Thijs Herman
059f23af2a
chore: fix module path to match GitHub URL, update Makefile GHCR path
...
- Module: github.com/thijsherman → github.com/Turbootzz
- Makefile: turboot/ → ghcr.io/turbootzz/
- Added docker-push-tag target
2026-02-20 18:18:13 +00:00
Thijs Herman
9f8ebf2408
feat: replace Bitwarden CLI with native Go API client ( #2 )
...
BREAKING: Removes Node.js/Bitwarden CLI dependency entirely.
## What changed
- New native HTTP client talks directly to Vaultwarden API
- Bitwarden-compatible crypto in pure Go:
- AES-256-CBC + HMAC-SHA256 decryption
- PBKDF2-SHA256 and Argon2id key derivation
- HKDF key stretching (with legacy fallback)
- Auto token refresh (never expires)
- Background vault sync (configurable interval, default 5min)
- Docker image: ~233MB → ~15MB (pure Alpine, no Node.js)
## New env vars
- VAULTWARDEN_EMAIL (replaces CLIENT_ID/CLIENT_SECRET)
- SYNC_INTERVAL (default: 5m)
## Removed
- internal/vaultwarden/client_cli.go (CLI interaction)
- Bitwarden CLI dependency (Node.js + npm package)
- VAULTWARDEN_CLIENT_ID, VAULTWARDEN_CLIENT_SECRET env vars
## Added
- internal/vaultwarden/crypto.go (encryption/decryption)
- internal/vaultwarden/crypto_test.go (11 unit tests)
- internal/vaultwarden/api_client.go (HTTP client)
## Unchanged
- External API surface (GET /secret/:name, POST /refresh, GET /health)
- All security middleware (auth, IP whitelist, rate limiting)
2026-02-20 13:28:38 +01:00
Thijs Herman
e320f95d9f
Security: Redact secret names from production logs & bind port to localhost ( #1 )
...
* security: redact secret names from logs, bind port to localhost
- handlers: replace secret names in Warn/Error logs with client IP
(prevents information disclosure via log access/injection)
- client: downgrade secret name logs from Info to Debug level
(Debug is discarded in production via io.Discard)
- docker-compose: bind port to 127.0.0.1:8080 instead of 0.0.0.0:8080
(prevents direct access bypassing reverse proxy)
Found during security pen test of vault.turboot.com
* Enhance logging for secret retrieval and cache access
2026-02-20 12:39:04 +01:00
Turbootzz
70481d0350
fixed Fiber IP security and cleanup code
2025-10-24 21:20:29 +02:00
Turbootzz
3055c413ef
added CLI improvments to docker
2025-10-24 19:01:39 +02:00
Turbootzz
d7a51a0f60
changed auth method
2025-10-24 18:28:52 +02:00
Turbootzz
1daa409a73
fixed CLI issue
2025-10-24 14:10:01 +02:00
Turbootzz
4131345add
security update
2025-10-24 13:25:05 +02:00
Turbootzz
5f937f6213
Added implementation
2025-10-17 13:32:58 +02:00
Thijs Herman