step-ca-formula/pillar.example at main · darix/step-ca-formula · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
#
# step-ca-formula
#
# Copyright (C) 2025   darix
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
#

# -*- coding: utf-8 -*-
# vim: ft=yaml
---
include:
  - includes.step-ca-mine-functions

step:
  # This is only meant for the case where the salt master is configured outside of the scope of the current salt master
  # In this case the ca section should not exist in that case
  #
  # salt:
  #  setup_from_client_config: True
  #  provisioner_password: 'supersecure!!!'
  ca:
    enabled: True
    password: "this is just a test"
    name: "Example CA"
    dns:
      - ca.example.com
    initial_provisioner: ca@example.com
    ssh: True
    provisioners:
      acme:
        options:
          type: ACME
      saltify@example.com:
        options:
          type: JWK
          password: foobar
          ssh: true
      saltstack@example.com:
        options:
          type: JWK
          password: foobar
          ssh: true
        settings:
          "forceCN": true
          "claims":
            "maxTLSCertDuration": "2160h0m0s"
            "defaultTLSCertDuration": "2160h0m0s"
            "enableSSHCA": True
  defaults:
    token:
      lifetime: 60m
  ssh:
    sign_hosts_certs: True
    # TODO:
    # deploy_user_ca: False
    # TODO
    # deploy_cert_authority: False
    # defaults to all ecdsa, rsa, ed25519 by default
    host_key_types:
      - ed25519
    principals:
      - {{ grains.id }}
  client_config:
    deploy_root_from_salt_mine: False
    # possible modes:
    #
    # tokens -> key/cert are generated on the minion and signed with token authentication
    # certificates -> both are generated on the saltmaster and shipped via pillar
    certificate_mode: tokens
    # use systemd timer based renewer services?
    certificate_use_renewer: False
    # combine key and cert (and optionally dhparams into one file)
    ssl_merged_certificates: True
    ssl_generate_dhparams: True
    # Ignore if certificates/keys are already created. Overwrite them.
    force_deploy: False
    ca:
      # TODO: find out how we can get the data via salt mine from the step-ca main host
      url:           "https://ca.example.com"
      # optional
      # contact_email: "ca@example.com"
      root_cert:
        fingerprint: "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
        # optional
        # path:        "/usr/share/pki/trust/anchors/step-ca-at-home.crt.pem"
  certificates:
    host:
      etcd:
        affected_services:
         - etcd.service
        cn: {{ grains.id }}
        san:
          - {{ grains.id }}
          - 127.0.0.1
      patroni:
        # cn: {{ grains.id }}
        config:
          kty: RSA
        exec_start_post: '/bin/echo "Hello world"'
      pg-ecdsa:
        cn: {{ grains.id }}
        exec_start_post:
          - bash -c '/usr/bin/systemctl is-active postgresql.service && /usr/bin/systemctl try-reload-or-restart postgresql.service'
      pg-rsa:
        cn: {{ grains.id }}
        config:
          kty: RSA
          size: 4096
        acls_for_combined_file:
          - acl_type: user
            acl_names:
            - postgres
            - minio
          - acl_type: group
            acl_names:
            - ldap
    user:
      postgres:
        cn: postgres
        san:
          - {{ grains.id }}
          - 127.0.0.1
        affected_services:
          - postgresql.service
      etcd:
        affected_services:
         - etcd.service
        cn: etcd
        san:
          - {{ grains.id }}
          - 127.0.0.1