18 lines
665 B
SYSTEMD
18 lines
665 B
SYSTEMD
[Unit]
|
|
Description=Renew the fleet SSH host certificate
|
|
Documentation=https://git.bitasylum.org/audiobuzz/diskless-workstation/docs/ssh-host-certificate-design.md
|
|
|
|
[Timer]
|
|
# Fire shortly after boot (once the network + enrolment are likely ready) to
|
|
# acquire the first cert for this boot's ephemeral host key, then renew well
|
|
# inside the cert's validity window. The service is idempotent + fail-open, so a
|
|
# missed/failed run just retries next cycle (sshd keeps serving the bare key
|
|
# meanwhile). Cadence is bench-tunable (host-cert validity is a step-ca policy).
|
|
OnBootSec=60s
|
|
OnUnitActiveSec=1h
|
|
Persistent=false
|
|
AccuracySec=15s
|
|
|
|
[Install]
|
|
WantedBy=timers.target
|