Thijs Herman
9f8ebf2408
BREAKING: Removes Node.js/Bitwarden CLI dependency entirely. ## What changed - New native HTTP client talks directly to Vaultwarden API - Bitwarden-compatible crypto in pure Go: - AES-256-CBC + HMAC-SHA256 decryption - PBKDF2-SHA256 and Argon2id key derivation - HKDF key stretching (with legacy fallback) - Auto token refresh (never expires) - Background vault sync (configurable interval, default 5min) - Docker image: ~233MB → ~15MB (pure Alpine, no Node.js) ## New env vars - VAULTWARDEN_EMAIL (replaces CLIENT_ID/CLIENT_SECRET) - SYNC_INTERVAL (default: 5m) ## Removed - internal/vaultwarden/client_cli.go (CLI interaction) - Bitwarden CLI dependency (Node.js + npm package) - VAULTWARDEN_CLIENT_ID, VAULTWARDEN_CLIENT_SECRET env vars ## Added - internal/vaultwarden/crypto.go (encryption/decryption) - internal/vaultwarden/crypto_test.go (11 unit tests) - internal/vaultwarden/api_client.go (HTTP client) ## Unchanged - External API surface (GET /secret/:name, POST /refresh, GET /health) - All security middleware (auth, IP whitelist, rate limiting)
41 lines
1.1 KiB
Bash
41 lines
1.1 KiB
Bash
# ===========================================
|
|
# Vaultwarden API Configuration
|
|
# ===========================================
|
|
# Copy this file to .env and fill in your values.
|
|
# NEVER commit your actual .env file!
|
|
|
|
# --- Required ---
|
|
|
|
# Your Vaultwarden instance URL
|
|
VAULTWARDEN_URL=https://vault.yourdomain.com
|
|
|
|
# Your Vaultwarden login email
|
|
VAULTWARDEN_EMAIL=you@example.com
|
|
|
|
# Your Vaultwarden master password
|
|
VAULTWARDEN_PASSWORD=your-master-password
|
|
|
|
# API key for authenticating to this service (min 32 chars)
|
|
# Generate one: openssl rand -base64 32
|
|
API_KEY=
|
|
|
|
# --- Optional ---
|
|
|
|
# Restrict access to specific IPs/CIDRs
|
|
# ALLOWED_IPS=192.168.1.0/24,10.0.0.1
|
|
|
|
# Auto-whitelist GitHub Actions IPs (for CI/CD)
|
|
# ENABLE_GITHUB_IP_RANGES=true
|
|
|
|
# Trusted reverse proxy IPs (for correct client IP detection)
|
|
# TRUSTED_PROXY_IP=172.16.0.0/12
|
|
|
|
# How often to re-sync the vault (default: 5m)
|
|
# SYNC_INTERVAL=5m
|
|
|
|
# Environment (development shows detailed errors, production hides them)
|
|
# ENVIRONMENT=production
|
|
|
|
# Enable debug logging (shows secret names in logs — NOT for production!)
|
|
# DEBUG=false
|