admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

pin operator public keys (key ceremony)

Browse Source
This commit is contained in:
authentik Default Admin
2026-07-08 11:27:50 +02:00
parent e5617969ae
commit bd97bc3474
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/felhom-host-install.sh
+5 -5
View File
@@ -144,17 +144,17 @@
set -euo pipefail
SCRIPT_VERSION="1.11.0" # keep in sync with the header line at the top of this file
SCRIPT_VERSION="1.11.1" # keep in sync with the header line at the top of this file
# Operator signing keys pinned at day-0 (GL-4; doc 04 §3 two-key model). EMPTY by default — the pin
# CEREMONY is an operator step: generate the real keypairs OFFLINE, then fill these four constants
# in one commit (or pass --operator-pubkey-file at install time, which overrides them). Empty =
# no authz.signers written = agent self-update stays DORMANT (the safe default; the verify step
# warns). PUBLIC keys only — this script never generates, reads, or references private key material.
OPERATOR_KEY_OPERATIONAL_ID="" # key_id = the authorized_keys comment, e.g. "felhom-op-1"
OPERATOR_KEY_OPERATIONAL_LINE="" # full authorized_keys line: "ssh-ed25519 AAAA… felhom-op-1"
OPERATOR_KEY_RECOVERY_ID="" # cold key; authorizes only key-rotation/break-glass
OPERATOR_KEY_RECOVERY_LINE=""
OPERATOR_KEY_OPERATIONAL_ID="felhom-op-1"
OPERATOR_KEY_OPERATIONAL_LINE="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL8z0qCNgA3x2xxAB0Qj5ro8waFjGZ8Ta/sWB63tlLw+ felhom-op-1"
OPERATOR_KEY_RECOVERY_ID="felhom-rec-1"
OPERATOR_KEY_RECOVERY_LINE="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC/gZI5mvXmUzImh81iHdjdVYwmQ4fRGKqn+9td0fI5/ felhom-rec-1"
#-------------------------------------------------------------------------------
# Logging (mirrors felhom-controller/scripts/docker-setup.sh)