BlueJay PKI Portal
IAmWorkin ACME Certificate Authority
Internal CA
ClusterIssuer: step-ca-acme
Domain: *.iamworkin.lan
Validity: 30 days, auto-renewed by cert-manager
Cloudflare Origin Certs
*.flowercore.io and *.iamwork.in
15-year RSA certificates for public domains
Download Root CA
Install the IAmWorkin Root CA certificate to trust internal services.
Root CA download will be available here.
---
# nginx configuration
apiVersion: v1
kind: ConfigMap
metadata:
name: pki-web-nginx-conf
namespace: pki
data:
default.conf: |
server {
listen 80;
server_name _;
root /usr/share/nginx/html;
index index.html;
location / {
try_files $uri $uri/ =404;
}
location /healthz {
access_log off;
return 200 "ok";
add_header Content-Type text/plain;
}
}
---
# PKI Web Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
name: pki-web
namespace: pki
labels:
app: pki-web
spec:
replicas: 1
selector:
matchLabels:
app: pki-web
template:
metadata:
labels:
app: pki-web
annotations:
flowercore.io/healthz-auth-policy: "allow-anonymous"
spec:
containers:
- name: nginx
image: nginx:alpine
ports:
- containerPort: 80
name: http
volumeMounts:
- name: nginx-conf
mountPath: /etc/nginx/conf.d/default.conf
subPath: default.conf
- name: html
mountPath: /usr/share/nginx/html
resources:
requests:
memory: 16Mi
cpu: 5m
limits:
memory: 64Mi
cpu: 50m
livenessProbe:
httpGet:
path: /healthz
port: 80
httpHeaders:
- name: X-Forwarded-Proto
value: https
initialDelaySeconds: 5
periodSeconds: 10
readinessProbe:
httpGet:
path: /healthz
port: 80
httpHeaders:
- name: X-Forwarded-Proto
value: https
initialDelaySeconds: 3
periodSeconds: 5
volumes:
- name: nginx-conf
configMap:
name: pki-web-nginx-conf
- name: html
configMap:
name: pki-web-html
---
apiVersion: v1
kind: Service
metadata:
name: pki-web
namespace: pki
spec:
selector:
app: pki-web
ports:
- port: 80
targetPort: 80
name: http
---
# TLS Certificate via cert-manager
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: pki-tls
namespace: pki
spec:
secretName: pki-tls
issuerRef:
name: step-ca-acme
kind: ClusterIssuer
dnsNames:
- pki.iamworkin.lan
---
# Internal-only route: if a public twin is ever operator-approved, gate it with Host(`