CLI

Arguments

Arguments must be entered before commands.

-c [path]

Path to the JSON/Jsonnet configuration file.

-f [format]

Set log format (human, kv, raw, default: human).

-l [level]

Set minimum log level (none, debug, info, error, default: info).

-p

Disable paging via less.

-s [status]

Set the minimum status for error message logging.

-x [key=value]

Set config key=value (can be provided multiple times).

Commands

Rot comes with a list of default Commands, but you can add custom Commands using Macros–Command templates that live within the Rot configuration.

Commands also support partial matching. Rot will attempt to match a partial CLI command (like cfg) to the longest matching command or macro (in this instance, config).

acme-account-delete

Delete or Deactivate an ACME account.

acme-account-get

Retrieve ACME account details

acme-account-new

Create a new ACME account, or set the email addresses of an existing account

acme-authz-get

Retrieve ACME authorization details

acme-authz-test

Test ACME authorization challenges to see if they will validate from an ACME server

acme-authz-wait

Wait for an ACME order authorization to finish

acme-challenge-get

Retrieve ACME challenge details

acme-challenge-validate

Request the ACME server to validate a challenge

acme-order-finalize

Generate a certificate and key from an authorized ACME order

acme-order-get

Retrieve ACME order details

acme-order-new

Create a new ACME certificate order for a domain or IP

algorithms

Show algorithms Rot understands

autocomplete

Adds autocomplete for Rot commands into your terminal:

$ source <(rot autocomplete)

base64

Import and export base64 strings in various encodings. See command line for specific usage.

config

Show the rendered config from all sources (file, environment variables, and command line arguments).

decrypt

Perform ad-hoc decryption of a value.

decrypt-keys

A convenience command to decrypt and source all encrypted keys to avoid typing them in constantly. Best used within scripts.

docs

Open a web browser to the documentation website (this website).

edit

Interactively edit a Keyring’s values in an editor like VSCode or vi. Values will be displayed, decrypted, in Jsonnet, and any changes (add/change/delete) will be committed to the keyring upon saving.

encrypt

Encrypt a value and print it to stdout without adding it to the config. Can specify a recipient key to use asymmetric encryption.

eula

View the Rot End User License Agreement (EULA).

hash-new

Generate a hash of a file or string.

hash-verify

Verify the hash of a file or string. Will return an error/exit non-zero if the hash doesn’t match, otherwise silently exits 0 on success.

init

Initialize a new Rot configuration. See Initialize Rot for more information.

jq

Query JSON from stdin using jq. Supports standard JQ filters, and the -r flag to render raw values.

jwt-get

Show the contents of a JWT and optionally verify it against a public key.

jwt-new

Generate JSON Web Tokens (JWTs). Visit Generate JWTs for more information.

key-add-private

Add an existing Decrypt Key to a Keyring. See Manage Keys for more information.

key-add-public

Add a new or existing key to Decrypt Keys. See Manage Keys for more information.

key-delete-private

Remove a Decrypt Key from a Keyring. See Manage Keys for more information.

key-delete-public

Remove a Decrypt Key from Rot. See Manage Keys for more information.

key-get

Show the details of a decryptkeys.

key-get-public

Display the public key of a private key.

key-list

List decryptkeys in a configuration.

key-new

Generate ad-hoc cryptographic keys.

keyring-add

Add a new or modify an existing Keyring. See Manage Keyrings for more information. Generate and add a private key to a configuration with the specified name.

keyring-delete

Remove a Keyring from Rot. See Manage Keyrings for more information.

keyring-list

Show the names of Config > keyrings in the configuration, optionally showing decryptKeys that can access them.

keyring-rekey

Rekey a Keyring configuration. See Manage Keyrings for more information.

pem

Convert a Rot key to PEM or a PEM key to Rot. Can specify an ID for the key when converting from PEM to Rot.

random

Generate random strings.

run

Run a command and inject secrets into it via environment variables. See Run Commands for more information. By default, any Value written to stderr/stdout will be masked with ***. Values can be unmasked using the Config > unmask config.

signature-new

Generate signatures. Visit Generate Signatures for more information.

signature-verify

Verify the signature of a message and public key. Will return an error/exit non-zero if the signature doesn’t match, otherwise silently exits 0 on success.

ssh-get

Convert a Rot key to SSH or a SSH key to Rot.

ssh-new

Generate SSH certificates. Visit Generate SSH for more information.

value-add

Add a value to a configuration. Can specify an optional length to have Rot randomly generate a value instead of prompting for it. See Manage Values for more information.

value-add-private

Generate and add a private key to a configuration with the specified name.

value-copy

Copy a value between Keyrings.

value-delete

Remove a value from a Rot configuration. See Manage Values for more information.

value-get

Show a decrypted value from the Rot configuration. See Manage Values for more information.

value-link

Link a value to other values. When the value is modified, the changes will be copied to the linked values.

value-list

Show the names of values in a Keyring.

value-move

Move a value between Keyrings.

value-set-meta

Modify metadata for an existing Value.

version

Print the current version of Rot.

x509-csr-get

Show the contents of an X.509 certificate signing request.

x509-csr-new

Create a new X.509 certificate signing request.

x509-csr-sign

Sign an X.509 certificate signing request using a private key.

x509-get

Show the contents of an X.509 certificate and optionally verify it against a CA certificate.

x509-new

Generate X.509 certificates. Visit Generate Certificates for more information.