Termix Identity
Claim a public handle and publish your SSH public keys under it. Any server
can then pull them into authorized_keys:
curl -fsSL https://<termix>/plugin-api/termix-identity/u/<handle> >> ~/.ssh/authorized_keys
Add /<ALGO> (for example /ED25519) to serve only one key type. The
resolver needs no login and is never cached.
Certificate authority
Each handle can have its own SSH certificate authority. Servers trust it with
TrustedUserCAKeys, using the public key from /u/<handle>/ca. Termix then
issues short-lived certificates for your Ed25519 keys. Rotating the CA
revokes every certificate it issued. The CA private key is stored encrypted
with the installation key.
Certificates are downloaded once and never stored, so hosts in Termix do not use them to connect. This plugin adds no SSH auth type.
Old URLs
The 2.8 resolver URLs (/termix-id/u/<handle>, /termix-id/u/<handle>/<ALGO>
and /termix-id/u/<handle>/ca) permanently redirect here, so servers that
fetch them from scripts keep working. curl -L follows the redirect.
Permission
termix-identity.use lets a user claim a handle, publish keys and run a CA.
Admins and users have it by default.