Building a Recoverable Encrypted Secrets Vault with git-crypt

cd ~/av/prj
mkdir exampleuser-vault
cd exampleuser-vault
git init

mkdir -p hermes/profiles/{glm52,dspro,kimi,sonnet} \
         ssh gpg/private-keys-v1.d claude \
         projects/{peertube,searxng,firecrawl/api} \
         personal

brew install git-crypt
cd ~/av/prj/exampleuser-vault
git-crypt init

# Hermes
cp ~/.hermes/.env                    hermes/
cp ~/.hermes/auth.json               hermes/
cp ~/.hermes/gateway_state.json      hermes/
cp ~/.hermes/channel_directory.json  hermes/
cp ~/.hermes/processes.json          hermes/
for p in glm52 dspro kimi sonnet; do
  cp ~/.hermes/profiles/$p/.env      hermes/profiles/$p/
done

# SSH
cp ~/.ssh/id_ed25519                 ssh/
cp ~/.ssh/id_ed25519.pub             ssh/
cp ~/.ssh/id_rsa                     ssh/
cp ~/.ssh/id_rsa.pub                 ssh/
cp ~/.ssh/config                     ssh/

# GPG
cp -a ~/.gnupg/private-keys-v1.d    gpg/

# Claude
cp ~/.claude/.credentials.json       claude/

# Projects
cp ~/av/prj/peertube/.env            projects/peertube/
cp ~/av/env/searxng/.env             projects/searxng/
cp ~/av/src/firecrawl/apps/api/.env  projects/firecrawl/api/

git add -A
git-crypt status

git commit -m "init: exampleuser-vault with git-crypt"

VAULT=~/av/prj/exampleuser-vault

# Backup originals
cp ~/.hermes/.env ~/.hermes/.env.backup-$(date +%F)
rm ~/.hermes/.env
ln -s "$VAULT/hermes/.env" ~/.hermes/.env

for p in glm52 dspro kimi sonnet; do
  cp ~/.hermes/profiles/$p/.env ~/.hermes/profiles/$p/.env.backup-$(date +%F)
  rm ~/.hermes/profiles/$p/.env
  ln -s "$VAULT/hermes/profiles/$p/.env" ~/.hermes/profiles/$p/.env
done

#!/bin/bash
set -euo pipefail

REPO="$HOME/av/prj/exampleuser-vault"
cd "$REPO"

echo "[sync] Mirroring secrets into exampleuser-vault..."

# ---- Hermes (mirror) ----
cp "$HOME/.hermes/auth.json"               hermes/auth.json
cp "$HOME/.hermes/gateway_state.json"       hermes/gateway_state.json
cp "$HOME/.hermes/channel_directory.json"   hermes/channel_directory.json
cp "$HOME/.hermes/processes.json"           hermes/processes.json

# ---- SSH (mirror) ----
cp "$HOME/.ssh/id_ed25519"                  ssh/id_ed25519
cp "$HOME/.ssh/id_ed25519.pub"              ssh/id_ed25519.pub
cp "$HOME/.ssh/id_rsa"                      ssh/id_rsa
cp "$HOME/.ssh/id_rsa.pub"                  ssh/id_rsa.pub
cp "$HOME/.ssh/config"                      ssh/config

# ---- GPG (mirror) ----
rm -rf gpg/private-keys-v1.d
cp -a "$HOME/.gnupg/private-keys-v1.d"     gpg/private-keys-v1.d

# ---- Claude (mirror) ----
cp "$HOME/.claude/.credentials.json"        claude/.credentials.json

# ---- Projects (mirror) ----
cp "$HOME/av/prj/peertube/.env"             projects/peertube/.env    2>/dev/null || true
cp "$HOME/av/env/searxng/.env"              projects/searxng/.env     2>/dev/null || true
cp "$HOME/av/src/firecrawl/apps/api/.env"   projects/firecrawl/api/.env 2>/dev/null || true

# ---- Stage, commit, push ----
git add -A
if git diff --cached --quiet; then
    echo "[sync] Nothing changed."
    exit 0
fi

git commit -m "sync $(date +%Y-%m-%d_%H%M)"
git push
echo "[sync] Done -- pushed to origin."

