Kyle Isom
ae4cc8b420
Templates linked to /v1/ API server routes which don't exist on the web server (separate binary). Add web server handlers that fetch data via gRPC and serve the downloads directly. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
217 lines
8.7 KiB
HTML
217 lines
8.7 KiB
HTML
{{define "title"}} - SSH CA: {{.MountName}}{{end}}
|
|
{{define "content"}}
|
|
<div class="page-header">
|
|
<h2>SSH CA: {{.MountName}}</h2>
|
|
<div class="page-meta">
|
|
<a href="/dashboard">← Dashboard</a>
|
|
</div>
|
|
</div>
|
|
|
|
{{if .Error}}<div class="error">{{.Error}}</div>{{end}}
|
|
|
|
<div class="card">
|
|
<div class="card-title">CA Public Key</div>
|
|
{{if .CAPublicKey}}
|
|
<textarea rows="3" class="pem-input" readonly>{{.CAPublicKey}}</textarea>
|
|
<p style="margin-top: 0.5rem; margin-bottom: 0;">
|
|
<a href="/sshca/ca" download="ca.pub">Download CA Public Key</a>
|
|
</p>
|
|
{{else}}
|
|
<p>CA public key not available.</p>
|
|
{{end}}
|
|
</div>
|
|
|
|
<div class="card">
|
|
<div class="card-title">Sign User Certificate</div>
|
|
{{if .SignUserResult}}
|
|
<div class="success">
|
|
<p>User certificate signed. Serial: <code>{{.SignUserResult.Serial}}</code> — Expires: {{.SignUserResult.ExpiresAt}}</p>
|
|
<div class="form-group">
|
|
<label>Certificate</label>
|
|
<textarea rows="6" class="pem-input" readonly>{{.SignUserResult.CertData}}</textarea>
|
|
</div>
|
|
</div>
|
|
{{else}}
|
|
<form method="post" action="/sshca/sign-user">
|
|
{{csrfField}}
|
|
<div class="form-row">
|
|
<div class="form-group">
|
|
<label for="sign_user_profile">Profile</label>
|
|
<select id="sign_user_profile" name="profile">
|
|
<option value="">(default)</option>
|
|
{{range .Profiles}}<option value="{{.Name}}">{{.Name}}</option>{{end}}
|
|
</select>
|
|
</div>
|
|
<div class="form-group">
|
|
<label for="sign_user_ttl">TTL <small style="text-transform:none;letter-spacing:0;">(optional)</small></label>
|
|
<input type="text" id="sign_user_ttl" name="ttl" placeholder="24h">
|
|
</div>
|
|
</div>
|
|
<div class="form-group">
|
|
<label for="sign_user_key">Public Key <small style="text-transform:none;letter-spacing:0;">(authorized_keys format)</small></label>
|
|
<textarea id="sign_user_key" name="public_key" rows="3" class="pem-input" placeholder="ssh-ed25519 AAAA..." required></textarea>
|
|
</div>
|
|
<div class="form-group">
|
|
<label for="sign_user_principals">Principals <small style="text-transform:none;letter-spacing:0;">(one per line, blank = your username)</small></label>
|
|
<textarea id="sign_user_principals" name="principals" rows="2" placeholder="kyle"></textarea>
|
|
</div>
|
|
<div class="form-actions">
|
|
<button type="submit">Sign User Certificate</button>
|
|
</div>
|
|
</form>
|
|
{{end}}
|
|
</div>
|
|
|
|
<div class="card">
|
|
<div class="card-title">Sign Host Certificate</div>
|
|
{{if .SignHostResult}}
|
|
<div class="success">
|
|
<p>Host certificate signed. Serial: <code>{{.SignHostResult.Serial}}</code> — Expires: {{.SignHostResult.ExpiresAt}}</p>
|
|
<div class="form-group">
|
|
<label>Certificate</label>
|
|
<textarea rows="6" class="pem-input" readonly>{{.SignHostResult.CertData}}</textarea>
|
|
</div>
|
|
</div>
|
|
{{else}}
|
|
<form method="post" action="/sshca/sign-host">
|
|
{{csrfField}}
|
|
<div class="form-row">
|
|
<div class="form-group">
|
|
<label for="sign_host_hostname">Hostname</label>
|
|
<input type="text" id="sign_host_hostname" name="hostname" placeholder="server.example.com" required>
|
|
</div>
|
|
<div class="form-group">
|
|
<label for="sign_host_ttl">TTL <small style="text-transform:none;letter-spacing:0;">(optional)</small></label>
|
|
<input type="text" id="sign_host_ttl" name="ttl" placeholder="720h">
|
|
</div>
|
|
</div>
|
|
<div class="form-group">
|
|
<label for="sign_host_key">Public Key <small style="text-transform:none;letter-spacing:0;">(authorized_keys format)</small></label>
|
|
<textarea id="sign_host_key" name="public_key" rows="3" class="pem-input" placeholder="ssh-ed25519 AAAA..." required></textarea>
