adding ssh host signing

2026-07-11 16:20:21 +09:30
parent b5d6c790c4
commit 2e318fba00
24 changed files with 1626 additions and 90 deletions
@@ -0,0 +1,17 @@
+[Unit]
+Description=Renew the fleet SSH host certificate
+Documentation=https://git.bitasylum.org/audiobuzz/diskless-workstation/docs/ssh-host-certificate-design.md
+
+[Timer]
+# Fire shortly after boot (once the network + enrolment are likely ready) to
+# acquire the first cert for this boot's ephemeral host key, then renew well
+# inside the cert's validity window. The service is idempotent + fail-open, so a
+# missed/failed run just retries next cycle (sshd keeps serving the bare key
+# meanwhile). Cadence is bench-tunable (host-cert validity is a step-ca policy).
+OnBootSec=60s
+OnUnitActiveSec=1h
+Persistent=false
+AccuracySec=15s
+
+[Install]
+WantedBy=timers.target