vault

The Gateway publishes its MySQL and PostgreSQL credentials into one Vaultwarden collection and keeps them current. See Vaultwarden.

Commands

Command	Result
`vault:setup`	Store the Vaultwarden account, organization, and collection.
`vault:status`	Show the setup and the state of the published items.
`vault:sync`	Publish changes now and repair changed or missing items.
`vault:teardown`	Delete the published items and the stored account.

Every command accepts --json.

orbit vault:setup

Check and store the Gateway’s Vaultwarden account, organization, and collection.

orbit vault:setup --url=<origin> --client-id=<id> --client-secret-file=<path> --master-password-file=<path> --organization=<name-or-id> --collection=<name-or-id> [--json]

Option	Required	Meaning
`--url`	yes	Vaultwarden origin on a `.orbit` host, for example `https://vault.orbit`. Must use HTTPS.
`--client-id`	yes	The `client_id` of the Gateway account’s personal API key, such as `user.<uuid>`.
`--client-secret-file`	yes	File that contains only the API key’s `client_secret`.
`--master-password-file`	yes	File that contains only the account’s master password.
`--organization`	yes	Organization name or ID.
`--collection`	yes	Collection name or ID in that organization.

The CLI never accepts the client secret or the master password as an argument. Setup can run again with a new API key or master password. Another organization or collection needs vault:teardown first. The output is the status.

orbit vault:setup --url=https://vault.orbit --client-id=user.3f0c… \
  --client-secret-file=./client-secret --master-password-file=./master-password \
  --organization=Orbit --collection=Databases

orbit vault:status

Show the setup and the state of the published items.

orbit vault:status [--json]

The output shows configured, url, email, organization, collection, items, pending, skipped, last_synced_at, and last_error. See Status.

orbit vault:sync

Publish changes now. The run also recreates published items that are gone from Vaultwarden and rewrites ones that someone changed there.

orbit vault:sync [--json]

The output is the status. The scheduler runs the same reconcile every minute, so this command is needed only to see the result at once. When a change failed, the Gateway returns vault.sync_failed and the command exits with a failure.

orbit vault:teardown

Permanently delete every Orbit item in the collection, then delete the stored account, organization, and collection.

orbit vault:teardown [--keep-items] [--yes] [--json]

Option	Required	Meaning
`--keep-items`	no	Leave the published items in Vaultwarden.
`--yes`	in noninteractive and JSON modes	Confirm the teardown without a prompt.

In a terminal the command asks a default-No question. Without --yes, a noninteractive or JSON call fails with input.confirmation_required before any Gateway request. Declining fails with input.cancelled and changes nothing.

Errors

Code	Meaning
`input.confirmation_required`	`vault:teardown` ran without `--yes` where it cannot ask.
`input.cancelled`	The operator declined the `vault:teardown` question.
`input.invalid`	`vault:setup` has no `--client-id`, `--organization`, or `--collection`.
`vault.secret_required`	`vault:setup` has no `--client-secret-file` or `--master-password-file`.
`vault.secret_invalid`	A secret file is unreadable or empty.
`vault.url_invalid`	`--url` is not an HTTPS origin. The Gateway also refuses a host outside `.orbit`.
`vault.sync_failed`	`vault:sync` could not make at least one change.

Vaultwarden errors lists the Gateway errors.

Using the CLI

Fleet

Applications

Operations

Commands

orbit vault:setup

orbit vault:status

orbit vault:sync

orbit vault:teardown

Errors

​Commands

​orbit vault:setup

​orbit vault:status

​orbit vault:sync

​orbit vault:teardown

​Errors

​Related

Commands

orbit vault:setup

orbit vault:status

orbit vault:sync

orbit vault:teardown

Errors

Related