starred/certforge
1
0
Fork 0
mirror of https://github.com/rkivalin/certforge.git synced 2026-10-18 00:00:51 +00:00
Code Issues Packages Projects Releases Wiki Activity
22 Commits 1 Branch 10 Tags
252c2967fdf5e488d3aadf52c6476ec64e8af39a
Commit Graph
4 Commits
Author SHA1 Message Date
Roman KivalinandClaude Opus 4.6 0726e829a9 Add HMAC-SHA-384 TSIG support, document HMAC-SHA-512 truncation limitation 
BIND 9.18+ truncates HMAC-SHA-512 MACs by default, and hickory-dns
does not support verifying truncated HMACs. Document the workaround
(use hmac-sha256) and add hmac-sha384 as an additional option.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-13 20:35:12 +02:00
Roman KivalinandClaude Opus 4.6 da8c937782 Refactor config: named DNS clients, challenge solvers, per-domain solver assignment 
Breaking config change. The DNS and challenge configuration is now
structured around named, reusable components:

- [dns.*] named DNS client connections with explicit zone field
- [solver.*] challenge solvers (dns-01, http-01, tls-alpn-01)
- Certificates reference solvers by name (solver/solvers fields)
- DANE blocks reference DNS clients by name (dns field)
- Removed automatic zone detection heuristics
- Added default_solver for global fallback
- Validation: DNS-01 rejected for IP addresses, solver/solvers
  mutual exclusivity, length matching, reference integrity

HTTP-01 and TLS-ALPN-01 solver implementations to follow.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-13 19:15:01 +02:00
Roman KivalinandClaude Opus 4.6 1c517ecbab Add packaging, CI, and license 
- MIT license
- Arch Linux PKGBUILD
- Debian packaging (debian/)
- GitHub Actions: CI (test + clippy) and release workflow
  builds x86_64 + aarch64 binaries, Arch and Debian packages
- Default config is now no-op (certificate blocks commented out)
- Fix clippy warnings (collapsible ifs, redundant closures)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-12 20:47:00 +02:00
Roman KivalinandClaude Opus 4.6 c1fdfba3fe Initial implementation of certforge ACME certificate manager 
Rust CLI tool for automated ACME certificate management with:
- DNS-01 challenge via RFC 2136 dynamic DNS updates with TSIG auth
- DANE TLSA record publication (RFC 6698/7671/7672)
- systemd credential integration (systemd-creds encrypt/decrypt)
- systemd unit management via D-Bus (zbus)
- Post-renewal hooks (systemctl reload/restart, arbitrary commands)
- Key rotation with DANE pre-publication protocol
- TOML configuration with per-zone DNS overrides

Tested against Let's Encrypt staging. 12 unit tests, zero warnings.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-12 20:07:27 +02:00