Bitwarden

Installs the Bitwarden CLI (bw) and configures shell aliases.

Demo

What it does

• Auto-installs and updates the Bitwarden CLI to the latest release (native executable, no Node.js required)
• Configures the Bitwarden server (defaults to EU)
• Configures zsh tab completion when zsh is installed (written to /usr/local/share/zsh/site-functions/_bitwarden; bash is not covered)
• Shell aliases for common operations

Variables

Variable	Default	Description
bitwarden_server	https://vault.bitwarden.eu	Bitwarden server URL

Examples

Point at the US (global) server instead of the EU default:

bitwarden_server: https://vault.bitwarden.com   # default: https://vault.bitwarden.eu

Aliases

Alias	Command	Description
bitwarden	bw	Shorthand for the Bitwarden CLI
bitwarden-generate	bw generate -uln --length 32	Generate a strong 32-character password
password	bitwarden-generate	Short alias
bitwarden-password	bw get password	Print an item's password
bitwarden-lock	bw lock	Lock the vault
bitwarden-sync	bw sync	Pull the latest vault state from the server
bitwarden-status	bw status	Show server, login, and lock state
bitwarden-logout	bw logout	Log out

Functions

Function	Description
bitwarden-unlock	Unlock the vault and export BW_SESSION for the rest of the shell
bitwarden-list	Search items, printing id, name, username, and URI as JSON
bitwarden-copy	Copy an item's password to the clipboard (xclip)
bitwarden-username	Print an item's username
bitwarden-totp	Print an item's current TOTP code
bitwarden-notes	Print an item's notes
bitwarden-item	Print an item's name, username, URI, and TOTP as JSON
bitwarden-add	Create a login item from name and username arguments, prompting for the password so it stays out of shell history
bitwarden-open	Open an item's URI in the browser (xdg-open)

Usage

On a fresh machine, log in first.

bitwarden login

Then unlock the vault before running Ansible playbooks that use Bitwarden lookups. Use the bitwarden-unlock function, which exports the session for the rest of the shell:

bitwarden-unlock
ansible-playbook playbook.yaml --ask-become-pass

Troubleshooting

Bitwarden lookups fail against a locked vault

A bare bw unlock only prints a session token; it does not export it, so lookups still fail against a locked vault. Use the bitwarden-unlock function instead, which runs export BW_SESSION=$(bw unlock --raw) so the session is available to every command in the shell.

The session expires, so re-run bitwarden-unlock when lookups start failing again. If a lookup fails on a fresh machine, confirm you ran bitwarden login before unlocking.