34 lines
1.7 KiB
Bash
34 lines
1.7 KiB
Bash
# fleet-ssh-hostcert configuration — fleet-generic (no per-host data; invariant #1).
|
|
# The host's SSH host key is signed by the fleet SSH CA (via the enrol-broker) so
|
|
# admins trust every host with one `@cert-authority` line instead of per-boot TOFU
|
|
# (F-02/P-17). Replace the DNS names per environment; the serving dnsmasq resolves
|
|
# them. docs/ssh-host-certificate-design.md.
|
|
|
|
# The enrol-broker's HOST PLANE endpoint (mTLS). The host authenticates with its
|
|
# TPM identity; the broker (not the host) holds the step-ca provisioner credential
|
|
# and signs the SSH host cert, keeping step-ca behind the single front door.
|
|
SSH_HOSTCERT_BROKER_URL=https://boot.fleet.lab:9444/ssh/hostcert
|
|
|
|
# Fleet CA bundle: verifies the broker's server cert. Same anchor as the RADIUS /
|
|
# agent CA — reuse the one placeholder, replace per environment.
|
|
SSH_HOSTCERT_CACERT=/etc/dot1x/radius-ca.pem
|
|
|
|
# TPM identity (same key/cert as 802.1X, the NVMe hostnqn and agent mTLS) — used
|
|
# as the mTLS CLIENT cert proving this is an enrolled host.
|
|
SSH_HOSTCERT_HANDLE=0x81000100
|
|
SSH_HOSTCERT_NVINDEX=0x01800100
|
|
|
|
# The per-boot host key to certify and where its certificate is installed.
|
|
SSH_HOSTCERT_HOSTKEY=/etc/ssh/ssh_host_ecdsa_key.pub
|
|
SSH_HOSTCERT_OUT=/etc/ssh/ssh_host_ecdsa_key-cert.pub
|
|
SSH_HOSTCERT_DROPIN=/etc/ssh/sshd_config.d/60-hostcert.conf
|
|
|
|
# Cert principals. Empty => the binary uses the host's hostname (derived at
|
|
# runtime, never baked). Set a comma list to add e.g. a per-env FQDN or wildcard
|
|
# that admins connect by (must be covered by their `@cert-authority` line and
|
|
# authorised by the broker's principal policy).
|
|
SSH_HOSTCERT_PRINCIPALS=
|
|
|
|
# Reload sshd after installing/renewing the cert so it takes effect immediately.
|
|
SSH_HOSTCERT_RELOAD=true
|