v1.4.1 — Vaultwarden import helper

Highlights

New bootstrap phase installs the Bitwarden CLI and generates a ready-to-import JSON of every platform credential — so right after bootstrap finishes, you can load the whole stack into Vaultwarden with a few clicks.

What's new

Added

• Phase 11 — scripts/11-vaultwarden-import.sh
  Runs automatically after the Keycloak OIDC phase:

  1. Waits for Vaultwarden at https://localhost:8443.

  2. Installs bw via the pre-built zip from vault.bitwarden.com (single native binary, ~50 MB, installs in seconds). Falls back to brew install bitwarden-cli if the download fails.

     • Why not brew first? The brew formula compiles from source on Apple Silicon and can take 10+ minutes.

  3. Renders ./vaultwarden-import.json from the current .env:

     Kind	Items
     Logins (8)	ArgoCD, Gitea, Keycloak admin, Keycloak dev SSO user, Grafana, Prometheus, Portal, Vaultwarden admin panel
     Secure notes (3)	Gitea PostgreSQL creds, Keycloak PostgreSQL creds, OIDC client IDs + secrets

  4. Prints import instructions for both the web UI and the bw CLI.

• .gitignore now blocks vaultwarden-import*.json and bitwarden-export*.json from accidental commits.

Changed

• scripts/bootstrap.sh — phase 11 wired in between 10-configure-oidc.sh and the completion banner; the banner directs the user to the import file.

How to use

After ./bootstrap.sh finishes:

1. Open  https://localhost:8443  →  accept self-signed cert
2. Create account — set a strong master password
3. Tools  →  Import data
4. File format:  Bitwarden (json)
5. Select file: vaultwarden-import.json
6. Import data

# Then delete the plaintext:
rm vaultwarden-import.json

Or use the CLI:

export NODE_TLS_REJECT_UNAUTHORIZED=0
bw config server https://localhost:8443
bw login <email-you-registered>
export BW_SESSION=\$(bw unlock --raw)
bw import bitwardenjson vaultwarden-import.json
rm vaultwarden-import.json

Full changelog

See CHANGELOG.md.