Adds the stepca SSH auth type: Termix signs you in with the identity provider behind a smallstep step-ca OIDC provisioner, has the CA sign a fresh key, and keeps the short-lived SSH certificate until it expires.

Termix never runs the step binary. It talks to the CA's HTTPS API (/root/<fingerprint>, /provisioners, /1.0/ssh/sign) and to the identity provider directly, through core's outbound request guard.

Settings

Admin settings, under Settings > Plugins > Step CA:

CA URL, Root fingerprint and OIDC provisioner name. Leave all three empty to turn Step CA off.
Allowed private Step CA hosts: the CA and, if it is internal, the identity provider. Anything private that is not listed is refused.
Redirect URI: register it with the identity provider: <base URL>/plugin-api/step-ca/callback, or <base URL>/host/step-ca-callback while "Use the old redirect URI" is on.

An install upgraded from 2.8 has its Step CA settings copied in and keeps the old redirect URI turned on.

Several instances

With REDIS_URL set, a callback that reaches another Termix instance is handed to the one that started the sign-in. TERMIX_STEP_CA_REDIS_PREFIX changes the key prefix (default termix:step-ca).