pki-install

Public release artifacts for the CA/RA PKI system — binaries only, no source.

This repo exists so air-gapped installs can download a signed, self-contained release bundle without needing access to the private source repository. Each GitHub/Forgejo Release here corresponds 1:1 to a tagged release of the (private) source repo, built and published automatically by its release CI.

What's in a release

Each release's pki-release-<version>.tar.gz bundle contains:

• Container images for the app, Postgres, Caddy, and Chrome sidecar (docker save tarballs — no registry access needed to load them)
• Quadlet unit files and a .env template
• The install runbook (INSTALL.md)
• Portal reference docs and a user-manual walkthrough (docs/)
• SHA256SUMS for every file in the bundle

Download the tar for the version you want from this repo's Releases page, verify its checksums against SHA256SUMS, then follow INSTALL.md inside the bundle.

Documentation

This repo also carries a standalone, browsable copy of the docs (kept in sync with each release, not just bundled inside the tar):

• INSTALL.md — the install runbook
• docs/ca-portal.md — CA portal reference
• docs/ra-portal.md — RA portal reference
• docs/user-manual/ — end-user walkthrough guide

What's not here

Source code, issues, and CI internals live in the private source repository. This repo intentionally carries no application code — just release notes, documentation, and binary assets.