Lutz Finsterle
5a111b7a20
Turn the ssh/ engine into an SSH CA for cert-based access: - ssh/ roles: "user" (8h user certs, principal-restricted) and "host" (long-lived host certs); mount max-lease-ttl raised for host certs - scripts/ssh-login.sh: sign a fresh user cert via a scoped ssh/sign/user token (API, no bao binary) and connect — no authorized_keys on targets - ca/openbao-ssh-ca.pub: the SSH CA public key (for TrustedUserCAKeys and client @cert-authority trust) - README: usage, host onboarding, client trust - gitignore generated per-host artifacts/ First host wired + verified end-to-end: 192.168.0.26 (pifour) — lutz cert login and host-cert verification both confirmed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
12 lines
190 B
Plaintext
12 lines
190 B
Plaintext
# NEVER commit unseal keys, root tokens, or storage data
|
|
unseal-keys.json
|
|
init-output.json
|
|
unsealer-init.json
|
|
admin-credentials.txt
|
|
config/seal.hcl
|
|
*.token
|
|
config/tls/
|
|
data/
|
|
.env
|
|
artifacts/
|