frankenbit/purser
Watch
17
0
Fork
You've already forked purser
 0
Code Issues 7 Pull requests Projects Releases 4 Packages Wiki Activity Actions
Purser — VPN client-certificate issuance, revocation and delivery dashboard (step-ca)
72 commits 27 branches 4 tags 1,016 KiB
  • Go 78.3%
  • Shell 21.3%
  • Dockerfile 0.4%
Find a file
Exact
Repository files (latest commit first)
Filename Latest commit message Latest commit date
release-bot 611af9c0d8
All checks were successful
go-ci / lint + build + test (push) Successful in 51s
Details
chore(manifest): post-cut bookkeeping for v0.4.1 
Direct-pushed under path (alpha) per ADR-0007 (release-bot identity).

Tracker: frankenbit/release-toolkit#52
2026-10-05 22:18:11 +00:00
.forgejo/workflows chore(ci): run the release-toolkit PR gates from one pr.yml at v0.66.0 2026-10-05 21:33:18 +02:00
changelog.d chore(release): prepare v0.4.1 2026-10-05 21:53:34 +00:00
cmd feat(store): purge expired bundles; state the 120 bits the backup claim rests on (#3) 2026-08-05 23:07:38 +02:00
docs feat(dashboard): choose a certificate's expiry at issue time (#18) 2026-08-06 15:19:21 +02:00
internal feat(dashboard): choose a certificate's expiry at issue time (#18) 2026-08-06 15:19:21 +02:00
scripts feat(deploy): restore the previous image AND tree when the probe fails (#32) 2026-08-06 12:11:25 +02:00
tests feat(deploy): restore the previous image AND tree when the probe fails (#32) 2026-08-06 12:11:25 +02:00
.gitignore feat: scaffold Go module layout, CI workflow, and changelog conventions 2026-08-05 06:53:39 +02:00
.release-toolkit-manifest.json chore(manifest): post-cut bookkeeping for v0.4.1 2026-10-05 22:18:11 +00:00
CHANGELOG.md chore(release): prepare v0.4.1 2026-10-05 21:53:34 +00:00
Dockerfile fix(version): inject release tag via Dockerfile VERSION build-arg (#16) 2026-08-05 23:03:23 +02:00
go.mod wip(purser): step-ca client, PKCS#12 packaging, store, profile check, web surface 2026-08-05 17:27:51 +02:00
go.sum wip(purser): step-ca client, PKCS#12 packaging, store, profile check, web surface 2026-08-05 17:27:51 +02:00
README.md docs(ops): document dashboard password rotation 2026-08-06 15:10:43 +02:00
release-toolkit.yml chore(ci): run the release-toolkit PR gates from one pr.yml at v0.66.0 2026-10-05 21:33:18 +02:00

README.md

purser

Purser manages VPN client certificates for the alcatraz OpenConnect (ocserv) server. It handles certificate issuance, revocation, and delivery via step-ca (JWK provisioner), replacing the hand-rolled issue-cert.sh / certtool CA workflow. See alcatraz-infra#422 for the design and deployment context.

Operational runbooks, including dashboard password rotation with cmd/hashpw, live in docs/operations.md.

Key types

Two distinct keys are involved — do not conflate them:

  • Subject certificate key: RSA-3072 by default, configurable. Every successful Secure Client connection on this VPN has used RSA-3072; the first ECDSA P-256 cert (step-ca's default when the CA changed) was also the first EXPIRED one.
  • Provisioner JWT signing key: EC P-256 / ES256 — this is the JWK provisioner key in step-ca and is fixed by the CA, not a Purser config field. The enrolment flow is JWK-signed JWT (one-time token), not SCEP.