Homelab / One secrets store and one door in.
Secrets and access
Every secret lives in Bitwarden Secrets Manager and a single script reads them; nothing travels on a command line, where it would stay in shell history and in the process list. WireGuard is the only way into the internal network. The two exceptions are documented where they occur: the GitHub token comes from the gh CLI keyring, and Ansible writes the registry pull secret into the cluster because it cannot live in a public GitOps repository.
Every secret lives in Bitwarden Secrets Manager, under a project with its own access.
A single script reads them, and every make target goes through it.
WireGuard is the only way in; administrative interfaces resolve only through the tunnel.
How I built it
Nothing travels on a command line, where it would remain in shell history and in the process list for anyone who looks. The two exceptions are documented where they occur: the GitHub token is taken from the gh CLI keyring instead of being duplicated, and the registry pull secret is written into the cluster by Ansible, because it cannot live in a public GitOps repository.