initial commit

README.md

@@ -0,0 +1,16 @@
+# sync-keypairs
+
+Backs up all SSH keypairs into Bitwarden.
+
+## Prerequisites
+
+- [bitwarden-cli](https://github.com/bitwarden/clients/tree/main/apps/cli) installed
+- Run `bw login` first
+
+## Usage
+
+```bash
+./sync-keypairs.sh
+```
+
+This will unlock Bitwarden, sync your vault, and save each SSH keypair as a login item with attachments in `ssh-keys/<hostname>/<username>`.

sync-keypairs.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+set -xo pipefail
+
+if [ -z "${BW_SESSION}" ]; then
+    export BW_SESSION=$(bw unlock --raw)
+fi
+
+bw sync
+
+user=$(whoami)
+machine=$(cat /proc/sys/kernel/hostname)
+
+folder_name="ssh-keys/$machine/$user"
+
+folder=$(bw get folder $folder_name)
+if [ $? -ne 0 ]; then
+    folder=$(bw get template folder | jq ".name=\"$folder_name\"" | bw encode | bw create folder)
+fi
+
+folder_id=$(echo $folder | jq ".id")
+
+save_keypair() {
+    key_name=$(basename $1)
+    key_content=$(cat $1)
+
+    key_entry=$(bw get item $key_name)
+
+    if [ $? -ne 0 ]; then
+        login=$(bw get template item.login | jq ".username=\"$user@$machine\" | .password=\"$key_content\" | .totp=\"\"")
+        payload=$(bw get template item | jq ".folderId=$folder_id | .name=\"${key_name%.pub} \" | .login+=$login | .notes=\"\"" )
+
+        item=$(echo $payload | bw encode | bw create item)
+        item_id=$(echo $item | jq -r ".id")
+
+        bw create attachment --file $1 --itemid $item_id
+        bw create attachment --file ${1%.pub} --itemid $item_id
+    fi
+}
+
+for public_key in $HOME/.ssh/*.pub; do
+    save_keypair $public_key
+done