adding ssh host signing

serving/enrol-broker/main.go

@@ -63,6 +63,13 @@ type config struct {
 	adminKey      string
 	adminClientCA string
 	adminInsecure bool
+	// host plane (SSH host-cert issuance) mTLS
+	hostAddr     string
+	hostCert     string
+	hostKey      string
+	hostClientCA string
+	hostInsecure bool
+	sshNotAfter  string
 }
 
 func loadConfig() config {
@@ -87,14 +94,21 @@ func loadConfig() config {
 		adminKey:      env("BROKER_ADMIN_KEY", ""),
 		adminClientCA: env("BROKER_ADMIN_CLIENT_CA", ""),
 		adminInsecure: envBool("BROKER_ADMIN_INSECURE", false),
+		hostAddr:      env("BROKER_HOST_ADDR", ""), // empty => host plane disabled
+		hostCert:      env("BROKER_HOST_CERT", ""),
+		hostKey:       env("BROKER_HOST_KEY", ""),
+		hostClientCA:  env("BROKER_HOST_CLIENT_CA", ""), // default: caRoot (fleet root)
+		hostInsecure:  envBool("BROKER_HOST_INSECURE", false),
+		sshNotAfter:   env("STEP_SSH_CERT_NOT_AFTER", "720h"),
 	}
 }
 
 type broker struct {
-	cfg    config
-	store  *Store
-	signer Signer
-	rl     *rateLimiter
+	cfg       config
+	store     *Store
+	signer    Signer
+	sshSigner SSHSigner
+	rl        *rateLimiter
 }
 
 func main() {
@@ -123,7 +137,20 @@ func main() {
 		log.Fatalf("unknown BROKER_SIGNER %q (want step|mock)", cfg.signerKind)
 	}
 
-	b := &broker{cfg: cfg, store: store, signer: signer, rl: newRateLimiter(cfg.ratePerMin)}
+	// SSH host-cert signer (host plane) — same step|mock selection as the X.509
+	// enrolment signer, so a mock broker exercises both without a running step-ca.
+	var sshSigner SSHSigner
+	switch cfg.signerKind {
+	case "step":
+		sshSigner = &stepSSHSigner{
+			bin: cfg.stepBin, caURL: cfg.caURL, root: cfg.caRoot,
+			provisioner: cfg.provisioner, passwordFile: cfg.passwordFile, notAfter: cfg.sshNotAfter,
+		}
+	case "mock":
+		sshSigner = mockSSHSigner{}
+	}
+
+	b := &broker{cfg: cfg, store: store, signer: signer, sshSigner: sshSigner, rl: newRateLimiter(cfg.ratePerMin)}
 
 	// background reaper: expire timed-out requests + evict old decided ones.
 	go func() {
@@ -138,11 +165,12 @@ func main() {
 	}()
 
 	var wg sync.WaitGroup
-	wg.Add(2)
+	wg.Add(3)
 	go func() { defer wg.Done(); b.servePublic() }()
 	go func() { defer wg.Done(); b.serveAdmin() }()
-	log.Printf("enrol-broker up: public=%s admin=%s signer=%s words=%d ttl=%s",
-		cfg.publicAddr, cfg.adminAddr, signer.Kind(), len(words), cfg.ttl)
+	go func() { defer wg.Done(); b.serveHost() }() // SSH host-cert plane (no-op if BROKER_HOST_ADDR unset)
+	log.Printf("enrol-broker up: public=%s admin=%s host=%s signer=%s words=%d ttl=%s",
+		cfg.publicAddr, cfg.adminAddr, cfg.hostAddr, signer.Kind(), len(words), cfg.ttl)
 	wg.Wait()
 }