zorin-ops

Zorin Ops is the local infrastructure control plane built on Zorin Trust. It combines OpenSSH transport, owner-approved short-lived credentials, server inventory and narrow operational actions without storing a standing user SSH private key in Ops state.

0.3

Per-server authentication mode: existing OpenSSH config/agent or zorin-cert.
Zorin certificate mode generates a fresh ephemeral Ed25519 keypair and asks Zorin Authority for a phone-approved OpenSSH user certificate valid for 1–5 minutes.
The private half of the ephemeral key never leaves the local temporary credential directory and is removed when the credential expires, changes target, or the server entry is changed/deleted.
Server bootstrap can install/update the bundled zorin-node for Linux amd64/arm64 through existing SSH after an explicit phone approval.
SSH CA enrollment is a separate phone-approved action. It uses Zorin Node’s validated/rollback-capable TrustedUserCAKeys installer.
Expanded Node inventory: OS/kernel/architecture/CPU, filesystems, systemd services, listening sockets and top processes in addition to Docker and core metrics.
Docker logs remain read-only. Container start/stop/restart remains explicitly phone-approved and transaction-bound.
SSH diagnostics expose certificate mode, active expiry/principal and CA fingerprint in addition to resolved ssh -G configuration and transport/auth failures.
Existing SSH mode remains available as a migration/rollback path.

The UI is a local-only web application bound to 127.0.0.1:47474. All assets are bundled; there is no CDN dependency.

Recommended migration for a VPS

Keep the server in Existing SSH mode.
Open SSH CA and run Install / update Node.
Run Enroll CA and confirm the exact server operation on the phone.
Edit the server and switch authentication to Zorin short-lived certificate.
Activate a 1–5 minute command certificate when needed; terminals receive a separate terminal-purpose certificate.

The bootstrap account currently needs non-interactive sudo -n for the dedicated Node install/CA-enrollment commands.

Исходный код · MIT