sshca: First version of role

roles/sshca/files/signcert.sh

@@ -0,0 +1,26 @@
+#!/bin/sh
+
+set -eu
+
+umask 022
+
+if [ $# -ne 1 ]; then
+    echo "Usage: $(basename "$0") <pubkey>" 1>&2
+    exit 1
+fi
+
+_basedir="/srv/sshca"
+_name="$1"
+
+if ! echo "$_name" | grep -Eq '.foo.sh$'; then
+    echo "ERROR: Only '*.foo.sh' certificates are allowed" 1>&2
+    exit 1
+fi
+
+if [ ! -f "/srv/ansible/facts/${_name}" ]; then
+    echo "ERROR: Cannot find host '${_name}'" 1>&2
+    exit 1
+fi
+
+ssh-keygen -s "${_basedir}/ca/ca" -I "$_name" -n "$_name" -V -5m:+365d -h \
+    "${_basedir}/pubkeys/${_name}.pub"