lorentz
c155f56151
Adds a bws-CLI build stage to the Dockerfile and a docker-entrypoint.sh that runs `bws run -- node server.js` when BWS_ACCESS_TOKEN is set, falling back to a plain `node server.js` start when it's not. Lets AWS Route 53 credentials (and any future BWS-managed secret) reach the container without ever being written to the committed .env file. Fixed during phase 24 verification: - The bws CLI config only set state_dir; bws 2.x requires server_base (or server_identity) even for the default Bitwarden cloud instance, which crash-looped the container on every start. Added server_base = "https://vault.bitwarden.com". - docker-compose.yml's app.environment block re-declared BWS_ACCESS_TOKEN/BWS_PROJECT_ID as ${VAR:-} substitutions, which resolve against the root .env (not .env.local) and silently overrode the real token with an empty string. Removed the redundant re-declaration — env_file: .env.local already injects them. Verified live: pulse-app rebuilt and restarted with both fixes, AWS credentials confirmed reaching the Node process via BWS injection. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
10 lines
295 B
Bash
10 lines
295 B
Bash
#!/bin/sh
|
|
set -e
|
|
|
|
if [ -n "${BWS_ACCESS_TOKEN:-}" ]; then
|
|
echo "Loading secrets from Bitwarden Secrets Manager..."
|
|
exec bws run ${BWS_PROJECT_ID:+--project-id "${BWS_PROJECT_ID}"} -- node server.js
|
|
fi
|
|
|
|
echo "BWS_ACCESS_TOKEN not set; starting without Bitwarden secrets."
|
|
exec node server.js
|