nokkud is the supported daemon, but it is not the only way to automate a target. The core exposes the operations needed to enroll a machine, obtain its CA, sign host keys, and synchronize principals.
This is useful for a custom agent, an image-build step, a configuration-management module, or a scheduled script.
Use a service account
Create a service account for the workspace and assign it the access required by the automation. Authenticate API requests with its token.
For SSH certificate signing, the service account’s workspace is selected automatically. You do not need to carry a workspace ID through every request.
Keep the target ID
Manual target management requires a target created with an endpoint. Store its target ID in the machine’s configuration. The target ID is the stable identifier used for host certificate signing and target-scoped access operations.
Daemon enrollment creates this target automatically and returns its ID. A custom automation flow can either use that enrollment flow or use a manually created target.
Provisioning sequence
An automation script can follow this sequence:
- Generate or refresh an enrollment token when using core enrollment.
- Enroll the machine and persist the returned target ID and machine credential, or use a pre-created target ID with a service account.
- Fetch the target’s SSH CA public material.
- Generate or load the machine’s SSH host key locally.
- Submit the public host key to the SSH certificate signing operation with
type=HOSTand the target ID. The target ID is required for a service account signing a host certificate. - Install the returned host certificate and CA public key into the local SSH configuration.
- Fetch the current principal assignments for the target.
- Reconcile the local
AuthorizedPrincipalsFileor equivalent authorization mechanism. - Repeat certificate renewal and principal synchronization from a timer or configuration-management run.
The host certificate is issued for the target identity. Configuring the client to trust the returned CA means a manually managed target can avoid the usual first-connection TOFU prompt.
Principal synchronization
The core returns effective access for users, teams, and service accounts. A custom integration can translate that result into the local SSH authorization format it uses. If the integration provides an AuthorizedPrincipalsCommand, it can resolve the latest data at login time; a scheduled job can instead write local files periodically.
API details
The exact request and response fields are documented in the generated API reference. Relevant operations include daemon enrollment, daemon synchronization, certificate-authority retrieval, SSH certificate signing, target access, and principal management.
The API is the source of truth for custom integrations. Do not copy the daemon’s internal cache format as an API contract.