- Notifications
You must be signed in to change notification settings - Fork24
Manage your server secrets with Bitwarden
License
envwarden/envwarden
Folders and files
Name | Name | Last commit message | Last commit date | |
---|---|---|---|---|
Repository files navigation
I've decided to stop maintaining envwarden. Therecent changes by Bitwarden made me realize that there are better solutions for managing server secrets. I'm now looking at usingDoppler, which offers a free plan as well. It's far better suited for server secrets than envwarden. I'm not affiliated with Doppler in any way.
Thanks to everyone who used envwarden and especially to those who contributed to it. It was a fun project to work on, but it's time to say goodbye. 👋
Manage your server secrets withBitwarden
Get your secure environment variables from Bitwarden onto your server.
envwarden
searches your Bitwarden vault for items matchinga search criteria (defaults to 'envwarden').Then it goes through all custom fields on every item foundand make them available as envirnoment variables.
- Download
envwarden
(e.g.wget https://raw.githubusercontent.com/envwarden/envwarden/master/envwarden
) chmod +x envwarden && sudo cp envwarden /usr/local/bin
to make it executable and reachable- Download and install thebw CLI andjq version 1.6 and above!
docker pull envwarden/envwarden
- Create an item you'd like to use for storing secrets.Try to make its name unique, so envwarden can easily find itand not any unrelated items.You might want to define the name based on your server or environment(e.g.
staging
,development
,production
) - Add custom fields for each secure environment variable you need(fields can be text, hidden or boolean)
- You can add as many fields as you need, and you can also createmultiple items, as long as they match the same search term(their secrets would be combined)
- You can also copy attachments on the searched items to a destination folder
- You should use separate logins for each environment, and ideally limit serveraccess to only the secrets it needs, but it's up to you how to manage it
- You can store your Bitwarden login credentials inside
~/.envwarden
if you wish - Otherwise, you would be prompted for your email and password (or both)
- You can then use
eval $(envwarden)
to get your secretsexport
ed to your environment - Alternatively, you can output your secrets into an
.env
file usingenvwarden --dotenv
Usage: envwarden [--help] [--search] [--dotenv] [--copy]To export environment variables, use: `eval $(envwarden)`To create an .env file, use: `envwarden --dotenv > .env`Options: -h --help -s --search <keyword> (optional) define the search term for bitwarden items (defaults to 'envwarden') -d --dotenv (optional) outputs to stdout in .env format -k --dotenv-docker (optional) outputs secrets to stdout in a "docker-friendly" .env format (no quotes) -c --copy <destination folder> (optional) copies all attachments on the item to a folder -g --github envs to github actions compliance -ss --skip-sync (optional) skip the vault sync (default will sync on every invocation) You can use ~/.envwarden to store your credentials (email, email:password, or email:password:client_secret)See https://bitwarden.com/help/article/cli-auth-challenges/#get-your-personal-api-key
You can provide your Bitwarden username and password using three methods:
# 1. Passing as environment to Dockerdocker run -ti -e BW_USER=user@example.com -e BW_PASSWORD=careful envwarden/envwarden# 2. Mapping your `.envwarden` filedocker run -ti -v $HOME/.envwarden:/root/.envwarden envwarden/envwarden# 3. Waiting for `bw` to prompt for it for youdocker run -ti envwarden/envwarden
envwarden
is a very simple bash script that wraps around thebw
CLI. You can inspect it to make sure it's secure anddoesn't leak your secrets in any way. I tried to keep it as simple as possible, and also secure.
eval
is generally dangerous to run, but the script makes an effort to protect against command injection.--dotenv
might be a slightly safer option if your application can work with.env
files. Besides that, if you'reworried about command injection from people who have write access to your secrets, you might have bigger problems toworry about, and perhapsenvwarden
isn't for you :)
envwarden
would login and sync on every invocation. This isn't the fastest, but ideally you only need to run this whenyou bootstrap a new system, when you deploy, or when you need to refresh your secrets (in all cases, it probably makessense to fetch the fresh secrets anyway).
envwarden
is still experimental. Please use at your own risk. Feedback is welcome.
envwarden
is not affiliated or connected to Bitwarden or its creators 8bit Solutions LLC in any way.