sample_server_config.proto

##### SERVER CONFIGURATION

# Path to the SSH CA private key, e.g. ssh-keygen -t rsa -b 4096 -C "My CA" -N "" -f /path/to/ssh-ca
ca_key_path: "/path/to/ssh-ca"

# Port to listen for gRPC requests on (HTTP/2).
listen_port: 10000

# TLS cert / key to use, e.g. openssl req -x509 -newkey rsa:4096 -keyout /path/to/grpc-key.pem -out /path/to/grpc-cert.pem -days 3600 -nodes -subj '/CN=localhost' -batch
server_cert_path: "/path/to/grpc-key.pem"
server_key_path: "/path/to/grpc-cert.pem"


##### ID TOKEN VALIDATION

# Hosted domain allowed for ID token validation
allowed_domain_for_id_token: "example.com"

# Allowed client ID registered with Google: https://console.developers.google.com/
allowed_client_id_for_id_token: "xxxxxxxxxx.apps.googleusercontent.com"


##### GENERATED SSH CONFIG OPTIONS

# Appears as comment in the known_hosts
ca_comment: "ORGNAME-CA"

user_profiles: <
    key: "admin"
    value: <
        principals: "ec2-user"
        cert_permissions: <key: "permit-pty">
        cert_permissions: <key: "permit-port-forwarding">
        ssh_config_lines: "Host *.example.com"
        ssh_config_lines: "    User ec2-user"
        ssh_config_lines: "    IdentityFile $CERTNAME" # client updates
        ssh_config_lines: "    PasswordAuthentication no"
        ssh_config_lines: "    Port 12345"
        ssh_config_lines: "    StrictHostKeyChecking yes"
        known_hosts: "*.example.com"
    >
>


##### CERTIFICATE GENERATION OPTIONS

# TTL for each certificate. Since certs are not revokable, keep short.
generate_cert_duration_seconds: 86400

# Create an entry for each allowed user, where the key is the email address
# as validated by the Google ID token.
allowed_users: <
    key: "username@yourdomain.com"
    value: <
        profiles: "admin"
    >
>
allowed_users: <
    key: "otheruser@yourdomain.com"
    value: <
        profiles: "admin"
    >
>

# Uncomment the following if you wish to issue host certificates
# http_listen_port: 10001 # port to listen to HTTP requests on
# allowed_hosts: "*.yourdomain.com" # list of glob hostnames that you will issue certs for
# caddy_file_path: "/path/to/sample_caddy_file" # edit the sample_caddy_file