From 4ec48a8ee52a2d71ac58273259d139881f94c248 Mon Sep 17 00:00:00 2001
From: Cullen Walsh <ckwalsh@cullenwalsh.com>
Date: Sun, 27 Dec 2020 16:34:50 -0800
Subject: [PATCH] Add ssh renewer

---
 renewer/ssh/Dockerfile | 12 ++++++++++++
 renewer/ssh/renewer.sh | 15 +++++++++++++++
 2 files changed, 27 insertions(+)
 create mode 100644 renewer/ssh/Dockerfile
 create mode 100644 renewer/ssh/renewer.sh

diff --git a/renewer/ssh/Dockerfile b/renewer/ssh/Dockerfile
new file mode 100644
index 00000000..ed13055c
--- /dev/null
+++ b/renewer/ssh/Dockerfile
@@ -0,0 +1,12 @@
+FROM smallstep/step-cli:0.15.3
+
+USER root
+ENV USER_KEY="/var/run/autocert.step.sm/ssh_user_key"
+ENV HOST_KEY="/var/run/autocert.step.sm/ssh_host_key"
+ENV STEP_ROOT="/var/run/autocert.step.sm/root.crt"
+ENV RENEWAL_SEC="21600"
+ENV RENEWAL_JITTER_SEC="600"
+
+COPY renewer/ssh/renewer.sh /home/step/
+RUN chmod +x /home/step/renewer.sh
+CMD ["/home/step/renewer.sh"]
diff --git a/renewer/ssh/renewer.sh b/renewer/ssh/renewer.sh
new file mode 100644
index 00000000..25f90f88
--- /dev/null
+++ b/renewer/ssh/renewer.sh
@@ -0,0 +1,15 @@
+#!/bin/sh
+
+set -e
+
+if [ "$STEP_HOST" == "" ];
+then
+    KEY=$USER_KEY
+else
+    KEY=$HOST_KEY
+fi
+
+while true; do
+  sleep $(expr $RENEWAL_SEC + $RANDOM % $RENEWAL_JITTER_SEC);
+  step ssh renew -f $KEY-cert.pub $KEY;
+done;