIM_DEPLOY_KEY:-}" ]; then
echo "Using cached secrets from environment."
GITEA_TOKEN="$HANTIM_GITEA_TOKEN"
VULTR_API_KEY="$HANTIM_VULTR_API_KEY"
DEPLOY_KEY="$HANTIM_DEPLOY_KEY"
else
if bw status 2>/dev/null | grep -q '"status":"unauthenticated"'; then
echo "Log in to Bitwarden:"
bw login
fi
if bw status 2>/dev/null | grep -q '"status":"locked"'; then
BW_SESSION=$(bw unlock --raw)
export BW_SESSION
fi
bw sync --session "${BW_SESSION:-}"
GITEA_TOKEN=$(bw get notes hantim-new-app-script --session "${BW_SESSION:-}")
VULTR_API_KEY=$(bw get notes hantim-vultr-api-key --session "${BW_SESSION:-}")
DEPLOY_KEY=$(bw get item hantim-server-deploy --session "${BW_SESSION:-}" | jq -r '.sshKey.privateKey')
export HANTIM_GITEA_TOKEN="$GITEA_TOKEN"
export HANTIM_VULTR_API_KEY="$VULTR_API_KEY"
export HANTIM_DEPLOY_KEY="$DEPLOY_KEY"
fi
if bw status 2>/dev/null | grep -q '"status":"locked"'; then
BW_SESSION=$(bw unlock --raw)
export BW_SESSION
fi
bw sync --session "${BW_SESSION:-}"
GITEA_TOKEN=$(bw get notes hantim-new-app-script --session "${BW_SESSION:-}")
VULTR_API_KEY=$(bw get notes hantim-vultr-api-key --session "${BW_SESSION:-}")
DEPLOY_KEY=$(bw get item hantim-server-deploy --session "${BW_SESSION:-}" | jq -r '.sshKey.privateKey')
DEPLOY_KEY_FILE=$(mktemp)
echo "$DEPLOY_KEY" > "$DEPLOY_KEY_FILE"
chmod 600 "$DEPLOY_KEY_FILE"
scripts/remove-app.sh
+19 -12
View File
@@ -28,21 +28,28 @@ if ! command -v bw &>/dev/null; then
exit 1
fi
# --- Get Gitea API token from Bitwarden ---
# --- Get secrets (cached in env vars, or fetch from Bitwarden) ---
if bw status 2>/dev/null | grep -q '"status":"unauthenticated"'; then
echo "Log in to Bitwarden:"
bw login
if [ -n "${HANTIM_GITEA_TOKEN:-}" ]; then
echo "Using cached secrets from environment."
GITEA_TOKEN="$HANTIM_GITEA_TOKEN"
else
if bw status 2>/dev/null | grep -q '"status":"unauthenticated"'; then
echo "Log in to Bitwarden:"
bw login
fi
if bw status 2>/dev/null | grep -q '"status":"locked"'; then
BW_SESSION=$(bw unlock --raw)
export BW_SESSION
fi
bw sync --session "${BW_SESSION:-}"
GITEA_TOKEN=$(bw get notes hantim-new-app-script --session "${BW_SESSION:-}")
export HANTIM_GITEA_TOKEN="$GITEA_TOKEN"
fi
if bw status 2>/dev/null | grep -q '"status":"locked"'; then
BW_SESSION=$(bw unlock --raw)
export BW_SESSION
fi
bw sync --session "${BW_SESSION:-}"
GITEA_TOKEN=$(bw get notes hantim-new-app-script --session "${BW_SESSION:-}")
# --- Delete Gitea repo ---
echo "==> Deleting Gitea repo $GITEA_ORG/$APP..."