Module ssh 

SSH support for sandbox access.

When --ssh is enabled, sandboxes get an sshd configured for certificate-only authentication. Vault or a local CA signs ephemeral client certificates.

Structs

SshConfig

SSH configuration for a sandbox

Functions

generate_ca_keypair

Generate an ed25519 CA keypair for the built-in (non-Vault) path.

generate_client_keypair

Generate an ephemeral ed25519 client keypair.

generate_sshd_config

Generate an sshd_config string for certificate-only authentication.

get_vault_ca_public_key

Fetch the CA public key from Vault’s SSH secrets engine.

parse_ttl_to_secs

Parse a TTL string (e.g. “30m”, “1h”, “5m”, “2h30m”) to seconds.

sign_client_key

Convenience wrapper that routes to Vault or local signing based on config.

sign_client_key_local

Sign a client public key with a local CA private key.

sign_client_key_vault

Sign a client public key via Vault SSH secrets engine.

sshd_file_injections

Build the list of files to inject into the sandbox for SSH support.