panxiao81
88a02ababa
Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.
22 lines
671 B
Terraform
22 lines
671 B
Terraform
# SSH certificate authority for machine/agent access.
|
|
# The CA KEYPAIR itself is NOT managed here (see mounts.tf) — only this role,
|
|
# which is what actually constrains what a signed cert may do.
|
|
resource "vault_ssh_secret_backend_role" "ai_agent" {
|
|
backend = vault_mount.ssh_client_signer.path
|
|
name = "ai-agent"
|
|
key_type = "ca"
|
|
|
|
allow_user_certificates = true
|
|
default_user = "ansible"
|
|
allowed_users = "*"
|
|
|
|
# Deliberately short: access is scoped by TTL + principals rather than by
|
|
# source IP, so a leaked cert expires in minutes.
|
|
ttl = 300 # 5m
|
|
max_ttl = 900 # 15m
|
|
|
|
default_extensions = {
|
|
"permit-pty" = ""
|
|
}
|
|
}
|