pirafrank/vault-conductor

An SSH Agent that provides SSH keys stored in Bitwarden Secret Manager

Summary

vault-conductor is a command-line SSH agent written in Rust that fetches private SSH keys from the Bitwarden Secrets Manager instead of storing them locally. It acts as a Unix domain socket server, responding to standard SSH Agent Protocol requests so that tools like git or ssh can authenticate without writing private keys to disk.

What it is useful for

This tool is useful for developers who want to use SSH for authentication or commit signing on headless systems, CI/CD pipelines, or ephemeral containers without copying private key files onto those machines. It pulls keys on the fly from a centralized Bitwarden vault using a scoped access token, meaning you can grant a specific machine access only to specific secrets. Because keys are fetched lazily and live only in memory, it avoids storing private key files directly on local disk or across different environments. It supports both Ed25519 and RSA keys, provided they are stored in the newer OpenSSH private key format introduced in OpenSSH 7.8.

How engineers can use it

To get started, you need a Bitwarden Secrets Manager account and a private SSH key saved as a secret value, complete with the -----BEGIN OPENSSH PRIVATE KEY----- and -----END OPENSSH PRIVATE KEY----- strings. You can install the tool via a documented one-liner script:

curl -fsSL https://raw.githubusercontent.com/pirafrank/vault-conductor/main/install.sh | sh

Next, you configure the agent. The tool reads the BWS_ACCESS_TOKEN environment variable for your Bitwarden machine token, and BW_SECRET_IDS for a comma-separated list of secret UUIDs. You can optionally set BW_SERVER_ENDPOINT for self-hosted Bitwarden instances. To run it, point your shell to its socket location and start the daemon:

export SSH_AUTH_SOCK="/tmp/vc-$(whoami)-ssh-agent.sock"
vault-conductor start

Use vault-conductor start --fg for foreground mode, which is recommended for verifying your configuration, and vault-conductor stop to shut down a background process. Note that the tool requires a Linux distribution released in the last five years or macOS, and the documentation recommends reviewing the project's security policy before using RSA keys or agent forwarding.