TANG(8) TANG(8) (NAME) tang - (OVERVIEW) (Tang) . (stateless) (key escrow) . . . . ( ) ( ). . . . (zero-configuration) . . REST API JSON Object Signing and Encryption (JOSE) . Clevis . . (GETTING STARTED) : $ sudo systemctl enable tangd.socket --now . . (CONFIGURATION) . systemd tangd.socket . systemd.unit(5) systemd.socket(5) . SYSTEMD (STANDALONE OR VIA SYSTEMD) systemd -l (standalone) . 9090 -p . tang -l -p 9090 (ENDPOINT) (endpoint) . (URL) . -e . tang -l -p 9090 -e this/is/an/endpoint URL adv/rec . 9090 : http://localhost:9090/adv (GET) http://localhost:9090/rec (POST) /this/is/an/endpoint/ 9090 : http://localhost:9090/this/is/an/endpoint/adv (GET) http://localhost:9090/this/is/an/endpoint/rec (POST) (KEY ROTATION) (rotate ). . : https://www.keylength.com . tangd-rotate-keys(1) . . . /var/db/tang . : # DB=/var/db/tang # jose jwk gen -i '{"alg":"ES512"}' -o $DB/new_sig.jwk # jose jwk gen -i '{"alg":"ECMR"}' -o $DB/new_exc.jwk . : # mv $DB/old_sig.jwk $DB/.old_sig.jwk # mv $DB/old_exc.jwk $DB/.old_exc.jwk . . . . . (HIGH PERFORMANCE) . systemd . . . (connection pool) . . ProxyPass mod_proxy . (HIGH AVAILABILITY) . 1. () 2. DNS round-robin . . . . Clevis sss . . ( !) . () ! DNS round-robin . (COMMANDS) . (AUTHOR) Nathaniel McCallum (SEE ALSO) systemd.unit(5), systemd.socket(5), jose-jwk-gen(1), tang-show-keys(1), tangd-rotate-keys(1) (FURTHER READING) o Clevis : https://github.com/latchset/clevis o Tang : https://github.com/latchset/tang o JOSE : https://datatracker.ietf.org/wg/jose/charter o mod_proxy : https://httpd.apache.org/docs/2.4/mod/mod_proxy.html 02/14/2026 TANG(8)