Ostension

Vault-signed OPNsense WebGUI certificates with transactional activation and rollback.

Component	Responsibility
Rotator	Certificate issuance and rotation.
Plugin	Local activation and rollback.

Vault access stays outside OPNsense; rollback stays on the appliance so it works when the WebGUI is unreachable.

Toolchain: Go 1.26.7 · PHP 8.3.35.