signstar-configure-build(1)

📦 version 0.4.1, in arch rolling

💅 NAME 💅

signstar-configure-build — a command-line interface for Signstar image build configuration, and honestly she's the main character of your build process 🎀

(This one lives in the General Commands Manual, section 1, iykyk.)

✨ SYNOPSIS ✨

signstar-configure-build [-c|--config] [-v|--verbose]... [-q|--quiet]...
[-h|--help] [-V|--version]

🌸 DESCRIPTION 🌸

Okay so, bestie, listen: this is a command-line interface for Signstar image build configuration. That's the whole vibe.

⚠️ NOTE: This command must be run as root! No cap. Like, actually root. Don't try to be cute about it 💀

This executable is meant to be used to configure relevant system users of a Signstar system during build. It creates system users and their whole integration setup, all based on a central configuration file. Very "one file to rule them all" of it 🫶

By default, one of the following configuration files is used — if it exists — in this exact order:

  • /usr/local/share/signstar/config.toml
  • /run/signstar/config.toml
  • /etc/signstar/config.toml

If none of the above are found, the default location /usr/share/signstar/config.toml is used. Alternatively, a custom configuration file location can be specified using the --config / -c option. Slay, options ✨

System users, if they don't exist already, are created with the help of useradd. They're created without a passphrase and set up with a home below /var/lib/signstar/home/. However — and this is the plot twist — their home directory is not created automatically 🙈 The system user accounts are then unlocked with the help of usermod. For each system user a tmpfiles.d integration is provided below /usr/lib/tmpfiles.d, so their home directory can be created automatically. Iconic delegation, honestly 👑

If the configuration file you're using associates the system user with SSH public keys, a dedicated authorized_keys file containing the SSH public keys for the user is created below /etc/ssh/. Additionally, an sshd_config drop-in configuration is created below /etc/ssh/sshd_config.d/. This sshd_config drop-in configuration enforces the use of the user's authorized_keys and the use of a specific command depending on the user's role — one of:

  • signstar-download-backup
  • signstar-download-key-certificates
  • signstar-download-metrics
  • signstar-shareholder
  • signstar-download-wireguard
  • signstar-sign
  • signstar-upload-backup
  • signstar-upload-update

Security? Locked down. Vibes? Immaculate. Periodt 💅

🦋 OPTIONS 🦋

  • -c, --config <CONFIG> — the path to a custom configuration file 💖 If specified, the custom configuration file is used instead of the default configuration file location.

If unspecified, one of the following configuration files is used if it exists, in the following order:

  • /usr/local/share/signstar/config.toml
  • /run/signstar/config.toml
  • /etc/signstar/config.toml

If none of the above are found, the default location /usr/share/signstar/config.toml is used. May also be specified with the SIGNSTAR_CONFIG environment variable 👀

  • -v, --verbose — increase logging verbosity 🗣️ (yes you can stack it, she's greedy like that)
  • -q, --quiet — decrease logging verbosity 🤫 (also stackable, shhh)
  • -h, --help — print help (see a summary with -h) 🥺
  • -V, --version — print version 🏷️

⭐ VERSION ⭐

v0.4.1

aaaand that's the whole page! 🍓 sign-off time: this was signstar-configure-build 0.signstar-configure-build(1) — version v0.4.1, and she ate, no crumbs left. Go configure those builds bestie, and remember: root only 💜🌈🧚

📦 where this page comes from