Documentation
¶
Overview ¶
Package setup is myownpki init (PHASE1 step 11): unseal passphrase, recovery key, auth key, the first user with TOTP and – optionally – an online test CA.
Rules:
- Everything is asked and confirmed first, then written in one go: an abort before that (wrong confirmation, Ctrl+C) leaves nothing behind.
- Files that hand out a secret (recovery key, otpauth, demo secrets) are written before the database refers to that secret.
- A run that broke off while writing is resumed by running init again: it proves the unseal passphrase and creates only the missing parts.
Index ¶
Constants ¶
const ( TestRootName = "root" TestIntermediateName = "issuing" )
Defaults of the test CA.
const DemoWarning = "DEMO instance – all secrets are in one file, do not use in production"
DemoWarning is logged at every start of a demo instance (step 12) and shown as a banner in the UI (step 14).
Variables ¶
var ( ErrInitialized = errors.New("this instance is initialized already") ErrAborted = errors.New("init aborted – nothing was written") ErrNeedsFile = errors.New("without a terminal the secrets need files") ErrSameSecret = errors.New("the admin password must differ from the unseal passphrase (also in upper/lower case) – they protect different things and must not fall together") ErrBaseURLEmpty = errors.New("the test CA needs a public base URL (for example http://pki.homelab.lan) – it is part of every certificate and can't be changed later") )
Errors.
Functions ¶
This section is empty.
Types ¶
type LineInput ¶
type LineInput struct {
// contains filtered or unexported fields
}
LineInput is the UI of init --stdin: every secret is the next line of standard input. Only the line end (\n or \r\n) is removed – spaces belong to the secret, also at its end (owner 2026-10-15).
func NewLineInput ¶
NewLineInput reads secrets from in and writes messages to out.
type Mode ¶
type Mode int
Mode is how init gets its input.
const ( // Interactive: a person at a terminal; secrets are typed hidden. Interactive Mode = iota + 1 // Stdin: automation – passphrase and password as two lines on standard // input; recovery key and TOTP go to files. Stdin // Demo: everything is generated and written to one file. For trying out // only: the instance is marked as a demo for good. Demo )
Modes.
type Options ¶
type Options struct {
Config config.Config
Mode Mode
AdminUser string // Stdin and Demo; Interactive asks
RecoveryKeyFile string // Stdin: required for a new key
OTPAuthFile string // Stdin: required for a new user
DemoSecretsFile string // Demo: "" = <data_dir>/init-demo-secrets.txt
WithCA bool // create the test CA without asking
CABaseURL string
Hostname string // O of the test CA; "" = os.Hostname
Clock clock.Clock // nil = clock.System
Rand io.Reader // nil = crypto/rand
Who keys.Who // the console operator
// contains filtered or unexported fields
}
Options are the command-line choices.
type Result ¶
type Result struct {
Resumed bool
CheckpointFingerprint string
CAs []string // created now
Warnings []string
DemoSecretsFile string
// Enrollment of the new user (interactive): the recovery codes to show
// at the end. nil when no user was created.
Enrollment *auth.Enrollment
}
Result is what init reports at the end.
type UI ¶
type UI interface {
// Printf writes a message.
Printf(format string, args ...any)
// ReadLine asks for a visible answer.
ReadLine(prompt string) (string, error)
// ReadSecret asks for a hidden answer (in Stdin mode: the next line).
ReadSecret(prompt string) ([]byte, error)
}
UI is the console. Tests script it.