mirror of
https://github.com/Termix-SSH/Termix.git
synced 2026-10-28 14:15:24 +00:00
32 lines
1.4 KiB
Markdown
32 lines
1.4 KiB
Markdown
# Step CA
|
|
|
|
Connect to hosts with short-lived SSH certificates from a smallstep step-ca server, after signing in through its OIDC provisioner.
|
|
|
|
## Features
|
|
|
|
- Adds the Step CA login type to the host editor.
|
|
- Signs you in through the identity provider behind a [smallstep step-ca](https://smallstep.com/docs/step-ca/) OIDC provisioner.
|
|
- Has the CA sign a fresh key and keeps the certificate until it expires.
|
|
- Talks to the CA's HTTPS API directly, so the `step` binary is never needed.
|
|
|
|
## Setup
|
|
|
|
When `REDIS_URL` is set and you run more than one Termix instance, a callback that reaches the wrong instance is handed to the one that started the sign-in. `TERMIX_STEP_CA_REDIS_PREFIX` changes the key prefix, which defaults to `termix:step-ca`.
|
|
|
|
## Settings
|
|
|
|
### Admin
|
|
|
|
- CA URL, Root fingerprint and OIDC provisioner name: leave all three empty to turn Step CA off.
|
|
- Allowed private Step CA hosts: the CA and, if it is internal, the identity provider. Private hosts not on this list are refused.
|
|
- Redirect URI: register `<base URL>/plugin-api/step-ca/callback` with your identity provider.
|
|
- Use the old redirect URI: keep sending the 2.8 URI `<base URL>/host/step-ca-callback`. Upgraded installs keep this on until you turn it off.
|
|
|
|
## Development
|
|
|
|
```bash
|
|
npm run build # build into dist/
|
|
npm run test # run this plugin's tests
|
|
npm run typecheck # type-check this plugin
|
|
```
|