Greg Hellings
ce5f604636
Setup the external secrets helm charts Convert hard coded secrets to external secrets Add BitWarden CLI for serving external secrets
45 lines
959 B
Nix
45 lines
959 B
Nix
{
|
|
bitwarden-cli,
|
|
cacert,
|
|
dockerTools,
|
|
lib,
|
|
writeShellApplication,
|
|
...
|
|
}:
|
|
dockerTools.buildLayeredImage {
|
|
name = "img-bitwarden";
|
|
tag = "latest";
|
|
contents = [
|
|
dockerTools.binSh
|
|
dockerTools.caCertificates
|
|
];
|
|
config = {
|
|
Cmd = [
|
|
(lib.getExe (writeShellApplication {
|
|
name = "bitwarden-cli-entrypoint.sh";
|
|
runtimeInputs = [ bitwarden-cli ];
|
|
text = ''
|
|
set -ex
|
|
|
|
# Uncomment if you need to hit a custom host
|
|
#bw config server ''${BW_HOST}
|
|
|
|
echo "Using apikey to log in"
|
|
bw login --apikey --raw
|
|
BW_SESSION="$(bw unlock --passwordenv BW_PASSWORD --raw)"
|
|
export BW_SESSION
|
|
|
|
echo 'Running "bw serve" on port 8087'
|
|
bw serve --hostname all --port 8087
|
|
'';
|
|
}))
|
|
];
|
|
Env = [
|
|
"CURL_CA_BUNDLE=${cacert}/etc/ssl/certs/ca-bundle.crt"
|
|
];
|
|
ExposedPorts = {
|
|
"8087/tcp" = { };
|
|
};
|
|
};
|
|
}
|