Lutz Finsterle
af31208251
Generalize the .26 rollout into a reusable template: - authorize the host principal on ssh/roles/host (allowlist, merged) - sign the host certificate (ssh/sign/host) - emit a self-contained installer (user-CA TrustedUserCAKeys + HostCertificate) to artifacts/, additive and lockout-safe - add @cert-authority for the host to the client's known_hosts Needs no SSH access to the target (ssh-keyscan). README updated. Also gitignore .claude/ (local harness settings). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
13 lines
199 B
Plaintext
13 lines
199 B
Plaintext
# NEVER commit unseal keys, root tokens, or storage data
|
|
unseal-keys.json
|
|
init-output.json
|
|
unsealer-init.json
|
|
admin-credentials.txt
|
|
config/seal.hcl
|
|
*.token
|
|
config/tls/
|
|
data/
|
|
.env
|
|
artifacts/
|
|
.claude/
|