Accessing a Secret from the Vault

Machine translation of the French original.

The park has two vaults, and the first question is which one to access. The criteria is who accesses the secret:

The secret is…	Vault	Tools
a machine secret: API key, service password, token, host SSH key	OpenBao, on its own machine (pi-bao)	bao-get · bao-put
a human secret: web account, recovery code, personal device	Vaultwarden	bws

This process dates back to 2026-09-27. Previously, everything lived in Vaultwarden: a note or older script that would look for an API key within it. A guardian now refuses to create an entry that resembles a machine secret.

Machine Secret – OpenBao

# noms des clés d'un chemin (jamais les valeurs)
bao-get <hôte>/<stack> --keys

# lire une valeur, et la déplacer sans jamais l'afficher
bao-get <hôte>/<stack> <CLÉ> | ssh -p <port-ssh> <user>@<hôte> 'script-qui-lit-stdin'

# écrire : la valeur arrive sur stdin, jamais en argument
printf '%s' "$VALEUR" | bao-put <hôte>/<stack> <CLÉ> --maintenant

The path machines/<hôte>/<stack> is a mirror of the encrypted secrets file of the stack. A synchronizer pulls it down to the container every five minutes (--maintenant does it immediately), and pushes any changes made directly in the encrypted file back up to OpenBao. When starting, the hosts never contact the vault: they read their local copy, so a vault that is shut down prevents no service from restarting.

No human intervention is required for a machine secret. Reading, writing, and managing a key can be done without any interaction.

Human Secret – Vaultwarden

The vault is already unlocked: a service maintains the session in ~/.cache/bw/session.

# 1. trouver l'identifiant de l'entrée — TOUJOURS filtrer
~/bin/bws list items --search <motif> | jq -r '.[] | "\(.id)  \(.name)"'

# 2. lire la valeur, par un tube
~/bin/bws get password <identifiant> | <consommateur-qui-lit-stdin>

Never run bw unlock

Without an interactive terminal, the command waits until expiration – and the vault was already open. This is wasted time on a non-existent problem.

bws list without a filter makes the object complete, including the password

This is why jq from step 1 exists. It's not about display comfort; it's about preventing the printing of all passwords that match the pattern.

Two failures masquer as a "locked box":

1. ~/.bwsession no longer exists (removed on 2026-08-20). It was an orphaned cache, frozen on a June session, that multiple sessions had claimed turn by turn while the service itself was writing to ~/.cache/bw/session.
2. bw invoked without an absolute path fails in the systemd context: the PATH of a unit does not contain ~/.npm-global/bin. The command not found is consumed, and the caller concludes that the "locked box" is open.

What the two boxes share

The value passes through a pipe, never through the screen, a command-line argument, or a displayed variable: it does not traverse the agent's context, the session log, or the list of processes.

A secret is recorded as soon as it is installed, in the same session, and no later. A secret that exists only in a .env on a host is a secret that will never be found when the host fails.

Dernière vérification de cette page : 2026-10-06