infra/kubernetes
1
0
Fork 0
Code Pull Requests 3 Activity

sshca: Configure user CA

Browse Source 
SSHCA now supports issuing user certificates.  It uses OpenID Connect to
authenticate requests, and issues certificates based on the user's ID
token.
This commit is contained in:
Dustin
2024-02-01 09:02:11 -06:00
parent 834d0f804f
commit 2cd4a8b097
4 changed files with 59 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
sshca/config.toml
View File

@@ -1,9 +1,17 @@
machine_ids = "/var/lib/sshca/machine-ids.json"
[oidc]
discovery_url = "https://auth.pyrocufflink.blue"
client_id = "sshca"
[ca.host]
private_key_file = "/run/sshca/secrets/host/key/host-ca-key"
private_key_passphrase_file = "/run/sshca/secrets/host/passphrase/host-ca-key.passphrase"
[ca.user]
private_key_file = "/run/sshca/secrets/user/key/user-ca-key"
private_key_passphrase_file = "/run/sshca/secrets/user/passphrase/user-ca-key.passphrase"
[[libvirt]]
uri = "qemu+ssh://sshca@vmhost0.pyrocufflink.blue/system?keyfile=/run/sshca/libvirt/sshkey"