How c8m6/cci-ui works
CCI-UI is a Rails web application for managing X.509 certificates across permission areas. Users search Consul and legacy filesystem inventories, preview and confirm imports, manage certificate versions and status, inspect chains, and export certificates or authorized keys. A separate request workflow creates CSRs and publishes matching issued certificates; CA inventory, Puppet distribution, audit, access control, and operations are supporting capabilities. The README documents these product relationships; sampled source confirms Consul client behavior and encrypted key handling, but most Rails service implementations were not sampled, so finer call ownership is not asserted.
Main entry points: certificates_controller.rb Certificate workflows · certificate_requests_controller.rb Request workflow · consul_store.rb Consul certificate store · certificate_search.rb Certificate search
Components 25
Certificate catalog
- Certificate workflows
app/controllers/certificates_controller.rb - Certificate search
app/services/certificate_search.rb - Certificate import
app/services/certificate_import.rb - Certificate export
app/services/certificate_export.rb - Catalog indexing
app/services/catalog_indexer.rb - Consul certificate store
app/services/consul_store.rb - Legacy file inventory
app/services/legacy_store.rb - Encrypted key vault
lib/certificates/vault.rb
Certificate requests
- Request workflow
app/controllers/certificate_requests_controller.rb - CSR generation
app/services/csr_generation.rb - Issued certificate publication
app/services/csr_publication.rb - Request records
app/models/certificate_request.rb
Infrastructure integrations
- CA inventory
app/services/ca_inventory_refresh.rb - Puppet certificate client
integrations/puppet/cci/lib/cci_client.rb - Consul KV transport
lib/consul_connection.rb - PuppetDB associations
app/services/puppetdb_inventory.rb
Access and audit
- Audit records
app/models/audit_event.rb - OIDC authorization
app/services/oidc_authorization.rb
Operations
- Health and readiness
app/services/application_health.rb - Structured logging
lib/operational_log.rb
Other components
- Certificate user
- Keycloak identity
- PuppetDB service
- Consul service
- Certificate files
Connections 25
- Certificate user → Certificate workflows: manages
README.md - Certificate workflows → Certificate search: searches
README.md - Certificate workflows → Certificate import: imports
README.md - Certificate workflows → Certificate export: exports
README.md - Certificate search → Consul certificate store: searches
README.md - Certificate search → Legacy file inventory: searches
README.md - Catalog indexing → Consul certificate store: indexes
README.md - Certificate import → Consul certificate store: stores versions
README.md - Certificate import → Legacy file inventory: reads files
README.md - Certificate export → Encrypted key vault: decrypts keys
README.md - Certificate user → Request workflow: requests certificates
README.md - Request workflow → CSR generation: creates CSR
README.md - Request workflow → Request records: retains requests
README.md - Request workflow → Issued certificate publication: publishes matching cert
README.md - Issued certificate publication → Consul certificate store: publishes
README.md - CA inventory → Consul service: reads inventory
- Puppet certificate client → Consul KV transport: uses transport
integrations/puppet/cci/lib/cci_client.rb - Consul KV transport → Consul service: reads and writes
lib/consul_connection.rb - PuppetDB associations → PuppetDB service: queries hosts
README.md - OIDC authorization → Keycloak identity: authenticates
README.md - Certificate user → Audit records: actions recorded
README.md - Certificate export → Audit records: records exports
README.md - Health and readiness → Consul service: checks service
- Health and readiness → PuppetDB service: checks service
- Structured logging → Consul KV transport: logs transactions
lib/consul_connection.rb