Keybase-SSH-CA

This image contains the Keybase and Keybase-sshca applications running on ubuntu linux.

What is Keybase SSH CA?

A bot!, a chat bot! Which you can use as a certificate authority to sign ssh keys for usage on your servers!
Easiest way to use it is via the kssh utility which is possible to download at the official repository.

Tags

Tags are based on the keybase-sshca version.
As of current releases, the versions contains part of the commit sha suffixed, every build will include that as a tag too: 1.0.0-7803a8d

Keybase-sshca is built from source and compiled for amd64 and arm64/aarch64.

Docker Hub

• jitesoft/keybase-sshca
  • latest, 1.1.0
  • latest-alpine, 1.1.0-alpine

GitLab

• registry.gitlab.com/jitesoft/dockerfiles/keybase-sshca
  • latest, 1.1.0
• registry.gitlab.com/jitesoft/dockerfiles/keybase-sshca/alpine
  • latest, 1.1.0

Quay.io

• quay.io/jitesoft/keybase-sshca
  • latest, 1.1.0
  • latest-alpine, 1.1.0-alpine

Dockerfile can be found at GitLab and GitHub.

Image labels

This image follows the Jitesoft image label specification 1.0.0.

Usage

For full documentation, check the Keybase SSH CA Bot documentation.

Startup of bot:

docker run -v $(pwd):/home/keybase/certificates jitesoft/keybase-sshca:1.0.0 

To fine-tune the container to work with your channels, a few environment variables are available:

TEAMS="list.of.teams,separated.by.a.comma"
CHAT_CHANNEL="list.of.teams#and-channel,separated.by.a.comma#channel"
KEYBASE_USERNAME="your-bot-username"             # I recommend that you create a new bot for this.
KEYBASE_PAPERKEY="Paperkey-for-bot"              # Possible to generate quickly via the keybase cli. 
KEYBASE_USERNAME_PATH="path-to-username-in-file" # File to use instead of above 'username' env variable. 
KEYBASE_PAPERKEY_PATH="path-to-paperkey-in-file" # As above, but for the paperkey.
CA_KEY_LOCATION="/home/keybase/ca-cert"          # Location where the key file should be or will be if generated by this image.
                                                 # Default is /home/keybase/ca-cert
KEY_EXPIRATION="+12h"                            # Expiration time (prefixed with + and sufixed with unit, such as d, h, m).
KEYBASE_SSHCA_LOG_DIR="/home/keybase/.cache/keybase" # Path to directory where the logs of the keybase-ssh-ca bot should be placed.
                                                # defaults to /home/keybase/.cache/keybase
                                                # Note: logs are also printed to stdout.
STRICT_LOGGING="false"                          # Sets the logging to strict or not strict. (true or false)
ANNOUNCEMENT=""                                 # A string/text that the bot will use to announce itself in a channel.
                                                # The following placeholders are available: {USERNAME}, {CURRENT_TEAM}, {TEAMS}.

Most notable are the KEYBASE_* prefixed user and paperkey variables, which either filepath or env type are required to exist to allow the bot to connect.
The Docker image will generate a set of ecdsa keys to use as ca keys in case you don't supply them yourself, and it might be worth to add a persistent volume for them so that they do not disappear after restart of the container.

Licenses

This repository and the files therein are released under the MIT license.
Keybase is released under the BSD 3-Clause "New" or "Revised" license.
Keybase-sshca is released under the BSD 3-Clause "New" or "Revised" license.