project-charlie/docs/cert-issuer.md

Cert issuer

flowchart LR
  CertIssuer[cert-issuer / step-ca] --> SSHCerts[SSH user certs]
  CertIssuer --> X509[X.509 certs]
  CertSyncer[cert-syncer] --> NASCA["/mnt/nas/ca"]
  NASCA --> Hosts[Hosts]
  NASCA --> Consumers[Cert-consuming stacks]

Repo	Role
Charlie/cert-issuer	step-ca on morgott.
Charlie/cert-syncer	Refreshes CA/cert material into /mnt/nas/ca.
Charlie/cert-watch	Consumer-side cert restart sidecar.

Issued material

Material	Used by
SSH user certs	Gssh, runners, operator/admin SSH.
SSH user CA pubkey	Host sshd trust.
X.509 server certs	Internal services that consume managed certs.
X.509 root	Host trust stores and service clients.

Boundaries

Boundary	State
Human identity	Authentik remains the IdP.
Host authorization	LDAP/SSSD groups remain authoritative.
Cert storage	/mnt/nas/ca remains the distribution point.
CA key	Held by cert-issuer.

Operational details live in Charlie/cert-issuer.