Ilker ManapandClaude Opus 5.5
2f708e8f69
The CA directory holds the active root and, during a rotation, the next or the previous one; everything that trusts the region gets the trust bundle (all of them). Rack controllers receive it in their state, signed by the active root; the root update unit installs it only when the signature verifies against the roots it already trusts, and binary signatures verify against any of them. After switch racks renew their client and server certificates from the new root by themselves and report what they run on; switch and retire wait for every rack (-force). /ca.pem stays one certificate, the root of that server's certificate, and the PXE command line names that root, so agents in older images keep working; /ca-bundle.pem is the bundle. Deployed machines get one file per root and a daily timer that refreshes them from their rack over HTTPS. Refs #12 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
10 lines
231 B
SYSTEMD
10 lines
231 B
SYSTEMD
[Unit]
|
|
Description=rollcall: install a rollcall binary or trust bundle the rack controller staged
|
|
|
|
[Path]
|
|
PathExists=/var/lib/rollcall/update/ready
|
|
PathExists=/var/lib/rollcall/update/ca-ready
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|