Playbook for certificates updates #9

New Issue

2026-09-14T15:03:32+04:00

max commented

2026-09-14 15:03:32 +04:00

Possible implementation

The best way to do it is to push certificates from VPS to a dedicated machine (super small LXC container with Alpine, wireguard and rsync). Then the client which wants the certificate pulls it from that machine. This way that dedicated machine becomes a dead-end for an attacker. They can get access to this machine from VPS, that's it. All other machines pull the data from there, but the machine itself can't log in to other clients. Moreover, it's a good idea to have a centralized source of truth for such things.

## Possible implementation The best way to do it is to push certificates from VPS to a dedicated machine (super small LXC container with Alpine, wireguard and rsync). Then the client which wants the certificate pulls it from that machine. This way that dedicated machine becomes a dead-end for an attacker. They can get access to this machine from VPS, that's it. All other machines pull the data from there, but the machine itself can't log in to other clients. Moreover, it's a good idea to have a centralized source of truth for such things.

max added the enhancement label 2026-09-14 15:03:32 +04:00

max referenced a pull request that will close this issue

2026-09-14 16:59:24 +04:00

Update crt play #18

max closed this issue

2026-09-14 17:00:42 +04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: max/vmn-ansible#9