starred/certforge
1
0
Fork 0
mirror of https://github.com/rkivalin/certforge.git synced 2026-10-22 00:01:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add custom file permissions for key and certificate files

Browse Source 
Support key_mode, key_owner, key_group and cert_mode, cert_owner,
cert_group per certificate. Mode is an octal string (e.g. "0640"),
owner/group are resolved by name via getpwnam/getgrnam.

Permissions are checked before applying — system calls are only made
when the current state differs from the desired state, and changes
are logged. Runs on every renew for existing files, not just when
certificates are renewed. Defaults: key 0600, cert 0644, owner/group
unchanged.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Roman Kivalin
2026-04-17 21:03:59 +02:00
co-authored by Claude Opus 4.6
parent aeb17eef08
commit c717da348a
10 changed files with 211 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
examples/config.toml
+6
View File
@@ -81,7 +81,13 @@ dns = "main" # references [dns.main]
# key_type = "ecdsa-p256" # ecdsa-p256, ecdsa-p384
# key_credential = "/etc/credstore.encrypted/mail-tls-key"
# # key_path = "/etc/certforge/keys/mail.key"
# # key_mode = "0640" # file mode (default: 0600)
# # key_owner = "root" # file owner (default: unchanged)
# # key_group = "postfix" # file group (default: unchanged)
# cert_path = "/etc/certforge/certs/mail.pem"
# # cert_mode = "0644" # file mode (default: 0644)
# # cert_owner = "root"
# # cert_group = "postfix"
# renew_before_days = 30
# rotate_key = false
# # Named hooks (deduplicated if multiple certs reference the same hook)