frankenbit/purser
15
0
Fork 0
Code Issues 6 Pull requests Projects Releases 4 Packages Wiki Activity Actions
Purser — VPN client-certificate issuance, revocation and delivery dashboard (step-ca)
67 commits 28 branches 4 tags 999 KiB
  • Go 78.3%
  • Shell 21.3%
  • Dockerfile 0.4%
Find a file
Exact
pilot 41cd0d330f
Some checks failed
go-ci / lint + build + test (pull_request) Successful in 53s
Details
manifest-check / manifest-vs-tag consistency (pull_request) Failing after 5s
Details
manifest-check / check (pull_request) Failing after 0s
Details
go-ci / lint + build + test (push) Successful in 1m28s
Details
Merge branch 'main' into release-toolkit/manifest-v0.4.0
2026-08-17 16:05:07 +02:00
.forgejo/workflows fixup: correct fragment name/shape and rename checkout step 2026-08-17 16:01:04 +02:00
changelog.d fixup: correct fragment name/shape and rename checkout step 2026-08-17 16:01:04 +02:00
cmd feat(store): purge expired bundles; state the 120 bits the backup claim rests on (#3) 2026-08-05 23:07:38 +02:00
docs feat(dashboard): choose a certificate's expiry at issue time (#18) 2026-08-06 15:19:21 +02:00
internal feat(dashboard): choose a certificate's expiry at issue time (#18) 2026-08-06 15:19:21 +02:00
scripts feat(deploy): restore the previous image AND tree when the probe fails (#32) 2026-08-06 12:11:25 +02:00
tests feat(deploy): restore the previous image AND tree when the probe fails (#32) 2026-08-06 12:11:25 +02:00
.gitignore feat: scaffold Go module layout, CI workflow, and changelog conventions 2026-08-05 06:53:39 +02:00
.release-toolkit-manifest.json chore(manifest): post-cut bookkeeping for v0.4.0 2026-08-17 13:39:34 +00:00
CHANGELOG.md docs(changelog): split two sentences over the density ceiling in the 0.4.0 section 2026-08-06 17:59:00 +02:00
Dockerfile fix(version): inject release tag via Dockerfile VERSION build-arg (#16) 2026-08-05 23:03:23 +02:00
go.mod wip(purser): step-ca client, PKCS#12 packaging, store, profile check, web surface 2026-08-05 17:27:51 +02:00
go.sum wip(purser): step-ca client, PKCS#12 packaging, store, profile check, web surface 2026-08-05 17:27:51 +02:00
README.md docs(ops): document dashboard password rotation 2026-08-06 15:10:43 +02:00
release-toolkit.yml chore(release): add release-toolkit.yml consumer config (#7) 2026-08-05 19:31:44 +02:00

README.md

purser

Purser manages VPN client certificates for the alcatraz OpenConnect (ocserv) server. It handles certificate issuance, revocation, and delivery via step-ca (JWK provisioner), replacing the hand-rolled issue-cert.sh / certtool CA workflow. See alcatraz-infra#422 for the design and deployment context.

Operational runbooks, including dashboard password rotation with cmd/hashpw, live in docs/operations.md.

Key types

Two distinct keys are involved — do not conflate them:

  • Subject certificate key: RSA-3072 by default, configurable. Every successful Secure Client connection on this VPN has used RSA-3072; the first ECDSA P-256 cert (step-ca's default when the CA changed) was also the first EXPIRED one.
  • Provisioner JWT signing key: EC P-256 / ES256 — this is the JWK provisioner key in step-ca and is fixed by the CA, not a Purser config field. The enrolment flow is JWK-signed JWT (one-time token), not SCEP.