Local development

npm install
cp .env.example .env
# fill .env
npm run dev

Environment variables

• ORACLE_USER
• ORACLE_PASSWORD
• ORACLE_CONNECT_STRING
• ORACLE_WALLET_LOCATION
• ORACLE_WALLET_PASSWORD
• PORT
• ADMIN_TOKEN

API reference

GET  /health
POST /api/validate
POST /api/keys
GET  /api/keys/:handle
GET  /api/bundles          (admin token required)
DELETE /api/keys/:id       (admin token required)

Bundle shape

{
  "version": 1,
  "handle": "alice",
  "keys": [{
    "type": "ssh-ed25519",
    "publicKey": "ssh-ed25519 ...",
    "fingerprint": "SHA256:..."
  }],
  "proof": {
    "message": "register alice",
    "signature": "base64...",
    "signedBy": "ssh-ed25519 ..."
  }
}

Deployment

Production runs on the Oracle VM at /opt/pubkey-locker.

npm install
sudo cp deploy/pubkey-locker.service /etc/systemd/system/pubkey-locker.service
sudo systemctl daemon-reload
sudo systemctl enable --now pubkey-locker

sudo caddy validate --config /etc/caddy/Caddyfile
sudo caddy reload --config /etc/caddy/Caddyfile

Security

• Keep secrets in .env only.
• Keep the Oracle wallet outside the repository.
• Admin endpoints require X-Admin-Token.
• Rotate credentials if they are exposed.