# fleet-ssh-hostcert configuration — fleet-generic (no per-host data; invariant #1).
# The host's SSH host key is signed by the fleet SSH CA (via the enrol-broker) so
# admins trust every host with one `@cert-authority` line instead of per-boot TOFU
# (F-02/P-17). Replace the DNS names per environment; the serving dnsmasq resolves
# them. docs/ssh-host-certificate-design.md.

# The enrol-broker's HOST PLANE endpoint (mTLS). The host authenticates with its
# TPM identity; the broker (not the host) holds the step-ca provisioner credential
# and signs the SSH host cert, keeping step-ca behind the single front door.
SSH_HOSTCERT_BROKER_URL=https://boot.fleet.lab:9444/ssh/hostcert

# Fleet CA bundle: verifies the broker's server cert. Same anchor as the RADIUS /
# agent CA — reuse the one placeholder, replace per environment.
SSH_HOSTCERT_CACERT=/etc/dot1x/radius-ca.pem

# TPM identity (same key/cert as 802.1X, the NVMe hostnqn and agent mTLS) — used
# as the mTLS CLIENT cert proving this is an enrolled host.
SSH_HOSTCERT_HANDLE=0x81000100
SSH_HOSTCERT_NVINDEX=0x01800100

# The per-boot host key to certify and where its certificate is installed.
SSH_HOSTCERT_HOSTKEY=/etc/ssh/ssh_host_ecdsa_key.pub
SSH_HOSTCERT_OUT=/etc/ssh/ssh_host_ecdsa_key-cert.pub
SSH_HOSTCERT_DROPIN=/etc/ssh/sshd_config.d/60-hostcert.conf

# Cert principals. Empty => the binary uses the host's hostname (derived at
# runtime, never baked). Set a comma list to add e.g. a per-env FQDN or wildcard
# that admins connect by (must be covered by their `@cert-authority` line and
# authorised by the broker's principal policy).
SSH_HOSTCERT_PRINCIPALS=

# Reload sshd after installing/renewing the cert so it takes effect immediately.
SSH_HOSTCERT_RELOAD=true