Rotate git.satware.ai PAT + create Bitwarden entry (admin scope + rbw pinentry blockers) #1

New Issue

2026-06-30T14:00:12+02:00

mw commented

2026-06-30 14:00:12 +02:00

Context

The git.satware.ai PAT (c441fa...) is stored in gnome-keyring (libsecret) and tea config. Two follow-up tasks are blocked:

1. Token rotation (blocked: token lacks admin scope)

Current token scopes: write:repository, read:user. Gitea 1.26.1 requires write:admin to create/revoke tokens via API (POST /api/v1/users/mw/tokens). The current token returns 403/401 on those endpoints.

Manual steps (web UI):

Log in at https://git.satware.ai/user/settings/applications
Create new PAT with scopes: write:repository, read:user, write:admin
Update gnome-keyring: printf 'protocol=https\nhost=git.satware.ai\nusername=mw\npassword=<new>\n\n' | git credential approve
Update tea: tea login edit satware --token <new>
Create Bitwarden entry: rbw add 'Gitea PAT: git.satware.ai' 'mw' --uri 'https://git.satware.ai' (requires interactive pinentry)
Revoke old token via API: curl -X DELETE -H 'Authorization: token <new>' https://git.satware.ai/api/v1/users/mw/tokens/<old-id>
Update docs/product/passwords.md — mark rotation done

2. Bitwarden entry (blocked: rbw pinentry non-interactive)

rbw 1.15.0 uses pinentry for the password field on rbw add, not $EDITOR. Non-interactive entry creation failed because the fake pinentry returns the entry password for ALL GETPIN calls, breaking database unlock. The master password retrieval mechanism (how default pinentry auto-unlocks) is not yet understood.

Workaround: create the Bitwarden entry manually via rbw add (interactive, GUI pinentry) or the Bitwarden web UI at bitwarden.jantec.xyz.

References

Doc: docs/product/passwords.md section "Gitea PAT (git.satware.ai)"
Gitea server version: 1.26.1
tea version: 0.14.1 (pacman)

## Context The git.satware.ai PAT (`c441fa...`) is stored in gnome-keyring (libsecret) and tea config. Two follow-up tasks are blocked: ### 1. Token rotation (blocked: token lacks admin scope) Current token scopes: `write:repository`, `read:user`. Gitea 1.26.1 requires `write:admin` to create/revoke tokens via API (`POST /api/v1/users/mw/tokens`). The current token returns 403/401 on those endpoints. **Manual steps** (web UI): 1. Log in at https://git.satware.ai/user/settings/applications 2. Create new PAT with scopes: `write:repository`, `read:user`, `write:admin` 3. Update gnome-keyring: `printf 'protocol=https\nhost=git.satware.ai\nusername=mw\npassword=<new>\n\n' | git credential approve` 4. Update tea: `tea login edit satware --token <new>` 5. Create Bitwarden entry: `rbw add 'Gitea PAT: git.satware.ai' 'mw' --uri 'https://git.satware.ai'` (requires interactive pinentry) 6. Revoke old token via API: `curl -X DELETE -H 'Authorization: token <new>' https://git.satware.ai/api/v1/users/mw/tokens/<old-id>` 7. Update `docs/product/passwords.md` — mark rotation done ### 2. Bitwarden entry (blocked: rbw pinentry non-interactive) rbw 1.15.0 uses pinentry for the password field on `rbw add`, not $EDITOR. Non-interactive entry creation failed because the fake pinentry returns the entry password for ALL GETPIN calls, breaking database unlock. The master password retrieval mechanism (how default pinentry auto-unlocks) is not yet understood. **Workaround**: create the Bitwarden entry manually via `rbw add` (interactive, GUI pinentry) or the Bitwarden web UI at bitwarden.jantec.xyz. ### References - Doc: `docs/product/passwords.md` section "Gitea PAT (git.satware.ai)" - Gitea server version: 1.26.1 - tea version: 0.14.1 (pacman)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: infrastructure/mw-pfeddersheim-workstation#1