LastVet gates scripts¶

Bitwarden Secrets Manager (BWS) setup uses two patterns depending on where the script runs.

`install-bws.sh` — per-user (developer workstations)¶

Use on agent-01, personal Macs, and other operator workstations. Installs bws to ~/.local/bin via the Bitwarden install script. Access token lives in .bitwarden.env (or equivalent) and is loaded by the developer shell. Pair with scripts/lib/bws-secrets.sh for audit and sync helpers.

`bootstrap-bws-machine.sh` — machine (service VMs)¶

Use on LastVet, Sovereign, and Angel service VMs where Postgres, MinIO, cloudflared, or similar run under systemd. Installs bws to /usr/local/bin. Machine access token is deployed to /etc/bitwarden/access-token (mode 440, owner root:ryan) with /etc/profile.d/bws.sh and a ~/.bashrc hook so login and non-login shells export BWS_ACCESS_TOKEN. Requires /tmp/bws-token-<hostname> to exist before running with sudo.

LastVet API deploy and env (R940)¶

Use on lastvet-api VM (VMID 107). API code lives at /opt/last.vet-api. Systemd units: lastvet-api-staging.service (port 3000), lastvet-api-prod.service (port 3001). Public hostnames: api-staging.last.vet, api.last.vet.

Do not use last.vet-api/infra/scripts/deploy-api-image.sh (retired AWS ECS workflow).

SSH from your workstation with GitHub agent forwarding:

ssh -A lastvet-api
/opt/lastvet-gates/scripts/deploy-lastvet-api.sh

Script	Description
`deploy-lastvet-api.sh`	Git pull `main`, `npm ci`, `npm run build`, restart staging + prod, health checks. Options: `--no-pull`, `--skip-build`, `--restore-env staging\\|prod\\|both`, `--staging-only`, `--prod-only`. Requires passwordless sudo; git pull needs `SSH_AUTH_SOCK` (use `ssh -A`).
`restore-lastvet-api-env-from-bws.sh`	`--env staging` or `--env prod`. R940 lane overrides AWS lane. Idempotent; never prints values. Empty BWS values are treated as missing (falls back to defaults such as `UPLOAD_DIR=/data/lastvet-uploads/{env}`).

Cloudflared operational scripts¶

Use on lastvet-edge (or any edge VM running the LastVet API tunnel). BWS keys live in the lastvet project: LASTVET_EDGE_CLOUDFLARED_ORIGIN_CERT, LASTVET_EDGE_CLOUDFLARED_TUNNEL_TOKEN.

Script	Description
`restore-cloudflared-from-bws.sh`	Rehydrate `/root/.cloudflared/cert.pem` and tunnel credentials JSON from Bitwarden (disaster recovery).
`cloudflared-tunnel-login-edge.sh`	Single-process `cloudflared tunnel login` wrapper; prints auth URL, waits for auto-download, documents browser-download fallback.

Login note: login.cloudflareaccess.org/<token> long-polls until browser auth completes. Use the auth URL from the same login process only. If auto-fetch fails, run restore-cloudflared-from-bws.sh or install browser-downloaded cert.pem manually.

Observability Phase 2 (R940)¶

Run from agent-01 (SSH + BWS access). Targets the observability VM at 192.168.1.93 / ryan@192.168.1.93 (use LAN IP; hostname resolves to Tailscale and breaks non-interactive SSH).

Script	Description
`observability/deploy-node-exporters.sh`	node_exporter on VMs 100–111 + pve-r940; GPU exporter on inference-01
`observability/install-postgres-exporter.sh`	postgres_exporter on lastvet-db (`POSTGRES_EXPORTER_PASSWORD` env or BWS)
`observability/setup-minio-prometheus-tokens.sh`	MinIO JWT bearer tokens → BWS
`observability/setup-caddy-metrics.sh`	Caddy global metrics + LAN admin API
`observability/deploy-prometheus-phase2.sh`	Push `/etc/prometheus/prometheus.yml` + bearer files
`observability/provision-grafana-dashboards.sh`	File-provision dashboards from `infra/observability/grafana/dashboards/`
`observability/deploy-slack-enrichment.sh`	Deploy `services/lastvet-slack-enrichment` to observability VM (webhook `:8088`, health Tailscale `:8089`)
`observability/deploy-alerting-phase4.sh`	Alertmanager + rules (webhook → enrichment service, email on critical)
`observability/verify-slack-enrichment.sh`	E2E test alert via Alertmanager + restart smoke
`observability/deploy-uptimerobot-slack-enrichment-health.sh`	UptimeRobot heartbeat safety net when enrichment `/health` is OK (Tailscale-only; push not pull)
`observability/restore-slack-enrichment-env-from-bws.sh`	On-VM BWS restore (optional; deploy script pushes env from agent-01 BWS)

See docs/observability/OBSERVABILITY_STACK.md.

`lib/bws-secrets.sh` — library (not run directly)¶

Shell library sourced by audit-bitwarden-secrets.sh, sync-bitwarden-secrets.sh, and related scripts. Not an entrypoint.