obelisk/rustica

An SSHCA that uses a standard Yubikey to issue new host and user certificates.

rustica's Issues

README is outdated

Should be updated after #5 since that changed how the system is configured and deployed.

Use $HOME/.config/rusticaagent for configuration

It would be nice to use XDG base directories for configuration files to keep config files all in one place.

To fully respect the config home, I believe it would default to $HOME/.config/rusticaagent or if XDG_CONFIG_HOME is set it would use $XDG_CONFIG_HOME/rusticaagent. For backward compatibility, falling back to $HOME/.rusticaagent would be a good idea.

mTLS credentials refreshed too often

After an mTLS creds refresh, the refresh timestamp should be updated and no more refresh should happen until we go into the refresh window again. But there seems to be too many refreshes.

Influx Lag Blocks Certificate Issuance

When using Influx logging, if influx stops responding, the web request must timeout before the certificate is passed to the client.

This should be happening in another thread.