49 lines
1.7 KiB
Plaintext
49 lines
1.7 KiB
Plaintext
# Example keystore for regauth.
|
|
# Copy to keystore.yaml and adjust. Do not commit keystore.yaml itself:
|
|
# it contains PRIVATE keys.
|
|
#
|
|
# keystore.yaml is the single source of truth for v2 and v3 keys.
|
|
# public-v2.key (PEM) and public-v3.key (JWKS) are derived from it and
|
|
# recreated on every start / keystore operation. Loss of public-*.key is
|
|
# not fatal: they are rebuilt from the keystore.
|
|
#
|
|
# v2: exactly one key. `keystore rotate-v2` replaces it. v2 has no revocation:
|
|
# old tokens stop verifying after the registry reloads rootcertbundle.
|
|
# v3: list of keys; exactly one has current: true; revoked keys have no private.
|
|
|
|
v2:
|
|
created_at: "2026-01-01T00:00:00Z"
|
|
private: |
|
|
-----BEGIN RSA PRIVATE KEY-----
|
|
REPLACE_WITH_REAL_V2_PRIVATE_KEY
|
|
-----END RSA PRIVATE KEY-----
|
|
|
|
v3:
|
|
keys:
|
|
# Current signing key. Used by `regauth server` to sign tokens.
|
|
- kid: "JLZL:JSL7:CJ5G:L7XU:COL3:YIRE:VLIM:HVTL:3LM6:4PX4:SUWN:RQKZ"
|
|
created_at: "2026-01-01T00:00:00Z"
|
|
current: true
|
|
revoked: false
|
|
private: |
|
|
-----BEGIN RSA PRIVATE KEY-----
|
|
REPLACE_WITH_REAL_V3_PRIVATE_KEY
|
|
-----END RSA PRIVATE KEY-----
|
|
|
|
# Old key: kept for verifying tokens issued before rotation.
|
|
- kid: "ABCD:EFGH:IJKL:MNOP:QRST:UVWX:YZ23:4567:ABCD:EFGH:IJKL:MNOP"
|
|
created_at: "2025-12-01T00:00:00Z"
|
|
current: false
|
|
revoked: false
|
|
private: |
|
|
-----BEGIN RSA PRIVATE KEY-----
|
|
REPLACE_WITH_REAL_V3_PRIVATE_KEY
|
|
-----END RSA PRIVATE KEY-----
|
|
|
|
# Revoked key: no longer in JWKS, private key wiped.
|
|
- kid: "ZZZZ:YYYY:XXXX:WWWW:VVVV:UUUU:TTTT:SSSS:RRRR:QQQQ:PPPP:OOOO"
|
|
created_at: "2025-11-01T00:00:00Z"
|
|
current: false
|
|
revoked: true
|
|
private: ""
|