Secrets manager

[modem7]

Heya,

Will vaultwarden eventually be compatible with the secrets manager that's been announced recently?

Thanks!

[BlackDex]

No. It's not open source licensed, and not build for the open source web-vault.

[mon5termatt]

https://bitwarden.com/products/secrets-manager/

might have to run it separate but looks like they will make it hostable

[LucEast]

Do I get it right, that the Secrets-Manager is now open sourced?

• https://www.reddit.com/r/Bitwarden/comments/15ya0ka/bitwarden_secrets_manager_is_now_generally/
• https://bitwarden.com/blog/secrets-manager-general-availability/

[BlackDex]

The source was already available if you would have checked my link.
Also checkout https://github.com/bitwarden/server/tree/master/bitwarden_license/src/Commercial.Core

It's all bound to the commercial license, and thus, we are not allowed to ship that code in any way, or we need to build it from scratch our self.

I think previously it wasn't available for everybody, but now it is.

[LucEast]

I think previously it wasn't available for everybody, but now it is.

Sorry for getting this wrong. I don't contribute that much and have thought that the fact that the Secrets Manager has been made FOSS automaticly allows to be used/contributed to.

[stefan0xC]

@LucEast Having the source code available does not make something FOSS. The Bitwarden project itself calls the Bitwarden License a "source available" license. Because the commercial modules under the bitwarden_license folder require "a paid subscription" to use in production (among other restrictions), they are neither "open source" nor "free software".

[luckydonald]

so you can selfhost their product for $ 12 per month now.

[Dreamtrailtv]

is it possible that parts of the Secretsmanager sourcecode are available under the AGPL license in Github? https://github.com/bitwarden/server/tree/master/src/Core/SecretsManager

[BlackDex]

Without a GUI it is almost not usable.

[minionflo]

I think a cli is good enough for the secrets manager

[luckydonald]

Ho does it differ to the normal bitwarden?

I mean there always was the bitwarden CLI, and this feels super similar, except that it does that from within your own application process, not prior to launching anything.
That means - if I understood correctly - no leaking of the passwords via environment variables which could be seen by inspecting the running process.

So, that said, maybe this could be integrated into vaultwarden? Like just marking an password as available to a "service account"?

[BlackDex]

If you want something similar, use the Bitwarden cli with the serve command. Vaultwarden already supports the api tokens for users and organizations, so you can use that to login.

I don't that anything similar to secrets manager will be coming to Vaultwarden.

[tukusejssirs]

If it is source available only, why not create an open source way? Using a plugin if necessary.

I thing VV could provide a way to check passwords are leaked on the web and a way to use in CI (GitHub CI, GitLab CI, …). That would awesome! ❤️

[BlackDex]

Vaultwarden already support leaked password checks via the web-vault.

Adding custom features to the web-vault is not easy, and hard to maintain. So that will probably not happen.

If you want that feature, use the Bitwarden hosted vault, it has free support for this.

[minionflo]

Are there any updates on this?

[stefan0xC]

Nope. Bitwarden has not released the Secrets Manager under the GPLv3, so #3368 (comment) still applies.

[OrionCodeDev]

But maybe that part with AGPL can be supported?
#3368 (comment)
@stefan0xC

[BlackDex]

There is no part we can add. It's useless without a GUI.
You need to be able to manage users, rights, secrets etc...
That isn't possible via the cli as far as i know.

[antoniolago]

Hello everyone, I created an app that makes VW a K8s secret manager by leveraging bw-cli Vaultwarden API, if anyone interested: https://github.com/antoniolago/vaultwarden-kubernetes-secrets

[derekslenk]

Hello everyone, I created an app that makes VW a K8s secret manager by leveraging bw-cli, if anyone interested in helping me test it, check it out: https://github.com/antoniolago/vaultwarden-kubernetes-secrets

Exactly what I was looking for!

[danielefranceschi]

Considering that Bitwarden's Secrets Manager APIs are known https://github.com/bitwarden/sdk-sm/blob/main/crates/fake-server/src/lib.rs IMHO this could be feasible.

[BlackDex]

It's a Bitwarden Licenses feature, not open source.
There is no OSS UI available for the secrets manager.

[danielefranceschi]

So why not implementing an independent oss ui? Or an oss cli? Or just the backend APIs and wait for someone implement the UI? Or it's something related to this comment of yours?

(I'd do it myself but I'm not proficient in UI or Rust, and I don't trust AI code I can't review)

[stefan0xC]

Because that is not the goal of this project and it frankly does not make much sense to develop an independent UI and then use that specific API because it's probably easier to create and develop against an independent API that you have more control over instead of integrating it with a separate code base like Vaultwarden. (And without an UI why would we want to implement the API ourselves? I mean that's just unnecessary work for a separate product that no one can use or develop against.)

[Sagit-chu]

Just a quick thought: the Hermes Agent framework actually just added native support for Bitwarden Secrets Manager. Given how fast things are moving in the AI space, we'll probably see a lot more AI agents starting to use BWS to handle their API keys very soon. It would be awesome to see this supported in Vaultwarden!

https://hermes-agent.nousresearch.com/docs/user-guide/secrets/bitwarden

[BlackDex]

Not gonna happen, read the comments above.