kaffa/obsidian
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

vault: jump-seoul SSH CA 등록 완료, admin principal 추가

Browse Source
This commit is contained in:
kappa
2026-03-12 18:56:37 +09:00
parent 898ba422d7
commit 947c6108a6
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
infra/vault.md
View File

@@ -41,7 +41,7 @@ vault.inouter.com(Synology)에서 hcv.inouter.com(K3s)으로 이관 완료 (2026
## SSH CA (Signed Certificates) ## SSH CA (Signed Certificates)
Vault SSH Secrets Engine (ssh-client-signer/) 활성화. CA 키: ed25519. 역할: admin (allowed_users: root,kaffa, TTL 8h, max 24h). Vault SSH Secrets Engine (ssh-client-signer/) 활성화. CA 키: ed25519. 역할: admin (allowed_users: root,kaffa,admin, TTL 8h, max 24h).
CA 등록 완료 서버: CA 등록 완료 서버:
- [[infra-hosts|apisix-osaka]] (100.108.39.107) — root - [[infra-hosts|apisix-osaka]] (100.108.39.107) — root
@@ -49,10 +49,11 @@ CA 등록 완료 서버:
- [[infra-hosts|incus-kr1]] (100.84.111.28) — kaffa - [[infra-hosts|incus-kr1]] (100.84.111.28) — kaffa
- [[infra-hosts|incus-kr2]] (100.119.109.41) — kaffa - [[infra-hosts|incus-kr2]] (100.119.109.41) — kaffa
- [[infra-hosts|sandbox-tokyo]] (100.79.87.48) — root - [[infra-hosts|sandbox-tokyo]] (100.79.87.48) — root
- [[infra-hosts|jump-seoul]] (100.120.61.54) — admin
미등록: jump-seoul (접속 불가), safeline-osaka (응답 없음) 미등록: safeline-osaka (응답 없음)
자동화: ~/.ssh/vault-sign.sh가 인증서 만료 시 자동 재발급. ~/.ssh/config에 Match exec로 연동. `ssh apisix-osaka` 등 일반 SSH처럼 사용 가능. 자동화: ~/.ssh/vault-sign.sh가 인증서 만료 시 자동 재발급 (curl + jq 기반). 인증서에 root,kaffa,admin principals 포함. ~/.ssh/config에 Match exec로 연동. `ssh apisix-osaka` 등 일반 SSH처럼 사용 가능.
## MCP 서버 ## MCP 서버