# Cert issuer

```mermaid
flowchart LR
  CertIssuer[cert-issuer / step-ca] --> SSHCerts[SSH user certs]
  CertIssuer --> X509[X.509 certs]
  CertSyncer[cert-syncer] --> NASCA["/mnt/nas/ca"]
  NASCA --> Hosts[Hosts]
  NASCA --> Consumers[Cert-consuming stacks]
```

| Repo                  | Role                                           |
| --------------------- | ---------------------------------------------- |
| `Charlie/cert-issuer` | step-ca on morgott.                            |
| `Charlie/cert-syncer` | Refreshes CA/cert material into `/mnt/nas/ca`. |
| `Charlie/cert-watch`  | Consumer-side cert restart sidecar.            |

## Issued material

| Material           | Used by                                       |
| ------------------ | --------------------------------------------- |
| SSH user certs     | Gssh, runners, operator/admin SSH.            |
| SSH user CA pubkey | Host `sshd` trust.                            |
| X.509 server certs | Internal services that consume managed certs. |
| X.509 root         | Host trust stores and service clients.        |

## Boundaries

| Boundary           | State                                         |
| ------------------ | --------------------------------------------- |
| Human identity     | Authentik remains the IdP.                    |
| Host authorization | LDAP/SSSD groups remain authoritative.        |
| Cert storage       | `/mnt/nas/ca` remains the distribution point. |
| CA key             | Held by cert-issuer.                          |

Operational details live in `Charlie/cert-issuer`.