mirror of
https://github.com/shankar0123/certctl.git
synced 2026-06-09 15:58:55 +00:00
Shankar
3ef6316457
Private keys never leave agent infrastructure. Agents generate ECDSA P-256 key pairs locally, store them with 0600 permissions, and submit only the CSR (public key) to the control plane. New AwaitingCSR job state pauses renewal/issuance jobs until the agent submits its CSR. Server-side keygen retained behind CERTCTL_KEYGEN_MODE=server for demo/development. Key changes: - Dual keygen mode via CERTCTL_KEYGEN_MODE (agent default, server for demo) - AwaitingCSR job state with CommonName/SANs in work response - Agent ECDSA P-256 keygen, local key storage, CSR-only submission - CompleteAgentCSRRenewal server-side flow for agent-submitted CSRs - DeploymentRequest.KeyPEM for agent-provided keys during deployment - Dockerfile.agent creates /var/lib/certctl/keys with correct ownership Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
66 lines
2.2 KiB
Go
66 lines
2.2 KiB
Go
package domain
|
|
|
|
import (
|
|
"encoding/json"
|
|
"time"
|
|
)
|
|
|
|
// Job represents a unit of work in the certificate control plane.
|
|
type Job struct {
|
|
ID string `json:"id"`
|
|
Type JobType `json:"type"`
|
|
CertificateID string `json:"certificate_id"`
|
|
TargetID *string `json:"target_id,omitempty"`
|
|
Status JobStatus `json:"status"`
|
|
Attempts int `json:"attempts"`
|
|
MaxAttempts int `json:"max_attempts"`
|
|
LastError *string `json:"last_error,omitempty"`
|
|
ScheduledAt time.Time `json:"scheduled_at"`
|
|
StartedAt *time.Time `json:"started_at,omitempty"`
|
|
CompletedAt *time.Time `json:"completed_at,omitempty"`
|
|
CreatedAt time.Time `json:"created_at"`
|
|
}
|
|
|
|
// JobType represents the classification of work to be performed.
|
|
type JobType string
|
|
|
|
const (
|
|
JobTypeIssuance JobType = "Issuance"
|
|
JobTypeRenewal JobType = "Renewal"
|
|
JobTypeDeployment JobType = "Deployment"
|
|
JobTypeValidation JobType = "Validation"
|
|
)
|
|
|
|
// JobStatus represents the execution state of a job.
|
|
type JobStatus string
|
|
|
|
const (
|
|
JobStatusPending JobStatus = "Pending"
|
|
JobStatusAwaitingCSR JobStatus = "AwaitingCSR"
|
|
JobStatusRunning JobStatus = "Running"
|
|
JobStatusCompleted JobStatus = "Completed"
|
|
JobStatusFailed JobStatus = "Failed"
|
|
JobStatusCancelled JobStatus = "Cancelled"
|
|
)
|
|
|
|
// DeploymentJob represents a job that deploys a certificate to a target via an agent.
|
|
type DeploymentJob struct {
|
|
Job `json:"job"`
|
|
AgentID string `json:"agent_id"`
|
|
DeploymentResult json.RawMessage `json:"deployment_result,omitempty"`
|
|
}
|
|
|
|
// WorkItem enriches a Job with target details so the agent knows which connector to use.
|
|
// Returned by GET /api/v1/agents/{id}/work.
|
|
type WorkItem struct {
|
|
ID string `json:"id"`
|
|
Type JobType `json:"type"`
|
|
CertificateID string `json:"certificate_id"`
|
|
CommonName string `json:"common_name,omitempty"`
|
|
SANs []string `json:"sans,omitempty"`
|
|
TargetID *string `json:"target_id,omitempty"`
|
|
TargetType string `json:"target_type,omitempty"`
|
|
TargetConfig json.RawMessage `json:"target_config,omitempty"`
|
|
Status JobStatus `json:"status"`
|
|
}
|