MayFly.sh
public sourceSystemsZero-trust SSH certificate authority and control plane. Issues short-lived OpenSSH user certificates to authenticated, explicitly authorized engineers instead of distributing long-lived SSH keys, with every issuance and denial recorded in a tamper-evident audit log.
Highlights
- Pluggable identity providers — GitHub and Keycloak/OIDC behind one provider abstraction, selectable per request
- Deny-by-default authorization via provider-neutral allowlists (GitHub user/org/team, OIDC group/role/attribute)
- Manages 1-64 Ed25519 certificate authorities with encrypted keys at rest, administered entirely through an admin API and CLI
- Short-lived certificates (default 5 minute TTL, 1 hour max) with a SHA-256 hash-chained, fail-closed audit log
- Runs fully unprivileged; every privileged filesystem write or sshd reload is delegated to mayfly-helper over an authenticated UDS
- Ed25519 machine identity with HTTPS enrollment, heartbeat, and jittered CA-bundle sync
- Zero unsafe code, pure-Rust TLS stack only (no OpenSSL/native-tls), with a Clippy-clean codebase and 100% documented public APIs
- Injectable clock abstraction so business logic never touches wall-clock time directly, keeping tests deterministic
- Covers authentication, SSH/cert issuance, machine administration, CA administration, operations, and fleet rollout in one tool
- Guided CA rotation workflows with PASS/WARN/FAIL diagnostics and rollout health scoring plus ETA
- Multi-account and profile support with table/wide/json/yaml output, --watch, and --follow across commands
- Every request maps 1:1 to one reviewed operation — no generic filesystem facility and no arbitrary command execution
- Rollback-safe apply workflow: validate, write, fsync, atomic rename, sshd -t, reload, verify — restores the previous config on any failure so a host is never left with a config sshd rejected
- Authenticates callers via SO_PEERCRED uid pinning, protocol versioning, and a constant-time capability token
- Single-threaded accept loop serializes privileged operations, with wall-clock timeouts on every external sshd/systemctl call
- One-way dependency direction — this repo consumes the crate repositories (server, agent, helper, CLI); no crate depends back on it
- Proves the happy path, failure behavior, and a real-systemd production deployment profile, including real TLS chain verification with a pinned CA
- All base images are @sha256 digest-pinned, with a version-compatibility matrix validating tested crate revision combinations
- A dedicated security-checks suite statically asserts no test hooks or insecure defaults ever reach the ship path
Stack
- Chaos Testing
- Docker Compose
- Ed25519
- HTTPS Enrollment
- Multi-account Profiles
- OAuth2 Device Flow
- OIDC
- OpenSSH Certificates
- SO_PEERCRED
- SQLite
- Structured Diagnostics
- TLS
- TLS 1.3
- Unix Domain Sockets
- systemd
Languages
- Rust 69%
- Go 22%
- Shell 8%
- Python 1%
- Dockerfile 1%
Activity
52 commits · updated last month
Components
Control Plane
source ↗Zero-trust SSH certificate authority and control plane. Issues short-lived OpenSSH user certificates to authenticated, explicitly authorized engineers instead of distributing long-lived SSH keys, with every issuance and denial recorded in a tamper-evident audit log.
- OpenSSH Certificates
- OAuth2 Device Flow
- OIDC
- TLS 1.3
- SQLite
- Ed25519
Agent / Daemon
source ↗A minimal, security-first Linux daemon whose only job is keeping a host's trusted SSH certificate authorities in sync with the Mayfly server. It runs unprivileged under systemd and delegates every privileged host change to the root mayfly-helper — it does not execute commands, open shells, or expose a control plane of its own.
- systemd
- Unix Domain Sockets
- Ed25519
- HTTPS Enrollment
Operator CLI
source ↗The primary operator interface for the Mayfly platform — an operational and fleet-rollout console covering authentication, SSH/certificate issuance, machine and CA administration, and observability, all built on a single SDK so operators never need to call the REST API directly.
- Multi-account Profiles
- Structured Diagnostics
Privileged Execution Service
source ↗The privileged, root-owned component of the Mayfly platform. It performs a small, explicit allow-list of OpenSSH host operations on behalf of the unprivileged mayfly-agent over an authenticated Unix Domain Socket — no network stack, no enrollment, no authorization decisions of its own.
- Unix Domain Sockets
- SO_PEERCRED
- systemd
Integration & CI Environment
source ↗A hermetic, deterministic Docker environment that runs the whole Mayfly platform — server, agent, helper, and a GitHub stand-in — on one isolated network, covering integration, acceptance, chaos, and performance testing plus the platform's CI pipeline.
- Docker Compose
- TLS
- Chaos Testing