Operations and maintenance

Important paths

Path	Purpose
/opt/adpki/backend	Laravel Backend
/opt/adpki/frontend/dist	compiled Web UI
/opt/adpki/ca-core	CA Core binary
/etc/adpki	runtime and application configuration
/var/lib/adpki	PKI data, imported CAs, and backups
/var/log/adpki	Backend, CA, installer, setup, and Nginx logs

Private keys below /var/lib/adpki/private use restrictive permissions and must never be exposed to the web-server account.

Updates

sudo adpki update

The updater:

1. checks available releases,
2. asks for confirmation,
3. creates a compressed database backup below /var/lib/adpki/backups when pg_dump is available,
4. stops AD-PKI services,
5. downloads and verifies CA, Backend, and Frontend artifacts,
6. applies pending Laravel migrations,
7. restores permissions and starts services.

After an update, verify:

adpki status
sudo journalctl -u adpki-ca.service --since "10 minutes ago"

Distribute Root CA trust

After import, the Root certificate is stored at /var/lib/adpki/root/root.crt and exposed through ${APP_URL}/api/ca/root.

Debian/Ubuntu:

sudo cp adpki-root-ca.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates

Windows PowerShell as Administrator:

Import-Certificate -FilePath "adpki-root-ca.crt" `
  -CertStoreLocation "Cert:\LocalMachine\Root"

macOS:

sudo security add-trusted-cert -d -r trustRoot \
  -k /Library/Keychains/System.keychain adpki-root-ca.crt

Distribute the public Root certificate only. Never distribute private keys.