ignition/step-ssh-renew.target at 9d941a998530a2464140452252ddf6a77ef59960 - ignition - Gitea: Git with a cup of tea

infra/ignition

Files

Dustin C. Hatch 88f165363d step-ssh: Automatically issue/renew SSH host certs

The `ssh-bootstrap` script, which is run by the *ssh-bootstrap.service*
systemd unit, requests SSH host certificates for each of the existing
SSH host keys.  The certificates are issued by the *POST /sshkeys/sign*
operation of *dch-webhooks* web service.

The *step-ssh-renew* timer/service runs `step ssh renew`, in a
container, on a weekly basis to renew the SSH host certificate.  A host
certificate must already exist, and its private key is used to
authenticate to the CA server.

Since `step ssh renew` can only operate on one certificate/key file at a
time, the `step-ssh-renew@.container` defines a template unit.  The
template instance specifies the key type (i.e. `rsa`, `ecdsa`, or
`ed25519`), which in turn defines which certificate and private key file
to use.  The timer unit activates a target unit, which depends on the
concrete service units.  Note that the target unit must have
`StopWhenUnneeded=yes` so that it can be restarted again the next time
the timer fires.

2023-10-03 20:06:37 -05:00

7 lines

173 B

SYSTEMD

Raw Blame History

 [Unit]
 Description=Renew SSH host certificates
 StopWhenUnneeded=yes
 Wants=step-ssh-renew@ed25519.service
 Wants=step-ssh-renew@ecdsa.service
 Wants=step-ssh-renew@rsa.service