Getting started

# 1. Téléchargement du bundle de release
curl -fsSL https://get.zetacert.com/install.sh | sh

# 2. Configuration minimale (interactive)
sudo pkifactor-ctl init \
  --domain pki.exemple.com \
  --admin-email admin@exemple.com \
  --license /chemin/vers/license.json

# 3. Démarrage des services
sudo pkifactor-ctl start

# 4. Vérification de l'état
sudo pkifactor-ctl status
# Expected output:
#   ✓ postgres        running   (healthy)
#   ✓ backend         running   (healthy)
#   ✓ frontend        running   (healthy)
#   ✓ acme            running   (healthy)
#   ✓ est             running   (healthy)
#   ✓ nginx           running   (healthy)

# 1. Ajout du repository Helm
helm repo add zetacert https://charts.zetacert.com
helm repo update

# 2. Création du namespace dédié
kubectl create namespace pkifactor

# 3. Installation avec valeurs personnalisées
helm install pkifactor zetacert/pkifactor \
  --namespace pkifactor \
  --set global.domain=pki.exemple.com \
  --set postgres.persistence.size=50Gi \
  --set ingress.tls.secretName=pki-tls \
  --set license.secretName=pki-license

# 4. Suivi du déploiement
kubectl -n pkifactor get pods -w

# values-prod.yaml — exemple production HA
global:
  domain: pki.exemple.com
  imageRegistry: ghcr.io/zetacert

backend:
  replicaCount: 3
  resources:
    requests: { cpu: 500m, memory: 1Gi }
    limits:   { cpu: 2000m, memory: 4Gi }

postgres:
  enabled: false  # On utilise un Patroni externe
externalDatabase:
  host: pgbouncer.db.svc.cluster.local
  port: 6432
  database: clm_db
  existingSecret: pki-db-credentials

protocols:
  acme: { enabled: true,  port: 8555 }
  est:  { enabled: true,  port: 8443 }
  scep: { enabled: false }
  cmp:  { enabled: true,  port: 8829 }

ingress:
  enabled: true
  className: nginx
  annotations:
    cert-manager.io/cluster-issuer: zetaca-issuer

URL : https://pki.exemple.com
Identifiant : admin@exemple.com
Mot de passe : (généré à l'init, voir /var/lib/pkifactor/initial_password)

Name           : ACME Corporation
Code           : ACME
Default domain : acme.com

# Exemple : connexion à un Vault PKI existant
curl -X POST https://pki.exemple.com/api/inventory/pkis \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Vault PKI Production",
    "type": "vault",
    "base_url": "https://vault.exemple.com:8200",
    "auth_method": "approle",
    "auth_config": {
      "role_id": "9566ebc2-...",
      "secret_id": "f8c3d9e1-..."
    },
    "mount_path": "pki-int/",
    "default_role": "srv-tls"
  }'

curl -X POST https://pki.exemple.com/api/clm/templates \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Web Server TLS",
    "code": "web-tls",
    "organization_id": 1,
    "pki_id": 1,
    "pki_role": "srv-tls",
    "key_algorithm": "ECDSA_P256",
    "validity_days": 90,
    "key_usage": ["digital_signature", "key_encipherment"],
    "extended_key_usage": ["server_auth"],
    "requires_approval": false,
    "acme_enabled": true,
    "acme_path": "web-tls"
  }'

# Via API
curl -X POST https://pki.exemple.com/api/certificates \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "template_code": "web-tls",
    "subject": { "common_name": "www.acme.com" },
    "sans": ["www.acme.com", "acme.com"],
    "key_format": "pkcs8",
    "delivery_format": "pem"
  }'

# Réponse
{
  "id": 42,
  "serial": "1A:2B:3C:...",
  "status": "issued",
  "not_before": "2026-04-18T10:00:00Z",
  "not_after":  "2026-07-17T10:00:00Z",
  "download_url": "/api/certificates/42/download?fmt=pem"
}