apply command custom flags

[Blacksmoke16]

So I have a bit of an interesting use case I wanted to pitch. I searched around a bit and didn't really see anything that would help with. But is entirely possible I missed something.

Basically the gist of it is I use https://www.chezmoi.io/user-guide/password-managers/bitwarden/ to handle secrets (ssh keys, auth tokens, etc). However this causes chezmoi apply to always prompt me to enter my Bitwarden password to allow it to access my vault. I would rather not keep it unlocked all the time, nor do I like having to type it in every time I want to change some small setting in my bash settings or something.

My initial idea for this is the idea of custom flags that can be defined on the apply command. E.g. something along the lines of:

{{ if flag "refresh-secrets" }}
  export SOME_TOKEN={{ (bitwarden "item" "example.com").notes }}
{{ end }}

Then it would only prompt for my password when I want to refresh secrets, via chezmoi apply -Drefresh-secrets.

Thoughts? Is there a better way to go about this that is already built-in?

EDIT: I guess the problem would be having chezmoi know not to remove that text when the flag isn't passed. So maybe its not as straightforward as I was thinking.

[Lockszmith-GH]

This reminds me of another discussion about a similar issue, take a look at #3202, if that is something else, then I'm sure somoeone from the comunity that uses encryption would chime in.

[halostatue]

The proposed approach is novel (and can be emulated by not (env "SKIP_ENCRYPTED"), I believe), but faces the same problems as outlined in the linked discussion — and as the edit points out, chezmoi can't work with an "indeterminate" state as it needs to know whether its resolution is complete at all times.

I still think that the best option is to use a password CLI that understands temporary sessions. IMO, the standard BitWarden command-line client is insecure as written (it does not invalidate authentication sessions; I would not be surprised if they survived reboot). The best alternative to the BitWarden CLI (rbw) has temporary authentication that don't provide per-terminal tab protection, but at least they expire an hour after use (and can be configured to expire sooner).

1Password has sessions that last ~15 minutes, and chezmoi has an optional mode where it can obtain a session token and use it for the duration, so you don't have to remember to unlock the vault first (and if you have biometric authentication enabled, it just works except every 30 days…).

We would happily take a PR that would extend the bw support to grab a token just like we do with 1Password (I would want to make sure that we invalidate the token after use so that we’re behaving better than the bw cli by default).

But I don’t think that, bar your layering approach, there is a way to do what’s desired.

[Lockszmith-GH]

All excellent points. Thanks for the summary, let's hope this helps out OP.