|
|
</div>
|
|
<div class="form-actions">
|
|
<button type="submit">Sign Host Certificate</button>
|
|
</div>
|
|
</form>
|
|
{{end}}
|
|
</div>
|
|
|
|
<div class="card">
|
|
<div class="card-title">Signing Profiles</div>
|
|
{{if .Profiles}}
|
|
<div class="table-wrapper">
|
|
<table>
|
|
<thead>
|
|
<tr>
|
|
<th>Name</th>
|
|
<th>Actions</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
{{range .Profiles}}
|
|
<tr>
|
|
<td><a href="/sshca/profile/{{.Name}}">{{.Name}}</a></td>
|
|
<td><a href="/sshca/profile/{{.Name}}">View</a></td>
|
|
</tr>
|
|
{{end}}
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
{{else}}
|
|
<p>No signing profiles configured.</p>
|
|
{{end}}
|
|
|
|
{{if .IsAdmin}}
|
|
<details style="margin-top: 1rem;">
|
|
<summary>Create Profile</summary>
|
|
<form method="post" action="/sshca/profile/create">
|
|
{{csrfField}}
|
|
<div class="form-row">
|
|
<div class="form-group">
|
|
<label for="profile_name">Name</label>
|
|
<input type="text" id="profile_name" name="name" placeholder="engineering" required>
|
|
</div>
|
|
<div class="form-group">
|
|
<label for="profile_max_ttl">Max TTL</label>
|
|
<input type="text" id="profile_max_ttl" name="max_ttl" placeholder="8760h">
|
|
</div>
|
|
</div>
|
|
<div class="form-group">
|
|
<label for="profile_principals">Allowed Principals <small style="text-transform:none;letter-spacing:0;">(one per line, blank = any)</small></label>
|
|
<textarea id="profile_principals" name="allowed_principals" rows="2" placeholder="*"></textarea>
|
|
</div>
|
|
<div class="form-group">
|
|
<label>Extensions</label>
|
|
<div class="checkbox-group">
|
|
<label class="checkbox-label"><input type="checkbox" name="extensions" value="permit-pty" checked> permit-pty</label>
|
|
<label class="checkbox-label"><input type="checkbox" name="extensions" value="permit-agent-forwarding"> permit-agent-forwarding</label>
|
|
<label class="checkbox-label"><input type="checkbox" name="extensions" value="permit-port-forwarding"> permit-port-forwarding</label>
|
|
<label class="checkbox-label"><input type="checkbox" name="extensions" value="permit-X11-forwarding"> permit-X11-forwarding</label>
|
|
<label class="checkbox-label"><input type="checkbox" name="extensions" value="permit-user-rc"> permit-user-rc</label>
|
|
</div>
|
|
</div>
|
|
<details>
|
|
<summary>Critical Options</summary>
|
|
<div class="form-row">
|
|
<div class="form-group">
|
|
<label for="profile_force_cmd">Force Command</label>
|
|
<input type="text" id="profile_force_cmd" name="force_command" placeholder="(none)">
|
|
</div>
|
|
<div class="form-group">
|
|
<label for="profile_source_addr">Source Address</label>
|
|
<input type="text" id="profile_source_addr" name="source_address" placeholder="(none)">
|
|
</div>
|
|
</div>
|
|
</details>
|
|
<div class="form-actions">
|
|
<button type="submit">Create Profile</button>
|
|
</div>
|
|
</form>
|
|
</details>
|
|
{{end}}
|
|
</div>
|
|
|
|
<div class="card">
|
|
<div class="card-title">Certificates</div>
|
|
{{if .Certs}}
|
|
<div class="table-wrapper">
|
|
<table>
|
|
<thead>
|
|
<tr>
|
|
<th>Serial</th>
|
|
<th>Type</th>
|
|
<th>Key ID</th>
|
|
<th>Principals</th>
|
|
<th>Issued By</th>
|
|
<th>Expires</th>
|
|
<th></th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
{{range .Certs}}
|
|
<tr>
|
|
<td><a href="/sshca/cert/{{.Serial}}"><code>{{.Serial}}</code></a></td>
|
|
<td>{{.CertType}}</td>
|
|
<td>{{.KeyID}}</td>
|
|
<td>{{.Principals}}</td>
|
|
<td>{{.IssuedBy}}</td>
|
|
<td>{{.ExpiresAt}}</td>
|
|
<td>{{if .Revoked}}<span class="badge badge-danger">revoked</span>{{end}}</td>
|
|
</tr>
|
|
{{end}}
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
{{else}}
|
|
<p>No certificates issued.</p>
|
|
{{end}}
|
|
</div>
|
|
|
|
{{if .IsAdmin}}
|
|
<div class="card">
|
|
<div class="card-title">Key Revocation List</div>
|
|
<p><a href="/sshca/krl" download="krl.bin">Download KRL</a></p>
|
|
</div>
|
|
{{end}}
|
|
{{end}}
|