hantim/hantim-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cache bitwarden secrets in env vars to skip unlock on repeated runs

Browse Source
This commit is contained in:
Timothy Kim
2026-03-16 21:22:53 -04:00
parent 9d999c319d
commit 99a4a4b3ea
2 changed files with 44 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/new-app.sh
+12 -1
View File
@@ -54,8 +54,14 @@ if ! command -v dig &>/dev/null; then
exit 1 exit 1
fi fi
# --- Get Gitea API token from Bitwarden --- # --- Get secrets (cached in env vars, or fetch from Bitwarden) ---
if [ -n "${HANTIM_GITEA_TOKEN:-}" ] && [ -n "${HANTIM_VULTR_API_KEY:-}" ] && [ -n "${HANTIM_DEPLOY_KEY:-}" ]; then
echo "Using cached secrets from environment."
GITEA_TOKEN="$HANTIM_GITEA_TOKEN"
VULTR_API_KEY="$HANTIM_VULTR_API_KEY"
DEPLOY_KEY="$HANTIM_DEPLOY_KEY"
else
if bw status 2>/dev/null | grep -q '"status":"unauthenticated"'; then if bw status 2>/dev/null | grep -q '"status":"unauthenticated"'; then
echo "Log in to Bitwarden:" echo "Log in to Bitwarden:"
bw login bw login
@@ -71,6 +77,11 @@ GITEA_TOKEN=$(bw get notes hantim-new-app-script --session "${BW_SESSION:-}")
VULTR_API_KEY=$(bw get notes hantim-vultr-api-key --session "${BW_SESSION:-}") VULTR_API_KEY=$(bw get notes hantim-vultr-api-key --session "${BW_SESSION:-}")
DEPLOY_KEY=$(bw get item hantim-server-deploy --session "${BW_SESSION:-}" | jq -r '.sshKey.privateKey') DEPLOY_KEY=$(bw get item hantim-server-deploy --session "${BW_SESSION:-}" | jq -r '.sshKey.privateKey')
export HANTIM_GITEA_TOKEN="$GITEA_TOKEN"
export HANTIM_VULTR_API_KEY="$VULTR_API_KEY"
export HANTIM_DEPLOY_KEY="$DEPLOY_KEY"
fi
DEPLOY_KEY_FILE=$(mktemp) DEPLOY_KEY_FILE=$(mktemp)
echo "$DEPLOY_KEY" > "$DEPLOY_KEY_FILE" echo "$DEPLOY_KEY" > "$DEPLOY_KEY_FILE"
chmod 600 "$DEPLOY_KEY_FILE" chmod 600 "$DEPLOY_KEY_FILE"
scripts/remove-app.sh
+8 -1
View File
@@ -28,8 +28,12 @@ if ! command -v bw &>/dev/null; then
exit 1 exit 1
fi fi
# --- Get Gitea API token from Bitwarden --- # --- Get secrets (cached in env vars, or fetch from Bitwarden) ---
if [ -n "${HANTIM_GITEA_TOKEN:-}" ]; then
echo "Using cached secrets from environment."
GITEA_TOKEN="$HANTIM_GITEA_TOKEN"
else
if bw status 2>/dev/null | grep -q '"status":"unauthenticated"'; then if bw status 2>/dev/null | grep -q '"status":"unauthenticated"'; then
echo "Log in to Bitwarden:" echo "Log in to Bitwarden:"
bw login bw login
@@ -43,6 +47,9 @@ fi
bw sync --session "${BW_SESSION:-}" bw sync --session "${BW_SESSION:-}"
GITEA_TOKEN=$(bw get notes hantim-new-app-script --session "${BW_SESSION:-}") GITEA_TOKEN=$(bw get notes hantim-new-app-script --session "${BW_SESSION:-}")
export HANTIM_GITEA_TOKEN="$GITEA_TOKEN"
fi
# --- Delete Gitea repo --- # --- Delete Gitea repo ---
echo "==> Deleting Gitea repo $GITEA_ORG/$APP..." echo "==> Deleting Gitea repo $GITEA_ORG/$APP..."