비밀 관리 (D-ops-17)

┌──────────────┐                      ┌─────────────────────────────────────────┐
│ Vaultwarden  │ ← canonical SoT      │ /Users/axe/.axe/customers.yaml          │
│ (axe.axelabs │                      │   services.<svc>.secrets[]:             │
│  .ai/vault)  │                      │     - env: FRAME_DB_PASSWORD            │
└──────┬───────┘                      │       vault: "frame/axe/db-password"    │
       │                              │     - env: AZURE_FRAME_MCP_CLIENT_SECRET│
       │ bw CLI                       │       vault: "frame/axe/oauth-..."      │
       │ (BW_SESSION                  │       rotation_external: azure          │
       │  from Keychain)              └─────────────────────┬───────────────────┘
       │                                                    │ (manifest read)
       ▼                                                    ▼
┌──────────────────────────────────────────────────────────────────┐
│ axe ship <service>  (release-gate)                               │
│   step 1: docs-check                                             │
│   step 2: branch + clean                                         │
│   step 3: commits to push                                        │
│   step 4: confirm                                                │
│   step 5: git push                                               │
│   step 6: deploy                                                 │
│     ├─ pre-deploy [a]: axe secret check <service>   ← abort 시 stop│
│     ├─ pre-deploy [b]: axe secret pull <service>    ← env_file write│
│     └─ docker compose up -d ...     (env_file = pulled content) │
└──────────────────────────────────────────────────────────────────┘
       │
       ▼
┌────────────────────────────────────────┐
│ /Users/axe/<repo>/.env(.local)        │ ← AUTO-GENERATED, mode 600,
│   FRAME_DB_PASSWORD="..."             │   git-ignored
│   AZURE_FRAME_MCP_CLIENT_SECRET="..." │
│   ...                                  │
└────────────────────────────────────────┘
       │
       ▼
   docker container env (frame-mcp-blue, etc.)

services:
  frame:
    env_file: "/Users/axe/frame/.env.local"   # axe secret pull 의 write target
    secrets:
      - env: FRAME_DB_PASSWORD               # 환경변수 이름 (docker-compose 가 보는)
        vault: "frame/axe/db-password"       # Bitwarden item name (axe secret get 가 보는)
      - env: AZURE_FRAME_MCP_CLIENT_SECRET
        vault: "frame/axe/oauth-client-secret"
        rotation_external: azure              # 회전 시 Azure portal 갱신 필요
      # ...

services:
  frame:
    realchoice:
      env_file: "/Users/realchoice/frame/.env.local"
      secrets:
        - env: FRAME_DB_PASSWORD
          vault: "frame/realchoice/db-password"
        - env: FRAME_JWT_SECRET
          vault: "frame/realchoice/jwt-secret"
        - env: AZURE_FRAME_MCP_CLIENT_SECRET
          vault: "frame/realchoice/oauth-client-secret"
          rotation_external: azure
        - env: FRAME_PII_PASSPHRASE_REALCHOICE
          vault: "frame/realchoice/pii-passphrase-realchoice"
        - env: CLAUDE_CODE_OAUTH_TOKEN
          vault: "frame/realchoice/claude-oauth"
  blueprint:
    realchoice:
      env_file: "/Users/realchoice/blueprint/.env"
      secrets:
        - env: AZURE_AD_CLIENT_SECRET
          vault: "blueprint/realchoice/azure-client-secret"
          rotation_external: azure
        - env: NEXTAUTH_SECRET
          vault: "blueprint/realchoice/nextauth-secret"
        # ... (axe customer 의 12 개 패턴 동일 복제)
  vaultwarden:
    realchoice:
      env_file: "/Users/realchoice/.axe/vault/.env"
      bootstrap_only: true
      secrets:
        - env: AZURE_VAULTWARDEN_CLIENT_SECRET
          vault: "vaultwarden/realchoice/oauth-client-secret"
          rotation_external: azure
  hive:
    realchoice:
      env_file: "/Users/realchoice/hive/.env.local"
      secrets:
        - env: HIVE_DB_PASSWORD
          vault: "hive/realchoice/db-password"
        # ... axe 동일 패턴

axe secret rotate AZURE_FRAME_MCP_CLIENT_SECRET --service frame

[1/4] external rotation required (provider: azure)
      portal: https://portal.azure.com/#view/Microsoft_AAD_RegisteredApps/...
      action: rotate secret in the provider, then paste the NEW value below.
              the OLD value will remain valid until step 4 (rotation overlap window).
      new value: ********

[2/4] writing new value to vault item 'frame/axe/oauth-client-secret'
      ✓ updated existing vault item

[3/4] axe secret pull frame
      ✓ frame: pulled 7 secrets → /Users/axe/frame/.env.local (mode 600)

[4/4] deploy with new secret
      run `axe ship frame` now? (yes/no): yes
      → frame blue/green swap with new secret

Note: in the azure portal, REVOKE the OLD secret value now that the new
      one is verified working in production. Both are valid until you delete the old.