brew install gh          # if not already installed
gh auth login            # authenticate with your GitHub account
cd ~/av/prj/exampleuser-vault
gh repo create exampleuser-vault --private --source=. --push

brew install bitwarden-cli
bw login                     # interactive login with email + master password

export BW_SESSION="<from_bw_login>"
B64_KEY=$(base64 < ~/exampleuser-vault-key)

bw get template item | \
  jq --arg name "exampleuser-vault-gitcrypt" \
     --arg notes "Git-crypt key for https://github.com/exampleuser/exampleuser-vault.git

Recovery:
  echo \"<paste_key>\" | base64 -d > /tmp/git-crypt-key
  cd exampleuser-vault
  git-crypt unlock /tmp/git-crypt-key

Key (base64):
$B64_KEY" \
  '.type = 2 | .name = $name | .notes = $notes | .secureNote = {type: 0}' | \
  bw encode | bw create item --session "$BW_SESSION"

git-crypt export-key ~/exampleuser-vault-key

cat > ~/av/bin/store-bw-master-pass.sh << 'SCRIPT'
#!/bin/bash
set -euo pipefail

echo "=== Bitwarden Master Password Storage ==="
read -s -p "Master password: " PASS
echo
read -s -p "Confirm master password: " CONFIRM
echo

if [ "$PASS" != "$CONFIRM" ]; then
  echo "FAIL: Passwords do not match."
  exit 1
fi

security add-generic-password -s "bitwarden" -a "BW_MASTER_PASS" -w "$PASS"
echo "Stored in macOS Keychain."
SCRIPT
chmod +x ~/av/bin/store-bw-master-pass.sh

~/av/bin/store-bw-master-pass.sh

security add-generic-password -s "bitwarden" -a "BW_EMAIL" -w "[email protected]"

#!/bin/bash
set -euo pipefail

VAULT_REPO="https://github.com/exampleuser/exampleuser-vault.git"
BW_ITEM_NAME="exampleuser-vault-gitcrypt"
TMPDIR=$(mktemp -d /tmp/vault-test-XXXXX)
trap 'rm -rf "$TMPDIR"' EXIT

FAIL=0

login_bw() {
  local STATUS
  STATUS=$(bw status 2>/dev/null | jq -r '.status // "unauthenticated"')
  if [ "$STATUS" = "unlocked" ]; then
    echo "[0/4] Vault already unlocked"
    return
  fi

  local PASS
  PASS=$(security find-generic-password -s "bitwarden" -a "BW_MASTER_PASS" -w 2>/dev/null) || true
  if [ -z "$PASS" ]; then
    echo "FAIL: Master password not in keychain."
    echo "       Run ~/av/bin/store-bw-master-pass.sh"
    exit 1
  fi

  local EMAIL
  EMAIL=$(bw status 2>/dev/null | jq -r '.userEmail // empty')
  if [ -z "$EMAIL" ]; then
    EMAIL=$(security find-generic-password -s "bitwarden" -a "BW_EMAIL" -w 2>/dev/null) || true
  fi
  if [ -z "$EMAIL" ]; then
    echo "FAIL: Could not determine Bitwarden email."
    exit 1
  fi

  if [ "$STATUS" != "unauthenticated" ]; then
    bw logout --quiet 2>/dev/null || true
  fi

  echo "[0/4] Logging in to Bitwarden..."
  export BW_MASTER_PASS="$PASS"
  BW_SESSION=$(bw login "$EMAIL" --passwordenv BW_MASTER_PASS --raw 2>/dev/null) || {
    echo "FAIL: Login failed."
    exit 1
  }
  unset BW_MASTER_PASS
  PASS=""
  export BW_SESSION
  echo "  OK -- logged in"
}

echo "=== exampleuser-vault recovery test ==="
echo
login_bw

echo "[1/4] Fetching key from Bitwarden..."
NOTE=$(bw list items --search "$BW_ITEM_NAME" --session "$BW_SESSION" 2>/dev/null)
ITEM_ID=$(echo "$NOTE" | jq -r '.[0].id // empty')
[ -z "$ITEM_ID" ] && { echo "FAIL: Item not found"; exit 1; }

