Bitwarden Secrets Manager — LastVet¶

Team secrets live in the lastvet Secrets Manager project. Local files are generated by sync scripts and must stay gitignored.

One-time setup¶

# 1. Install CLIs
lastvet-gates/scripts/install-bws.sh   # Secrets Manager
brew install bitwarden-cli jq          # Password Manager

# 2. Verify which path works (run after configuring either path below)
lastvet-gates/scripts/verify-bitwarden-login.sh

Path A — Secrets Manager (CI/agents)¶

# Machine account → Projects → lastvet (Can read) → create access token AFTER grant
cp lastvet-gates/.bitwarden.env.example lastvet-gates/.bitwarden.env
# BWS_ACCESS_TOKEN="..."  (quote value — contains + and /)
# BWS_PROJECT_ID=93af53ce-9afe-45e9-948d-b47a014a75d9

lastvet-gates/scripts/sync-bitwarden-secrets.sh --auth sm ios

If token shows 0 projects/secrets: create a new access token after granting project access.

bw login
export BW_SESSION=$(bw unlock --raw)

# Create vault items named exactly like manifest keys (e.g. Secure Note "VA_OPEN_DATA_API_KEY")
lastvet-gates/scripts/verify-bitwarden-login.sh
lastvet-gates/scripts/sync-bitwarden-secrets.sh --auth vault ios

Or guided: lastvet-gates/scripts/bw-login.sh

Auto (default)¶

Tries Secrets Manager first, falls back to Password Manager vault:

lastvet-gates/scripts/sync-bitwarden-secrets.sh ios

Manifest keys (project `lastvet`)¶

Key	Used by
`VA_OPEN_DATA_API_KEY`	iOS Facilities/Forms → `Secrets.xcconfig` (BWS: `LASTVET_IOS_SHARED_VA_OPEN_DATA_API_KEY`)
`VETERAN_SESSION_EXCHANGE_SECRET_STAGING`	iOS Debug → `Secrets.xcconfig` (BWS: `LASTVET_AWS_STAGING_VETERAN_SESSION_EXCHANGE_SECRET`)
`VETERAN_SESSION_EXCHANGE_SECRET_PRODUCTION`	iOS Release → `Secrets.xcconfig` (BWS: `LASTVET_AWS_PROD_VETERAN_SESSION_EXCHANGE_SECRET`)
`VETERAN_JWT_SECRET`, `SECURE_LINK_HMAC_SECRET`	API → `.env.local` (must match AWS SM after populate)
`RAISE_*_PASSWORD`	Web deck gates → `.env.local`
`CLOUDFLARE_API_TOKEN`, `CLOUDFLARE_ACCOUNT_ID`	Shared CF creds → GitHub `last.vet-web` Actions (`scripts/sync-github-cloudflare-secrets.sh`)

Full list: bitwarden/secrets-manifest.json

Per-repo sync¶

lastvet-gates/scripts/sync-bitwarden-secrets.sh ios   # last.vet-ios/Secrets.xcconfig
lastvet-gates/scripts/sync-bitwarden-secrets.sh api   # last.vet-api/.env.local
lastvet-gates/scripts/sync-bitwarden-secrets.sh web   # last.vet-web/.env.local

iOS wrapper (same as ios target):

cd last.vet-ios && ./scripts/sync-secrets-from-bitwarden.sh

Notes¶

VA OAuth (Patient Health + Service History) is not in Secrets Manager — client IDs are in VAAuthConfig.swift.
Open-data apikey is a separate developer.va.gov credential; add it as VA_OPEN_DATA_API_KEY in the lastvet project.
BWS_ACCESS_TOKEN stays in .bitwarden.env only (bootstrap credential).