${envwarden}

Manage your server secrets with Bitwarden

How?

Get your secure environment variables from Bitwarden onto your server.

envwarden

Installation

• Download

  envwarden

  (e.g.

  wget https://raw.githubusercontent.com/envwarden/envwarden/master/envwarden

  )

• chmod +x envwarden && sudo cp envwarden /usr/local/bin

  to make it executable and reachable
• Download and install the bw CLI and jq version 1.6 and above!

With Docker

• docker pull envwarden/envwarden

Usage

Adding secrets to Bitwarden

• Create an item you'd like to use for storing secrets. Try to make its name unique, so envwarden can easily find it and not any unrelated items. You might want to define the name based on your server or environment (e.g.

  staging

  ,

  development

  ,

  production

  )
• Add custom fields for each secure environment variable you need (fields can be text, hidden or boolean)
• You can add as many fields as you need, and you can also create multiple items, as long as they match the same search term (their secrets would be combined)
• You can also copy attachments on the searched items to a destination folder
• You should use separate logins for each environment, and ideally limit server access to only the secrets it needs, but it's up to you how to manage it

Getting secrets onto your server

• You can store your Bitwarden login credentials inside

  ~/.envwarden

  if you wish
• Otherwise, you would be prompted for your email and password (or both)
• You can then use

  eval $(envwarden)

  to get your secrets

  export

  ed to your environment
• Alternatively, you can output your secrets into an

  .env

  file using

  envwarden --dotenv

Usage: envwarden [--help] [--search] [--dotenv] [--copy]

To export environment variables, use: eval $(envwarden)
To create an .env file, use: envwarden --dotenv > .env
Options:
    -h --help
    -s --search  (optional) define the search term for bitwarden items (defaults to 'envwarden')
    -d --dotenv (optional) outputs to stdout in .env format
    -k --dotenv-docker (optional) outputs secrets to stdout in a "docker-friendly" .env format (no quotes)
    -c --copy  (optional) copies all attachments on the item to a folder
    -g --github envs to github actions compliance
You can use ~/.envwarden to store your credentials (just email, or email:password)

Running with Docker

You can provide your Bitwarden username and password using three methods:

# 1. Passing as environment to Docker
docker run -ti -e [email protected] -e BW_PASSWORD=careful envwarden/envwarden

2. Mapping your .envwarden file
docker run -ti -v $HOME/.envwarden:/root/.envwarden envwarden/envwarden
3. Waiting for bw to prompt for it for you
docker run -ti envwarden/envwarden

Importing secrets to Kubernetes

with just 3 lines of bash

Notes

envwarden

bw

eval

--dotenv

.env

envwarden

envwarden

envwarden

envwarden