37 lines
1.5 KiB
Markdown
37 lines
1.5 KiB
Markdown
# Cert issuer
|
|
|
|
```mermaid
|
|
flowchart LR
|
|
CertIssuer[cert-issuer / step-ca] --> SSHCerts[SSH user certs]
|
|
CertIssuer --> X509[X.509 certs]
|
|
CertSyncer[cert-syncer] --> NASCA["/mnt/nas/ca"]
|
|
NASCA --> Hosts[Hosts]
|
|
NASCA --> Consumers[Cert-consuming stacks]
|
|
```
|
|
|
|
| Repo | Role |
|
|
| --------------------- | ---------------------------------------------- |
|
|
| `Charlie/cert-issuer` | step-ca on morgott. |
|
|
| `Charlie/cert-syncer` | Refreshes CA/cert material into `/mnt/nas/ca`. |
|
|
| `Charlie/cert-watch` | Consumer-side cert restart sidecar. |
|
|
|
|
## Issued material
|
|
|
|
| Material | Used by |
|
|
| ------------------ | --------------------------------------------- |
|
|
| SSH user certs | Gssh, runners, operator/admin SSH. |
|
|
| SSH user CA pubkey | Host `sshd` trust. |
|
|
| X.509 server certs | Internal services that consume managed certs. |
|
|
| X.509 root | Host trust stores and service clients. |
|
|
|
|
## Boundaries
|
|
|
|
| Boundary | State |
|
|
| ------------------ | --------------------------------------------- |
|
|
| Human identity | Authentik remains the IdP. |
|
|
| Host authorization | LDAP/SSSD groups remain authoritative. |
|
|
| Cert storage | `/mnt/nas/ca` remains the distribution point. |
|
|
| CA key | Held by cert-issuer. |
|
|
|
|
Operational details live in `Charlie/cert-issuer`.
|