| 1 | # 🤖 The Bitwarden vault contract — the ONE place the scripts and the vault |
| 2 | # agree on item names and where each value lives. Scripts read exactly what |
| 3 | # this file says and fail crisply when the vault doesn't match; they never |
| 4 | # guess. The vault side keeps these items named exactly this way — renaming |
| 5 | # one is a reviewed PR here plus the vault edit, in step, never one without |
| 6 | # the other (the sudoers-operators rule, applied to the vault). |
| 7 | # |
| 8 | # Sourced by release-server.sh, doctor.sh, ops-dev.sh. POSIX sh; constants |
| 9 | # only — no logic, no side effects, nothing here is secret (names, not |
| 10 | # values). |
| 11 | # shellcheck disable=SC2034 # consumed by the sourcing scripts |
| 12 | |
| 13 | # The Ed25519 seed that signs the server release feed. VALUE: a hidden custom |
| 14 | # field — the item has no password slot, and the field carries no agreed name |
| 15 | # yet, so readers pick the only >40-char field value. Naming that field (e.g. |
| 16 | # `credential`) and reading it exactly is the remaining half of this |
| 17 | # contract; doing so is a coordinated vault edit + script change. |
| 18 | BW_ITEM_SIGNING_KEY="Eleven Messenger server release signing key" |
| 19 | |
| 20 | # The DNSimple API token (Eleven account 176940) — the tofu dnsimple provider |
| 21 | # and DNS-01 issuance. VALUE: the login PASSWORD slot, nothing else. |
| 22 | BW_ITEM_DNSIMPLE="lchat DNSimple DNS-01 token (11ch.at — Eleven Messenger acct 176940)" |
| 23 | |
| 24 | # Per-operator dev agent credentials (docs/secrets.md § AWS): every operator |
| 25 | # holds EXACTLY ONE item whose name starts with this prefix — theirs, named |
| 26 | # for their revocable IAM identity (aws-dev-agent-<name>). VALUE: the sealed |
| 27 | # env file — KEY=VALUE lines in the secure note (or custom fields). |
| 28 | BW_ITEM_DEV_AGENT_PREFIX="aws-dev-agent-" |
| 29 | |
amadan