# Docker TLS material (generated, not committed)

Generate with `infra/scripts/docker-tls/generate-docker-tls.sh`. Deploy with the `docker-tls`
Ansible role. Verify with `infra/scripts/docker-tls/verify-docker-tls.sh`.

**Nothing in this directory is ever committed** — see `infra/.gitignore`. This README (and only
this README) is tracked, so the directory itself exists in the repo as documentation of what
belongs here operationally.

Files that will exist here on a real deployment host (never in git):

```
ca.pem                              # public — safe to distribute to both VMs
ca-key.pem                          # PRIVATE — offline/secrets-vault only, never on either VM
server-cert.pem / server-key.pem                    # rn-lab-host-01's dockerd
provisioner-client-cert.pem / provisioner-client-key.pem   # rn-platform-01's Provisioner
```

Rotation procedure: `docs/RUNBOOK_DOCKER_TLS_ROTATION.md`.