test-example: all-privkeys: Define, and indirect through, a variable

[secnet.git] / README.make-secnet-sites

diff --git a/README.make-secnet-sites b/README.make-secnet-sites
index 17af35c4266672d30166355d801f551b88bfc94a..aa4b216d2f580f96f7dc8047bbc0bce7bc69b6cd 100644 (file)
--- a/README.make-secnet-sites
+++ b/README.make-secnet-sites
@@ -47,6 +47,39 @@ OPTIONS
                If NUMBER is higher than make-secnet-sites supports,
                it writes out what it can.
 
+       --pubkeys-install
+
+               Specifies that public keys are to be installed in the
+               live pubkeys area (and not hardcoded in secnet conf
+               files).  With this option, generated site configs
+               refer to keys in PUBKEYS; also, the generated secnet
+               configuration enables live peer public update.
+
+       --pubkeys-single
+
+               Specifies that one public key per site is to be
+               written directly into the sites.conf output.  If
+               --output-version=1, this is the rsa1 key 0000000000.
+               Otherwise it is an error if there are multiple public
+               keys defined for any site, in the input.
+               --pubkeys-single is the default.
+
+       --pubkeys-elide
+
+               In the sites.conf output, just write the peer-keys
+               entry referring to keys in PUBKEYS.  But do not write
+               public keys anywhere.
+
+       --pubkeys-dir PUBKEYS
+
+               Specifies the live pubkeys area pathname.
+               The default is /var/lib/secnet/pubkeys.
+
+               Key files are named
+                       PUBKEYS/peer.<mangled-peer-name>[~...]
+               mangled-peer-name is chosen by make-secnet-sites
+                       / => ,
+
        --debug | -D
 
                Increase amount of debugging output.
@@ -220,7 +253,6 @@ INPUT SYNTAX
                Specifies the key set id (8 hex digits representing
                4 bytes: each pair is the value of the next byte).
                May appear at most once.  If not present, 00000000.
-               Not yet suported in make-secnet-sites.
 
        pkg GROUPIDHEX
        pkgf GROUPIDHEX
@@ -228,7 +260,6 @@ INPUT SYNTAX
                pkgf indicates a fallback group.
                May be repeated (with different id values).
                If not specified, 00000000.
-               Not yet suported in make-secnet-sites.
 
 
 OUTPUT STRUCTURE