✓ blueprint: merged 13 secrets into /Users/axe/blueprint/.env (13 updated, 0 added, non-managed lines preserved)

APP_ID=<app's appId>  # e.g. Frame MCP: 137fc0ef-...
OLD_KEY_ID=$(az ad app credential list --id $APP_ID --query "[?starts_with(hint,'<old hint>')].keyId | [0]" -o tsv)
 
# 1. Azure 새 secret 추가 (--append, OLD 유지 = overlap window)
NEW=$(az ad app credential reset --id $APP_ID \
  --display-name "rotated <date>" --years 2 --append \
  --query password -o tsv)
 
# 2. vault PUT
axe secret push <ENV_NAME> --service <svc> --value "$NEW"
 
# 3. pull (merge — config 보존)
axe secret pull <svc>
 
# 4. 무중단 swap
axe deploy <svc> axe --apply   # frame / hive
# 또는
axe blueprint upgrade axe --apply  # blueprint
 
# 5. 검증 — 컨테이너 env 의 새 secret prefix 가 OLD 와 다른지
docker exec <active-container> env | grep <ENV_NAME>
 
# 6. 운영 안정 확인 후 OLD revoke
az ad app credential delete --id $APP_ID --key-id $OLD_KEY_ID

axe secret send <ENV_NAME> --service <svc> [--to <recipient>]

# 예: 한진우에게 Blueprint MCP secret 전달
axe secret send AZURE_BLUEPRINT_MCP_CLIENT_SECRET --service blueprint --to jinwoo
# ✓ Send created: blueprint AZURE_BLUEPRINT_MCP_CLIENT_SECRET (jinwoo)
#   expires in 1d / max 1 access(es)
# https://vault.axelabs.ai/#/send/abc123.../def456...

for who in taehun jinwoo soohun; do
  for env in AZURE_BLUEPRINT_MCP_CLIENT_SECRET AZURE_HIVE_MCP_CLIENT_SECRET; do
    svc=$(echo $env | awk -F_ '{print tolower($2)}')
    echo "=== $who / $env ==="
    axe secret send $env --service $svc --to $who
  done
done

# 1. URL 발급 (이미 `/tmp/sends.txt` 로 캐시했다고 가정)
# 2. 수신자별 메시지 합성 + DM 발사 (예: 강태훈 한 명)
CRON=$(grep -E "^CRON_SECRET=" /Users/axe/blueprint/.env | cut -d= -f2-)
URL_BP=$(grep "^taehun|blueprint|" /tmp/sends.txt | cut -d'|' -f3)
URL_HV=$(grep "^taehun|hive|" /tmp/sends.txt | cut -d'|' -f3)
 
TEXT="태훈님, Blueprint + Hive Custom Connector 등록 부탁드립니다 ...
Blueprint Secret: $URL_BP
Hive Secret:     $URL_HV"
 
curl -s -X POST http://localhost:3100/api/admin/broadcast-dm \
  -H "Authorization: Bearer $CRON" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --arg e [email protected] --arg t "$TEXT" \
        '{emails:[$e], text:$t, contentType:"text"}')"
# → {"summary":{"total":1,"sent":1,...}, "results":[{...,"chatId":"19:...","messageId":"..."}]}

# === argument-pack: 이 부분만 task 별로 갱신 ===
ITEM_NAME='<bw-item-name>'              # 예: ghcr-axelabs-ai-pull-pat
COLLECTION_ID='<organization-collection-uuid>'  # bw list collections --organizationid <ORG> | jq 로 확인
ORG_ID='<organization-uuid>'            # 예: 0c5d8bbd-ad85-42b4-8b8a-2849031981b1 (AXE)
LOGIN_USERNAME='<username-or-empty>'    # 예: axe-labs-ai
LOGIN_URI='<service-url-or-empty>'      # 예: https://ghcr.io
DIALOG_PROMPT='<운영자에게 보여줄 한 줄 설명>'
DIALOG_TITLE='<dialog 타이틀 — AXE Vault 일관성>'
NOTES_HINT='<짧은 용도 + rotation 주기>'
# ============================================
 
SECRET=$(osascript \
  -e "display dialog \"${DIALOG_PROMPT}\" default answer \"\" with hidden answer with title \"${DIALOG_TITLE}\" buttons {\"Cancel\",\"OK\"} default button \"OK\"" \
  -e 'text returned of result' 2>&1)
RC=$?
if [ $RC -ne 0 ] || [ -z "$SECRET" ]; then echo "DIALOG_CANCELLED_OR_EMPTY rc=$RC"; exit 1; fi
 
export BW_SESSION="$(security find-generic-password -s 'axe.vault.session' -w 2>/dev/null)"
if [ -z "$BW_SESSION" ]; then echo "NO_SESSION_IN_KEYCHAIN"; exit 1; fi
 
