feat(security): instance CA + service identity certs (M1)

- lib/pki: root CA provisioning on first run (~/.dcntrlized/pki/), per-service
  leaf identity issuance (90d, refreshed at start), revocation with CRL
- main: EnsureCA on startup
- start: inject CA + identity mounts and AUTH_* mTLS env into compose services
- uninstall: revoke the service's cert (CRL entry published)

This commit is contained in:

Admin

2026-08-15 23:10:12 +01:00

parent a172b542b7

commit dc79629c7e

13 changed files with 992 additions and 1 deletions

src/lib/pki/logs/warn.log

View File

@@ -0,0 +1,3 @@
 ========== Start Log ==========
 [INFO] Logger initialized
 [2026-08-15T23:09:40+01:00]