From 2e412e6448f7cbbd1817fb059eb2aa04ad029201 Mon Sep 17 00:00:00 2001
From: Claude Bot <claude-bot@renner.uno>
Date: Tue, 27 Oct 2026 09:39:19 +0100
Subject: [PATCH] feat(openbao): SSH client CA roles for owner and claude-bot

Phase 1 of the SSH CA. The ssh-client-signer mount and its ed25519 CA
were set up by hand (root token); this records the roles and the
claude-bot signing policy.

- role owner: principal k.renner, 6-month certs. The mount was enabled
  with -max-lease-ttl=4380h; the 768h system default would cap it.
- role claude: principal claude-bot, 1h certs, pty only.
- policy ssh-sign-claude for the claude-bot userpass user, next to its
  existing claude-bot-write.

Verified: a YubiKey sk-ssh-ed25519 key signed on role owner yields a
sk-ssh-ed25519-cert-v01 cert, principal k.renner, valid to 2027-04-27.
CA fingerprint SHA256:xEhuqxqFVZ/ig6KpAtHOhLbwsIhyWpzXhvDcjIfM/Js,
served unauthenticated at /v1/ssh-client-signer/public_key.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../openbao/policies/ssh-sign-claude.hcl           | 10 ++++++++++
 .../infrastructure/openbao/ssh-ca/role-claude.json | 12 ++++++++++++
 .../infrastructure/openbao/ssh-ca/role-owner.json  | 14 ++++++++++++++
 3 files changed, 36 insertions(+)
 create mode 100644 kubernetes/infrastructure/openbao/policies/ssh-sign-claude.hcl
 create mode 100644 kubernetes/infrastructure/openbao/ssh-ca/role-claude.json
 create mode 100644 kubernetes/infrastructure/openbao/ssh-ca/role-owner.json

diff --git a/kubernetes/infrastructure/openbao/policies/ssh-sign-claude.hcl b/kubernetes/infrastructure/openbao/policies/ssh-sign-claude.hcl
new file mode 100644
index 00000000..b7b1eb2a
--- /dev/null
+++ b/kubernetes/infrastructure/openbao/policies/ssh-sign-claude.hcl
@@ -0,0 +1,10 @@
+# OpenBao policy: ssh-sign-claude
+# Sign claude-bot's SSH public key on ssh-client-signer role claude (1h certs). Attached to userpass user claude-bot. NOT applied by Flux.
+#
+#   bao write ssh-client-signer/roles/claude @kubernetes/infrastructure/openbao/ssh-ca/role-claude.json
+#   bao policy write ssh-sign-claude kubernetes/infrastructure/openbao/policies/ssh-sign-claude.hcl
+#   bao write auth/userpass/users/claude-bot token_policies=claude-bot-write,ssh-sign-claude
+
+path "ssh-client-signer/sign/claude" {
+  capabilities = ["update"]
+}
diff --git a/kubernetes/infrastructure/openbao/ssh-ca/role-claude.json b/kubernetes/infrastructure/openbao/ssh-ca/role-claude.json
new file mode 100644
index 00000000..9ed47629
--- /dev/null
+++ b/kubernetes/infrastructure/openbao/ssh-ca/role-claude.json
@@ -0,0 +1,12 @@
+{
+  "key_type": "ca",
+  "allow_user_certificates": true,
+  "allowed_users": "claude-bot",
+  "default_user": "claude-bot",
+  "allowed_extensions": "permit-pty",
+  "default_extensions": {
+    "permit-pty": ""
+  },
+  "ttl": "1h",
+  "max_ttl": "1h"
+}
diff --git a/kubernetes/infrastructure/openbao/ssh-ca/role-owner.json b/kubernetes/infrastructure/openbao/ssh-ca/role-owner.json
new file mode 100644
index 00000000..998cec49
--- /dev/null
+++ b/kubernetes/infrastructure/openbao/ssh-ca/role-owner.json
@@ -0,0 +1,14 @@
+{
+  "key_type": "ca",
+  "allow_user_certificates": true,
+  "allowed_users": "k.renner",
+  "default_user": "k.renner",
+  "allowed_extensions": "permit-pty,permit-port-forwarding,permit-agent-forwarding,permit-user-rc",
+  "default_extensions": {
+    "permit-pty": "",
+    "permit-port-forwarding": "",
+    "permit-user-rc": ""
+  },
+  "ttl": "4380h",
+  "max_ttl": "4380h"
+}
-- 
2.54.0