Metadata-Version: 2.4
Name: rotato
Version: 0.1.0
Summary: Serverless secret/key rotation into Bitwarden Secrets Manager
Author-email: Zhitao Gong <zhitaao.gong@gmail.com>
License-Expression: MIT
Project-URL: Homepage, https://github.com/gongzhitaao/rotato
Project-URL: Repository, https://github.com/gongzhitaao/rotato
Project-URL: Issues, https://github.com/gongzhitaao/rotato/issues
Keywords: bitwarden,secrets,secret-rotation,credentials,cli,cloud-run
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: System Administrators
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Classifier: Topic :: Security
Classifier: Topic :: System :: Systems Administration
Requires-Python: >=3.12
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: bitwarden-sdk>=2.1.0
Requires-Dist: httpx2>=2.10.0
Requires-Dist: pyjwt[crypto]>=2.8.0
Dynamic: license-file

# rotato

Serverless secret/key rotation into
[Bitwarden Secrets Manager](https://bitwarden.com/products/secrets-manager/).

A scheduled [Cloud Run job](https://cloud.google.com/run/docs/create-jobs)
rotates an expiring credential (e.g. a GitLab PAT) and writes the fresh value
back to Bitwarden. Every machine then fetches the *current* value on demand, so
the secret is never written to disk and rotations are transparent.

## Install

```bash
uv tool install rotato      # or: pipx install rotato
```

## Consumer usage (laptop / VM)

Bootstrap a machine once — no repo checkout required:

```bash
# GitLab PAT (or any Bitwarden token) as a git credential
rotato install <secret-uuid> --user <git-user>

# GitHub App mode: mint a short-lived installation token per git op
rotato install <pem-uuid> --github --app-id <id> --installation-id <id>
```

`install` writes this machine's read-only Bitwarden token to
`~/.config/rotato/`, records a friendly `name -> uuid` map, and points git's
credential helper at `rotato`. After that:

```bash
rotato fetch <name|uuid>          # print a secret's current value, read-only
rotato github-token <name|uuid> --app-id <id> --installation-id <id>
git -C <a-repo> ls-remote         # git now authenticates via Bitwarden
```

## Server side

The rotation job runs as `rotato run <rotator-name>` (also the container
entrypoint); `ROTATOR` selects the rotator. Deploying the Cloud Run job,
scheduler, and alerting is covered in the full documentation.

## Documentation

Full design, invariants, deployment, and "add a rotator" guide:
[README.org](https://github.com/gongzhitaao/rotato/blob/main/README.org).

## License

[MIT](https://github.com/gongzhitaao/rotato/blob/main/LICENSE).
