Trust commands

Common global behavior is documented in the CLI hub. The complete CA command contracts follow.

rotate learn-host-key fingerprint

gdsgate ca rotate [--all]

Requests a certificate-authority rotation through the cluster (Authority runs the paced double-signing).

Flag	Default	Purpose
--all	off	Rotate every rotatable CA with sensible defaults.

gdsgate ca learn-host-key <target>

Trust-on-first-use helper for the model-B jump-host path: connects to <target> (host or host:port, default port 22), captures the sshd's host-key, and prints its SHA256:<base64> fingerprint on stdout, ready to paste into [[connector.backends]].host_key_fingerprints (or write into the file pointed at by host_key_fingerprints_file).

gdsgate ca learn-host-key sshd-target:22 \
    > /etc/gdsgate/sshd-target.fp

Stderr carries a one-line preamble naming the target; exit code is non-zero on a connect / handshake failure.

gdsgate ca fingerprint [--file <path>]

Prints the SHA-256 fingerprint of the cluster's transport CA: the value an operator publishes so a user running gdsgate connect can tell this cluster from anything else answering on the same address.

gdsgate --config /etc/gdsgate/proxy.toml ca fingerprint

Without --file the anchor is looked for at ${enroll.state_dir}/transport-ca.pem, where an enrolled node writes it, and then at [client].transport_ca. Stdout carries the fingerprint alone, so it composes with a pipeline; the file it was read from goes to stderr. Exit code is non-zero when no anchor is found or the file holds no certificate.

The value is computed the same way the client computes it after fetching the anchor, so the two sides cannot drift apart.

Flag	Default	Purpose
--file <path>	from the configuration	Read this anchor instead of the ones the configuration names.

The source enum is CaAction in crates/gdsgate/src/main.rs. A fingerprint does not authenticate a user and must be confirmed before unattended bootstrap.