From b7a20f94b625908cba923a9b9d2db9540dd53594 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Thu, 24 Sep 2026 21:49:41 +1000 Subject: [PATCH] Allow IP and short-hostname principals on the sshca signhost role --- config/ssh_secret_backend_role/sshca/signhost.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/config/ssh_secret_backend_role/sshca/signhost.yaml b/config/ssh_secret_backend_role/sshca/signhost.yaml index fc8c1e5..2a7db8d 100644 --- a/config/ssh_secret_backend_role/sshca/signhost.yaml +++ b/config/ssh_secret_backend_role/sshca/signhost.yaml @@ -3,6 +3,8 @@ algorithm_signer: rsa-sha2-256 ttl: 315360000 # 87600 * 3600 allow_host_certificates: true allow_user_certificates: false -allowed_domains: "unkin.net,main.unkin.net,consul" +# "*" must be the sole entry: OpenBao only treats allowed_domains as unrestricted +# when the whole string is "*", and otherwise matches entries exactly or by suffix. +allowed_domains: "*" allow_subdomains: true allow_bare_domains: false -- 2.47.3