Adds the vault SSH auth type: Termix signs you in to Vault with OIDC in the browser, has Vault's SSH secrets engine sign a fresh key, and keeps the short-lived certificate until it expires.

Termix talks to Vault's HTTP API directly (auth/<mount>/oidc/auth_url, auth/<mount>/oidc/callback, <ssh mount>/sign/<role>). No Vault token, AppRole secret or long-lived key is ever stored.

Profiles

A profile holds the connection settings only: the Vault address and namespace, the OIDC mount and role, the SSH secrets mount and signer role, the valid principals and the key type. Pick one in the host editor after choosing "Vault" as the authentication type, and manage profiles from the same place. Users with the "Share Vault profiles" permission can share a profile with everyone.

Settings

Admin settings, under Settings > Plugins > HashiCorp Vault:

Redirect URI: add it to allowed_redirect_uris in each Vault OIDC role: <base URL>/plugin-api/vault/oidc/callback, or <base URL>/vault/oidc/callback while "Use the old redirect URI" is on.

An install upgraded from 2.8 that used Vault keeps the old redirect URI turned on.