API-Keys sicher speichern

# vault.py
import os
import json
import base64
from cryptography.fernet import Fernet

VAULT_FILE = "vault.json.enc"
KEY_FILE = ".vault.key"

def get_key():
    """Lade oder erstelle Vault-Key"""
    if os.path.exists(KEY_FILE):
        with open(KEY_FILE, 'rb') as f:
            return f.read()
    key = Fernet.generate_key()
    with open(KEY_FILE, 'wb') as f:
        f.write(key)
    return key

def decrypt(filepath):
    """Entschlüssle Vault-Datei"""
    key = get_key()
    f = Fernet(key)
    with open(filepath, 'rb') as data:
        encrypted = data.read()
    return json.loads(f.decrypt(encrypted))

def get(service, key):
    """Hole einen Key aus dem Vault"""
    decrypted = decrypt(VAULT_FILE)
    return decrypted[service][key]

# Verwendung
api_key = vault.get("stripe", "secret_key")
print(f"Stripe Key: {api_key[:8]}...")  # sk_live_xxxx → sk_live_x...

# .env Datei (NIEMALS committen!)
STRIPE_SECRET_KEY=sk_live_xxxxx
GRAFANA_API_KEY=eyJxxxxx
OLLAMA_API_KEY=

# .env.example (Diesen committen)
STRIPE_SECRET_KEY=
GRAFANA_API_KEY=

# config.py
from dotenv import load_dotenv
import os

load_dotenv()

STRIPE_KEY = os.getenv("STRIPE_SECRET_KEY")
GRAFANA_KEY = os.getenv("GRAFANA_API_KEY")

# Error wenn Key fehlt
if not STRIPE_KEY:
    raise ValueError("STRIPE_SECRET_KEY nicht gesetzt")

# .gitignore
.env
.env.local
vault.json.enc
.vault.key
*.pem
*.key

# rotate_keys.py - Keys automatisch rotieren
import os
import subprocess
from datetime import datetime, timedelta

def rotate_stripe_key():
    """Neuen Stripe Key erstellen und alten revoke"""
    # 1. API Call zu Stripe
    result = subprocess.run([
        "stripe", "api_key", "create", 
        "--description", f"Rotated {datetime.now()}"
    ], capture_output=True, text=True)
    
    new_key = result.stdout.strip()
    
    # 2. .env updaten
    with open(".env", "r") as f:
        content = f.read()
    
    content = content.replace(
        "STRIPE_SECRET_KEY=sk_live_xxx",
        f"STRIPE_SECRET_KEY={new_key}"
    )
    
    with open(".env", "w") as f:
        f.write(content)
    
    # 3. Alten Key revoke
    subprocess.run(["stripe", "api_keys", "delete", "old_key_id"])
    
    print(f"✓ Key rotiert: {new_key[:12]}...")

# Cron: 0 0 1 */6 * → alle 6 Monate