@thibaultamartin Thanks for this! I'm using it to replace a hacky script I built for extracting an Ansible Vault secret from Vaultwarden (using the 'bw' CLI tool as your script does).

One small note: the script in your blog post sets a local 'password_names' variable but then doesn't appear to use it.

@thibaultamartin
Last year I built a 3 node Proxmox cluster and used Hashicorp's Vault for secrets management, but that solution looks great as well.

@bitwarden

@thibaultamartin There is also secret-tool, which allows you to just use your desktop keyring ;)

This way you safe yourself entering any master passwords, since this is all done by logging in.

https://grahamwatts.co.uk/gnome-secrets/#retrieving-secrets-with-secret-tool

@thibaultamartin @thibaultamartin Environment vars might not give you the security characteristics you expect. Example quote from the systemd docs: “Note that environment variables are not suitable for passing secrets (such as passwords, key material, …) to service processes. Environment variables set for a unit are exposed to unprivileged clients via D-Bus IPC, and generally not understood as being data that requires protection.

@thibaultamartin @bitwarden Hmm, that's very cool, but I do wonder how it could be used in production? The login command right now requires user input right?

@thibaultamartin @bitwarden Nix + direnv is great. I now have stuff like sops that loads and unloads automatically when i enter given directories!

@thibaultamartin I am curious: Why not use vaultwarden as a selfhosted bitwarden? :)