External Secrets setup

Setup the external secrets helm charts
Convert hard coded secrets to external secrets
Add BitWarden CLI for serving external secrets

pkgs/default.nix

@@ -14,6 +14,7 @@ in
   hms = c ./hms { };
   inject-darwin = c ./inject-darwin.nix { };
   inject = c ./inject.nix { };
+  img-bitwarden = c ./img-bitwarden.nix { };
   qemu-hook = c ./qemu-hook.nix { };
   setup-ssh = c ./setup-ssh { };
   upgrade-pg-cluster = c ./upgrade-pg-cluster.nix { };

pkgs/img-bitwarden.nix

@@ -0,0 +1,44 @@
+{
+  bitwarden-cli,
+  cacert,
+  dockerTools,
+  lib,
+  writeShellApplication,
+  ...
+}:
+dockerTools.buildLayeredImage {
+  name = "img-bitwarden";
+  tag = "latest";
+  contents = [
+    dockerTools.binSh
+    dockerTools.caCertificates
+  ];
+  config = {
+    Cmd = [
+      (lib.getExe (writeShellApplication {
+        name = "bitwarden-cli-entrypoint.sh";
+        runtimeInputs = [ bitwarden-cli ];
+        text = ''
+          set -ex
+
+          # Uncomment if you need to hit a custom host
+          #bw config server ''${BW_HOST}
+
+          echo "Using apikey to log in"
+          bw login --apikey --raw
+          BW_SESSION="$(bw unlock --passwordenv BW_PASSWORD --raw)"
+          export BW_SESSION
+
+          echo 'Running "bw serve" on port 8087'
+          bw serve --hostname all --port 8087
+        '';
+      }))
+    ];
+    Env = [
+      "CURL_CA_BUNDLE=${cacert}/etc/ssl/certs/ca-bundle.crt"
+    ];
+    ExposedPorts = {
+      "8087/tcp" = { };
+    };
+  };
+}