From 99a4a4b3ea852313b3d1cbc1c18eb5b3f2632ea7 Mon Sep 17 00:00:00 2001
From: Timothy Kim <timothykim@fastmail.fm>
Date: Mon, 16 Mar 2026 21:22:53 -0400
Subject: [PATCH] cache bitwarden secrets in env vars to skip unlock on
 repeated runs

---
 scripts/new-app.sh    | 39 +++++++++++++++++++++++++--------------
 scripts/remove-app.sh | 31 +++++++++++++++++++------------
 2 files changed, 44 insertions(+), 26 deletions(-)

diff --git a/scripts/new-app.sh b/scripts/new-app.sh
index ff0d1dc..4549b23 100755
--- a/scripts/new-app.sh
+++ b/scripts/new-app.sh
@@ -54,23 +54,34 @@ if ! command -v dig &>/dev/null; then
     exit 1
 fi
 
-# --- Get Gitea API token from Bitwarden ---
+# --- Get secrets (cached in env vars, or fetch from Bitwarden) ---
 
-if bw status 2>/dev/null | grep -q '"status":"unauthenticated"'; then
-    echo "Log in to Bitwarden:"
-    bw login
+if [ -n "${HANTIM_GITEA_TOKEN:-}" ] && [ -n "${HANTIM_VULTR_API_KEY:-}" ] && [ -n "${HANTIM_DEPLOY_KEY:-}" ]; then
+    echo "Using cached secrets from environment."
+    GITEA_TOKEN="$HANTIM_GITEA_TOKEN"
+    VULTR_API_KEY="$HANTIM_VULTR_API_KEY"
+    DEPLOY_KEY="$HANTIM_DEPLOY_KEY"
+else
+    if bw status 2>/dev/null | grep -q '"status":"unauthenticated"'; then
+        echo "Log in to Bitwarden:"
+        bw login
+    fi
+
+    if bw status 2>/dev/null | grep -q '"status":"locked"'; then
+        BW_SESSION=$(bw unlock --raw)
+        export BW_SESSION
+    fi
+
+    bw sync --session "${BW_SESSION:-}"
+    GITEA_TOKEN=$(bw get notes hantim-new-app-script --session "${BW_SESSION:-}")
+    VULTR_API_KEY=$(bw get notes hantim-vultr-api-key --session "${BW_SESSION:-}")
+    DEPLOY_KEY=$(bw get item hantim-server-deploy --session "${BW_SESSION:-}" | jq -r '.sshKey.privateKey')
+
+    export HANTIM_GITEA_TOKEN="$GITEA_TOKEN"
+    export HANTIM_VULTR_API_KEY="$VULTR_API_KEY"
+    export HANTIM_DEPLOY_KEY="$DEPLOY_KEY"
 fi
 
-if bw status 2>/dev/null | grep -q '"status":"locked"'; then
-    BW_SESSION=$(bw unlock --raw)
-    export BW_SESSION
-fi
-
-bw sync --session "${BW_SESSION:-}"
-GITEA_TOKEN=$(bw get notes hantim-new-app-script --session "${BW_SESSION:-}")
-VULTR_API_KEY=$(bw get notes hantim-vultr-api-key --session "${BW_SESSION:-}")
-DEPLOY_KEY=$(bw get item hantim-server-deploy --session "${BW_SESSION:-}" | jq -r '.sshKey.privateKey')
-
 DEPLOY_KEY_FILE=$(mktemp)
 echo "$DEPLOY_KEY" > "$DEPLOY_KEY_FILE"
 chmod 600 "$DEPLOY_KEY_FILE"
diff --git a/scripts/remove-app.sh b/scripts/remove-app.sh
index 930efa0..2187a44 100755
--- a/scripts/remove-app.sh
+++ b/scripts/remove-app.sh
@@ -28,21 +28,28 @@ if ! command -v bw &>/dev/null; then
     exit 1
 fi
 
-# --- Get Gitea API token from Bitwarden ---
+# --- Get secrets (cached in env vars, or fetch from Bitwarden) ---
 
-if bw status 2>/dev/null | grep -q '"status":"unauthenticated"'; then
-    echo "Log in to Bitwarden:"
-    bw login
+if [ -n "${HANTIM_GITEA_TOKEN:-}" ]; then
+    echo "Using cached secrets from environment."
+    GITEA_TOKEN="$HANTIM_GITEA_TOKEN"
+else
+    if bw status 2>/dev/null | grep -q '"status":"unauthenticated"'; then
+        echo "Log in to Bitwarden:"
+        bw login
+    fi
+
+    if bw status 2>/dev/null | grep -q '"status":"locked"'; then
+        BW_SESSION=$(bw unlock --raw)
+        export BW_SESSION
+    fi
+
+    bw sync --session "${BW_SESSION:-}"
+    GITEA_TOKEN=$(bw get notes hantim-new-app-script --session "${BW_SESSION:-}")
+
+    export HANTIM_GITEA_TOKEN="$GITEA_TOKEN"
 fi
 
-if bw status 2>/dev/null | grep -q '"status":"locked"'; then
-    BW_SESSION=$(bw unlock --raw)
-    export BW_SESSION
-fi
-
-bw sync --session "${BW_SESSION:-}"
-GITEA_TOKEN=$(bw get notes hantim-new-app-script --session "${BW_SESSION:-}")
-
 # --- Delete Gitea repo ---
 
 echo "==> Deleting Gitea repo $GITEA_ORG/$APP..."