superconfig/configs/dns/ at 5d83889b04e96dadb0de94a9a4abfa341b4f5be1 · lass.pds.lassul.us/superconfig · Tangled

lass.pds.lassul.us / superconfig

0

This repository has no description

0

superconfig / configs / dns

2 files

at 5d83889b04e96dadb0de94a9a4abfa341b4f5be1

Hermes configs.byoidc: init on neoprism (byoidc.lassul.us) 3d ago

configs.crit: public https://<id>.review.lassul.us per review The crit wrapper writes a fresh random 10-char id per daemon port into /var/lib/crit-routes; a path unit turns that into an nginx map on coaxmetal:7720 (retiolum only). neoprism proxies *.review.lassul.us there with a wildcard cert obtained via DNS-01 (RFC2136) against a delegated _acme-challenge.review.lassul.us zone on knot, so ids never hit CT logs.

6 days ago

configs.byoidc: init on neoprism (byoidc.lassul.us) byoidc lets people sign in with their own OpenID provider; Zitadel will offer it as one generic OIDC IdP. The downstream client "zitadel" gets its secret from a prompt-less clan var, which root-owned is fine for both byoidc (LoadCredential) and zitadel-reconcile (root). Its state (cached upstream clients, signing key) is not backed up: subjects are derived from issuer and upstream sub, a new signing key is picked up through JWKS, and upstream clients are registered again on demand.

3 days ago