step-ca v0.1.0

Secrets

step-ca — a small, self-hosted online certificate authority from Smallstep. Run your own private PKI and issue short-lived TLS/SSH certificates, with a built-in ACME server so tools like Caddy and cert-manager can get certs from you. Deployed as a host-networked Nomad service that auto-initializes on first boot, with a persistent volume.

nomad-pack run step-ca --registry nomploy

…or one line (add registry + run)

curl -fsSL https://packs.nomploy.com/install.sh | sh -s -- step-ca

Needs nomad-pack on PATH. The script only adds the nomploy registry and runs this pack.

Source ↗ Project ↗ ★ 8.9k ⚑ Report an issue

1 task https 9000 1 volume image smallstep/step-ca:latest tracks :latest image bumped today

Variables 11

values.hcl

Save as values.hcl, edit, then run:

nomad-pack run step-ca -f values.hcl --registry nomploy

# The name of the Nomad job.
job_name = "step-ca"

# The Nomad namespace to deploy into.
namespace = "default"

# The datacenters to deploy to.
datacenters = ["*"]

# The step-ca container image. Pin a tag in production.
image = "smallstep/step-ca:latest"

# Host port for the CA's HTTPS API.
port = 9000

# Name of the certificate authority (DOCKER_STEPCA_INIT_NAME), shown in certificates.
ca_name = "Nomploy CA"

# Comma-separated DNS names / IPs the CA will be reached at (DOCKER_STEPCA_INIT_DNS_NAMES). Include this host's name or IP.
dns_names = "localhost"

# Password protecting the CA's private keys (DOCKER_STEPCA_INIT_PASSWORD). CHANGE THIS and keep it safe — it is only used at first-boot initialization.
ca_password = "change-me-please"

# Named volume for the CA config, certs, and keys (/home/step). Losing it means losing your CA.
data_volume = "stepca_data"

# Placement constraints. Pin to the node holding the volume. On a nomploy cluster: attribute = "$${meta.nomploy_control_plane}", operator = "=", value = "true".
constraints = []

# Resources for the step-ca task.
resources = {
    cpu    = 300
    memory = 256
  }

Name	Type	Default	Description
job_name	string	"step-ca"	The name of the Nomad job.
namespace	string	"default"	The Nomad namespace to deploy into.
datacenters	list	["*"]	The datacenters to deploy to.
image	string	"smallstep/step-ca:latest"	The step-ca container image. Pin a tag in production.
port	number	9000	Host port for the CA's HTTPS API.
ca_name	string	"Nomploy CA"	Name of the certificate authority (DOCKER_STEPCA_INIT_NAME), shown in certificates.
dns_names	string	"localhost"	Comma-separated DNS names / IPs the CA will be reached at (DOCKER_STEPCA_INIT_DNS_NAMES). Include this host's name or IP.
ca_password set me	string	"change-me-please"	Password protecting the CA's private keys (DOCKER_STEPCA_INIT_PASSWORD). CHANGE THIS and keep it safe — it is only used at first-boot initialization.
data_volume	string	"stepca_data"	Named volume for the CA config, certs, and keys (/home/step). Losing it means losing your CA.
constraints	list	[]	Placement constraints. Pin to the node holding the volume. On a nomploy cluster: attribute = "$${meta.nomploy_control_plane}", operator = "=", value = "true".
resources	object	{ cpu = 300 memory = 256 }	Resources for the step-ca task.

Back up this pack

This pack stores data in one Docker named volume: stepca_data

restic

# Run on the node hosting this pack. Point restic at your repo first:
#   export RESTIC_REPOSITORY="s3:https://<account>.r2.cloudflarestorage.com/<bucket>"
#   export RESTIC_PASSWORD="<repo-password>"
#   export AWS_ACCESS_KEY_ID=<key>  AWS_SECRET_ACCESS_KEY=<secret>
restic backup \
  /var/lib/docker/volumes/stepca_data/_data

rclone (sync to S3/R2)

rclone sync /var/lib/docker/volumes/stepca_data/_data backup:<bucket>/stepca_data

Paths assume the default Docker volume location (/var/lib/docker/volumes). Restore by stopping the job, restoring files into the same volume, and re-running the pack.

Readme

step-ca

step-ca — a small, self-hosted online certificate authority from Smallstep. Run your own private PKI: issue short-lived X.509 (TLS) and SSH certificates, and use the built-in ACME server so tools like Caddy, cert-manager, and certbot can obtain certificates from your own CA.

Single host-networked Nomad service that auto-initializes on first boot, with a persistent volume for its config, certificates, and keys.

Deploy

nomad-pack registry add nomploy https://github.com/Nomploy/nomad-packs
nomad-pack run step-ca --registry=nomploy

Configure

Variable	Default	Description
`port`	`9000`	CA HTTPS API port.
`ca_name`	`Nomploy CA`	Certificate authority name (`DOCKER_STEPCA_INIT_NAME`).
`dns_names`	`localhost`	Comma-separated DNS names/IPs the CA is reached at (`DOCKER_STEPCA_INIT_DNS_NAMES`). Include this host.
`ca_password`	`change-me-please`	Password protecting the CA keys (`DOCKER_STEPCA_INIT_PASSWORD`). Change it — used at init.
`data_volume`	`stepca_data`	`/home/step` — config, certs, and private keys.
`image`	`smallstep/step-ca:latest`	Container image. Pin a tag in production.
`resources`	`{ cpu = 300, memory = 256 }`	Task resources.

After first boot, read the root fingerprint from the task logs, then bootstrap clients:

step ca bootstrap --ca-url https://<dns-name>:9000 --fingerprint <fingerprint>

Point ACME clients at https://<dns-name>:9000/acme/acme/directory. Back up the /home/step volume and the CA password securely — they are the trust root of your PKI. Pin the job to the node holding the volume with constraints.