NOTES=$(bw get item "$ITEM_ID" --session "$BW_SESSION" | jq -r '.notes // empty')
B64_KEY=$(echo "$NOTES" | sed -n '/^Key (base64):/,$ p' | tail -n +2 | tr -d '[:space:]')
[ -z "$B64_KEY" ] && { echo "FAIL: Key not found in note"; exit 1; }
echo "  OK -- found item $ITEM_ID"
echo

echo "[2/4] Cloning repo..."
git clone --quiet "$VAULT_REPO" "$TMPDIR/repo" 2>&1
echo "  OK -- cloned"
echo

echo "[3/4] Unlocking with git-crypt..."
echo "$B64_KEY" | base64 -d > "$TMPDIR/git-crypt-key"
cd "$TMPDIR/repo"
git-crypt unlock "$TMPDIR/git-crypt-key" 2>&1
echo "  OK -- unlocked"
echo

echo "[4/4] Verifying decrypted content..."
check_file() {
  local path="$1" label="$2"
  if [ ! -f "$TMPDIR/repo/$path" ]; then
    echo "  FAIL: $label -- missing"; return 1
  fi
  local ft; ft=$(file "$TMPDIR/repo/$path")
  if echo "$ft" | grep -qiE "text|ASCII|JSON|OpenSSH|PEM|RSA"; then
    echo "  OK: $label -- $(echo "$ft" | cut -d: -f2)"
  else
    echo "  FAIL: $label -- still encrypted"; return 1
  fi
}

check_file "hermes/.env"             "Hermes .env"
check_file "hermes/auth.json"        "Auth JSON"
check_file "ssh/id_ed25519"          "SSH private key"
check_file "ssh/id_rsa"              "SSH RSA key"
check_file "claude/.credentials.json" "Claude credentials"
check_file "ssh/config"              "SSH config"

if grep -q "export" "$TMPDIR/repo/hermes/.env" 2>/dev/null; then
  echo "  OK: hermes/.env has expected content"
else
  echo "  FAIL: hermes/.env wrong content"; FAIL=1
fi

echo
[ "$FAIL" -eq 0 ] && echo "PASS" || { echo "FAIL"; exit 1; }

cd ~/av/prj/exampleuser-vault
git add sync.sh test-recovery.sh README.md
git commit -m "feat: sync, recovery test, and documentation"
git push

(crontab -l 2>/dev/null; echo "# exampleuser-vault -- daily at 6:30am")
(crontab -l 2>/dev/null; \
  echo "30 6 * * * $HOME/av/prj/exampleuser-vault/sync.sh >> \
    $HOME/av/log/exampleuser-vault-sync.log 2>&1") | crontab -

brew install git git-crypt jq bitwarden-cli

git clone https://github.com/exampleuser/exampleuser-vault.git
cd exampleuser-vault

# Retrieve the key from Bitwarden
bw login
# Open the "exampleuser-vault-gitcrypt" secure note
# Copy the base64 key from the notes field

echo "<pasted_base64>" | base64 -d > /tmp/git-crypt-key
git-crypt unlock /tmp/git-crypt-key
rm /tmp/git-crypt-key

VAULT="$PWD"

# Hermes .env (source-of-truth -- symlink)
ln -sf "$VAULT/hermes/.env" ~/.hermes/.env
for p in glm52 dspro kimi sonnet; do
  ln -sf "$VAULT/hermes/profiles/$p/.env" ~/.hermes/profiles/$p/.env
done

# SSH (mirror -- copy, set perms)
cp ssh/id_ed25519 ~/.ssh/ && chmod 600 ~/.ssh/id_ed25519
cp ssh/config ~/.ssh/

# Claude (mirror -- copy)
cp claude/.credentials.json ~/.claude/

# Bitwarden master password in keychain
~/av/bin/store-bw-master-pass.sh

# Cron job
(crontab -l 2>/dev/null; echo "30 6 * * * $VAULT/sync.sh >> \
  ~/av/log/exampleuser-vault-sync.log 2>&1") | crontab -

cd ~/av/prj/exampleuser-vault && bash test-recovery.sh