john/dendritic
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ssh cert consolidation

Browse Source
This commit is contained in:
John Lancaster
2026-07-05 00:03:28 -05:00
parent b1f4b6ad41
commit a9b831a6b0
10 changed files with 39 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/hosts/janus/README.md
+4 -4
View File
@@ -34,7 +34,7 @@ If rotating provisioner password, also set:
Secret source-of-truth after this split:
- `modules/hosts/janus/secrets.yaml`: Janus runtime CA secrets (`ca_password`, `intermediate_ca_key`, `ssh_host_ca_key`, `ssh_user_ca_key`, `admin_provisioner_encrypted_key`)
- `keys/secrets.yaml`: shared Janus provisioner secret (`janus.admin_jwk`) consumed by `step-ssh-host` across hosts
- `keys/secrets.yaml`: shared Janus provisioner secret (`janus.admin_jwk`) consumed by `ssh-certs` across hosts
Then update public artifacts in repo from generated output:
@@ -54,14 +54,14 @@ ad hoc issuance commands first:
```shell
systemctl status step-ca.service
systemctl status step-ssh-host-renew.service
systemctl status step-ssh-host-renew.timer
systemctl status ssh-certs-renew.service
systemctl status ssh-certs-renew.timer
systemctl status mtls-bootstrap.service
ssh-host-cert-check
mtls-check
```
`step-ssh-host-renew.service` issues the SSH host certificate when it is missing
`ssh-certs-renew.service` issues the SSH host certificate when it is missing
or expiring. `mtls-bootstrap.service` issues the first Janus mTLS bundle
only when the configured certificate files are absent or invalid; recurring mTLS
renewal remains handled by `mtls-renew.timer`.