KNELCredsManager: Centralized Credential Management

General
1

KNELCredsManager: Centralized Credential Management

Strategy

Two backends, split by access pattern:

Backend Use case Examples
HashiCorp Vault Shared/infrastructure secrets — consumed by multiple systems, agents, and projects Redmine API key, Discourse API key, Technitium DNS key, Uptime Kuma key, phpIPAM app code, Beszel creds
Bitwarden Non-shared/personal secrets — individual user credentials, not consumed by automation across projects Personal SSH keys, personal service logins, individual account passwords

KNELCredsManager is the unified front door: consumers call one interface and
get secrets regardless of which backend stores them.

Current state (phase 1 complete)

On-disk credential store at ~/.creds/ (6 services), all consumers rewired,
Bitwarden CLI containerized and ready.

Credential store layout

~/.creds/
├── beszel.env         # Beszel monitoring hub
├── discourse.env      # Discourse forum API keys
├── phpipam.env        # phpIPAM app credentials
├── redmine.env        # Redmine REST API key
├── technitium.env     # Technitium DNS API key + token
└── uptime-kuma.env    # Uptime Kuma API key

Permissions: directory 700, files 600.

Consumer wiring

Service Consumer Mechanism
Redmine ~/daytoday/redmine/bin/redmine --env-file ~/.creds/redmine.env
Redmine MCP mcp-redmine-wrapper.sh set -a; . ~/.creds/redmine.env; set +a
Discourse ~/daytoday/discourse/bin/discourse --env-file ~/.creds/discourse.env
Discourse MCP mcp-discourse-wrapper.sh set -a; . ~/.creds/discourse.env; set +a
Beszel MCP mcp-beszel-wrapper.sh set -a; . ~/.creds/beszel.env; set +a

Bitwarden CLI (containerized)

  • Image: reachableceo-bw-cli:2026.7.0 (pinned)
  • Source: KNEL-AIMiddleware/tooling-cli/KNELCredsManager/
  • Wrapper: ~/.local/bin/bw
  • Data: ~/.local/share/bw-cli/

Roadmap

Phase 2: HashiCorp Vault (shared secrets backend)

  1. Deploy Vault infrastructure — #408
  2. Migrate shared credentials from ~/.creds/ into Vault — #409
  3. Update consumers to pull from Vault instead of flat files
  4. KNELCredsManager provides the abstraction layer

Phase 3: Bitwarden machine accounts (non-shared secrets)

  1. Configure machine-account auth (non-interactive) — #410
  2. Wire KNELCredsManager to query Bitwarden for personal secrets
  3. Document which secrets live where (Vault vs Bitwarden)

Phase 4: Ansible Vault (TBD)

Explore integration for playbook-level secret encryption. Needs scoping. — #411

Redmine tracking

  • #407 — KNELCredsManager parent ticket
  • #408 — Deploy HashiCorp Vault
  • #409 — Migrate credentials to Vault
  • #410 — Bitwarden machine accounts
  • #411 — Ansible Vault exploration (TBD)
  • #406 — Beszel API credentials (PocketBase auth)

Git