mirror of
https://github.com/Kruhlmann/punlock.git
synced 2026-11-05 09:24:08 +00:00
Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
14685a72d5 |
No files matched your search
@@ -1,64 +0,0 @@
|
||||
name: CI
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
pull_request:
|
||||
branches: [main]
|
||||
|
||||
env:
|
||||
CARGO_TERM_COLOR: always
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Install Rust
|
||||
uses: dtolnay/rust-action@stable
|
||||
|
||||
- name: Cache Cargo registry
|
||||
uses: actions/cache@v4
|
||||
with:
|
||||
path: |
|
||||
~/.cargo/registry
|
||||
~/.cargo/git
|
||||
target
|
||||
key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
|
||||
restore-keys: |
|
||||
${{ runner.os }}-cargo-
|
||||
- name: Build
|
||||
run: cargo build --release
|
||||
- name: Run tests
|
||||
run: cargo test --release
|
||||
|
||||
clippy:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- name: Install Rust
|
||||
uses: dtolnay/rust-action@stable
|
||||
- name: Cache Cargo registry
|
||||
uses: actions/cache@v4
|
||||
with:
|
||||
path: |
|
||||
~/.cargo/registry
|
||||
~/.cargo/git
|
||||
target
|
||||
key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
|
||||
restore-keys: |
|
||||
${{ runner.os }}-cargo-
|
||||
- name: Run Clippy
|
||||
run: cargo clippy -- -D warnings
|
||||
|
||||
fmt:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
|
||||
- name: Install Rust
|
||||
uses: dtolnay/rust-action@stable
|
||||
|
||||
- name: Check formatting
|
||||
run: cargo fmt -- --check
|
||||
Generated
+2
-2
@@ -117,9 +117,9 @@ checksum = "1628fb46dfa0b37568d12e5edd512553eccf6a22a78e8bde00bb4aed84d5bdbf"
|
||||
|
||||
[[package]]
|
||||
name = "bytes"
|
||||
version = "1.10.1"
|
||||
version = "1.11.1"
|
||||
source = "registry+https://github.com/rust-lang/crates.io-index"
|
||||
checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
|
||||
checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
|
||||
|
||||
[[package]]
|
||||
name = "caps"
|
||||
|
||||
@@ -1,90 +0,0 @@
|
||||
# Punlock
|
||||
|
||||
PasswordUNLOCKer - A tool to unlock secrets from [Bitwarden](https://bitwarden.com/) and mount them to the filesystem.
|
||||
|
||||
## Overview
|
||||
|
||||
Punlock authenticates with Bitwarden, fetches secrets based on `JMESPath` queries, and writes them to a secure runtime directory. It can also create symlinks to make secrets accessible at convenient locations.
|
||||
|
||||
## Features
|
||||
|
||||
- Authenticate with Bitwarden (including self-hosted instances)
|
||||
- Fetch secrets using `JMESPath` queries on Bitwarden items
|
||||
- Store secrets in a secure runtime directory (Linux: `/run/user/<uid>/punlock/`)
|
||||
- Create symlinks to secrets at custom locations
|
||||
- Automatic file permissions (readonly, 400 for private secrets)
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Rust (for building)
|
||||
- Bitwarden CLI (`bw`) installed and available in PATH
|
||||
|
||||
## Building
|
||||
|
||||
```bash
|
||||
cargo build --release
|
||||
```
|
||||
|
||||
The binary will be available at `target/release/punlock`.
|
||||
|
||||
## Configuration
|
||||
|
||||
Create a configuration file at one of these locations:
|
||||
- Current directory: `config.toml`
|
||||
- User config: `~/.config/punlock/config.toml`
|
||||
- System config: `/etc/punlock/config.toml`
|
||||
|
||||
Or specify a custom path with `--config`:
|
||||
|
||||
```bash
|
||||
punlock --config /path/to/config.toml
|
||||
```
|
||||
|
||||
### Configuration Format
|
||||
|
||||
```toml
|
||||
domain = "https://your-bitwarden-instance.com"
|
||||
email = "[email protected]"
|
||||
|
||||
# Secrets to unlock
|
||||
[[entries]]
|
||||
id = "bitwarden-item-uuid"
|
||||
query = "details.fields[[email protected]=='ssh_private_key'].value"
|
||||
path = "ssh/id_rsa"
|
||||
public = false
|
||||
links = ["~/.ssh/id_rsa"]
|
||||
|
||||
[[entries]]
|
||||
id = "another-item-uuid"
|
||||
query = "details.login.password"
|
||||
path = "api/tokens/github"
|
||||
public = true
|
||||
links = ["~/.config/github/token"]
|
||||
```
|
||||
|
||||
### Configuration Fields
|
||||
|
||||
- `domain` (optional): Bitwarden server URL for self-hosted instances
|
||||
- `email` (optional): Bitwarden account email
|
||||
- `entries`: Array of secrets to unlock
|
||||
- `id`: Bitwarden item UUID
|
||||
- `query`: `JMESPath` expression to extract the secret from the item
|
||||
- `path`: Relative path in the runtime directory to write the secret
|
||||
- `links` (optional): Array of symlink paths to create (supports `~` for home directory)
|
||||
- `public` (default: `false`): If true, file permissions are 0444; otherwise 0400
|
||||
|
||||
## Usage
|
||||
|
||||
```sh
|
||||
punlock
|
||||
# Or
|
||||
punlock --config /path/to/config.toml
|
||||
```
|
||||
|
||||
On first run, if email is not configured, you'll be prompted to enter it. You'll also need to enter your Bitwarden password.
|
||||
|
||||
## Runtime Directory
|
||||
|
||||
On Linux, secrets are stored in: `/run/user/<uid>/punlock/`
|
||||
|
||||
This is a tmpfs directory that is automatically cleaned on reboot to ensure that secrets do not stick around.
|
||||
Reference in new issue
Block a user