STATUS=$(bw status --session "$BW_SESSION" --raw 2>&1 | jq -r '.status' 2>/dev/null)
if [ "$STATUS" != "unlocked" ]; then echo "SESSION_NOT_UNLOCKED (run: bw unlock --raw)"; exit 1; fi
 
bw sync --session "$BW_SESSION" >/dev/null 2>&1
 
EXISTING=$(bw list items --organizationid "$ORG_ID" --session "$BW_SESSION" 2>/dev/null \
  | jq -r --arg n "$ITEM_NAME" '.[] | select(.name==$n) | .id' | head -1)
 
if [ -n "$EXISTING" ]; then
  bw get item "$EXISTING" --session "$BW_SESSION" 2>/dev/null | jq \
    --arg secret "$SECRET" --arg today "$(date +%Y-%m-%d)" --arg hint "$NOTES_HINT" \
    '.notes="\($hint) Updated: \($today)." | .login.password=$secret' \
    | bw encode | bw edit item "$EXISTING" --session "$BW_SESSION" >/dev/null \
    && echo "✓ UPDATED $ITEM_NAME ($EXISTING)"
else
  bw get template item | jq \
    --arg name "$ITEM_NAME" --arg org "$ORG_ID" --arg col "$COLLECTION_ID" \
    --arg secret "$SECRET" --arg today "$(date +%Y-%m-%d)" --arg hint "$NOTES_HINT" \
    --arg user "$LOGIN_USERNAME" --arg uri "$LOGIN_URI" \
    '.name=$name | .notes="\($hint) Issued: \($today)." | .organizationId=$org | .collectionIds=[$col]
     | .login.username=$user | .login.password=$secret
     | (if $uri == "" then . else .login.uris=[{"uri":$uri}] end)' \
    | bw encode | bw create item --session "$BW_SESSION" 2>/dev/null | jq -r '.id' \
    | xargs -I{} echo "✓ CREATED $ITEM_NAME ({})"
fi
 
unset SECRET

ITEM_NAME      = ghcr-axelabs-ai-pull-pat
COLLECTION_ID  = 1d794d29-f127-4602-b8cb-5ce8a731cf7f  (Platform — Service Secrets)
ORG_ID         = 0c5d8bbd-ad85-42b4-8b8a-2849031981b1  (AXE)
LOGIN_USERNAME = axe-labs-ai
LOGIN_URI      = https://ghcr.io
NOTES_HINT     = GHCR push/pull. axe-macmini + customer macmini docker login. Rotate 90d.

export NODE_EXTRA_CA_CERTS=/Users/axe/.axe/vault/certs/rootCA.pem

export BW_SESSION="$(bw unlock --raw)"

read -rs PW; export BW_SESSION="$(BW_PASSWORD="$PW" bw unlock --passwordenv BW_PASSWORD --raw)"; unset PW

read -rs KCPW; security unlock-keychain -p "$KCPW" ~/Library/Keychains/login.keychain-db; unset KCPW

npm install -g @bitwarden/[email protected]
bw --version    # 2025.7.0 확인

# vault 잠금 풀기 (필요 시)
bw unlock --raw    # 출력값 복사
security add-generic-password -s axe.vault.session -a [email protected] -w "<token>" -U
 
# 누락 확인
axe secret check frame
 
# 각 누락 item 에 대해, 현재 디스크의 값을 vault 로 push
axe secret push FRAME_DB_PASSWORD --service frame
# (interactive: value 입력)
# 또는 --value '<v>' 로 한 줄에
 
# 모두 채운 후 재확인
axe secret check frame    # exit 0 = ✓
 
# 이후로는 axe ship 가 자동으로 check + pull

SoT (변경 금지)                          View (자동 생성)
─────────────────                       ─────────────────────────────────
customers.yaml          ─┐
  .sso.apps.frame_mcp    │
    .client_id           ├──→ axe mcp publish ──→ Vaultwarden
    .application_id_uri  │    (idempotent upsert)  "MCP Connectors" collection
    .client_secret_env   │                            ├─ "Frame MCP (axe)"
                         │                            │    URIs: claude.ai/.com/customize/connectors
Vaultwarden             ─┤                            │           + https://axe.axelabs.ai/frame/mcp
  frame/axe/             │                            │    username: 137fc0ef-... (client_id)
   oauth-client-secret  ─┘                            │    password: <client_secret 40 chars>
                                                      │    field "MCP URL": application_id_uri
                                                      │    field "Tenant ID" / "Scopes" / "Vault secret path"
                                                      ├─ "Hive MCP (axe)"
                                                      └─ "Blueprint MCP (axe)"

axe mcp list              # 미리보기 — vault 미접근
axe mcp publish           # 실 publish — 매니페스트 순회 + vault fetch + upsert
axe mcp publish --dry-run # plan only
axe mcp publish --allow-missing  # public client (secret 없는 항목) 도 publish