Move pki to pass
This commit is contained in:
parent
a8717f9bf5
commit
7c1444b714
GPG Key ID:
0E496D15096376BE
10
deploy_pki
10
deploy_pki
|
|
@ -1,13 +1,13 @@
|
|||
#!/usr/bin/env ./sshtool
|
||||
|
||||
PKI=cluster/$CLUSTER/secrets/pki
|
||||
PKI=deuxfleurs/cluster/$CLUSTER
|
||||
YEAR=$(date +%Y)
|
||||
|
||||
cmd mkdir -p /var/lib/nomad/pki /var/lib/consul/pki
|
||||
|
||||
for file in consul-ca.crt consul$YEAR.crt consul$YEAR.key consul$YEAR-client.crt consul$YEAR-client.key; do
|
||||
if [ -f "$PKI/$file" ]; then
|
||||
copy_secret $PKI/$file /var/lib/consul/pki/$file
|
||||
if pass $PKI/$file >/dev/null; then
|
||||
write_pass $PKI/$file /var/lib/consul/pki/$file
|
||||
cmd chown consul:root /var/lib/consul/pki/$file
|
||||
fi
|
||||
done
|
||||
|
|
@ -16,8 +16,8 @@ cmd systemctl restart consul
|
|||
cmd sleep 10
|
||||
|
||||
for file in nomad-ca.crt nomad$YEAR.crt nomad$YEAR.key; do
|
||||
if [ -f "$PKI/$file" ]; then
|
||||
copy_secret $PKI/$file /var/lib/nomad/pki/$file
|
||||
if pass $PKI/$file >/dev/null; then
|
||||
write_pass $PKI/$file /var/lib/nomad/pki/$file
|
||||
fi
|
||||
done
|
||||
|
||||
|
|
|
|||
|
|
@ -1,8 +1,6 @@
|
|||
#!/bin/bash
|
||||
#!/usr/bin/env sh
|
||||
|
||||
set -xe
|
||||
|
||||
# Enter proper cluster subdirectory
|
||||
set -ex
|
||||
|
||||
cd $(dirname $0)
|
||||
|
||||
|
|
@ -13,38 +11,34 @@ if [ -z "$CLUSTER" ] || [ ! -d "cluster/$CLUSTER" ]; then
|
|||
exit 1
|
||||
fi
|
||||
|
||||
cd cluster/$CLUSTER
|
||||
|
||||
mkdir -p secrets/pki
|
||||
cd secrets/pki
|
||||
|
||||
# Do actual stuff
|
||||
PREFIX="deuxfleurs/cluster/$CLUSTER"
|
||||
|
||||
YEAR=$(date +%Y)
|
||||
for APP in consul nomad; do
|
||||
# 1. Create certificate authority
|
||||
if [ ! -f $APP-ca.key ]; then
|
||||
if ! pass $PREFIX/$APP-ca.key >/dev/null; then
|
||||
echo "Generating $APP CA keys..."
|
||||
#openssl genpkey -algorithm ED25519 -out $APP-ca.key
|
||||
openssl genrsa -out $APP-ca.key 4096
|
||||
openssl genrsa 4096 | pass insert -m $PREFIX/$APP-ca.key
|
||||
|
||||
openssl req -x509 -new -nodes -key $APP-ca.key -sha256 -days 3650 -out $APP-ca.crt -subj "/C=FR/O=Deuxfleurs/CN=$APP"
|
||||
openssl req -x509 -new -nodes \
|
||||
-key <(pass $PREFIX/$APP-ca.key) -sha256 \
|
||||
-days 3650 -subj "/C=FR/O=Deuxfleurs/CN=$APP" \
|
||||
| pass insert -m -f $PREFIX/$APP-ca.crt
|
||||
fi
|
||||
|
||||
CERT="${APP}${YEAR}"
|
||||
|
||||
# 2. Create and sign certificates for inter-node communication
|
||||
if [ ! -f $CERT.crt ]; then
|
||||
if ! pass $PREFIX/$CERT.crt >/dev/null; then
|
||||
echo "Generating $CERT agent keys..."
|
||||
if [ ! -f $CERT.key ]; then
|
||||
#openssl genpkey -algorithm ED25519 -out $CERT.key
|
||||
openssl genrsa -out $CERT.key 4096
|
||||
if ! pass $PREFIX/$CERT.key >/dev/null; then
|
||||
openssl genrsa 4096 | pass insert -m $PREFIX/$CERT.key
|
||||
fi
|
||||
openssl req -new -sha256 -key $CERT.key \
|
||||
openssl req -new -sha256 -key <(pass $PREFIX/$CERT.key) \
|
||||
-subj "/C=FR/O=Deuxfleurs/CN=$APP" \
|
||||
-out $CERT.csr
|
||||
openssl req -in $CERT.csr -noout -text
|
||||
openssl x509 -req -in $CERT.csr \
|
||||
-out /tmp/tmp-$CLUSTER-$CERT.csr
|
||||
openssl req -in /tmp/tmp-$CLUSTER-$CERT.csr -noout -text
|
||||
openssl x509 -req -in /tmp/tmp-$CLUSTER-$CERT.csr \
|
||||
-extensions v3_req \
|
||||
-extfile <(cat <<EOF
|
||||
[req]
|
||||
|
|
@ -69,23 +63,25 @@ DNS.3 = localhost
|
|||
DNS.4 = 127.0.0.1
|
||||
EOF
|
||||
) \
|
||||
-CA $APP-ca.crt -CAkey $APP-ca.key -CAcreateserial \
|
||||
-out $CERT.crt -days 700
|
||||
rm $CERT.csr
|
||||
-CA <(pass $PREFIX/$APP-ca.crt) \
|
||||
-CAkey <(pass $PREFIX/$APP-ca.key) -CAcreateserial \
|
||||
-CAserial /tmp/tmp-$CLUSTER-$CERT.srl \
|
||||
-days 700 \
|
||||
| pass insert -m $PREFIX/$CERT.crt
|
||||
rm /tmp/tmp-$CLUSTER-$CERT.{csr,srl}
|
||||
fi
|
||||
|
||||
# 3. Create client-only certificate used for the CLI
|
||||
if [ ! -f $CERT-client.crt ]; then
|
||||
if ! pass $PREFIX/$CERT-client.crt >/dev/null; then
|
||||
echo "Generating $CERT client keys..."
|
||||
if [ ! -f $CERT-client.key ]; then
|
||||
#openssl genpkey -algorithm ED25519 -out $CERT-client.key
|
||||
openssl genrsa -out $CERT-client.key 4096
|
||||
if ! pass $PREFIX/$CERT-client.key >/dev/null; then
|
||||
openssl genrsa 4096 | pass insert -m $PREFIX/$CERT-client.key
|
||||
fi
|
||||
openssl req -new -sha256 -key $CERT-client.key \
|
||||
openssl req -new -sha256 -key <(pass $PREFIX/$CERT-client.key) \
|
||||
-subj "/C=FR/O=Deuxfleurs/CN=$APP-client" \
|
||||
-out $CERT-client.csr
|
||||
openssl req -in $CERT-client.csr -noout -text
|
||||
openssl x509 -req -in $CERT-client.csr \
|
||||
-out /tmp/tmp-$CLUSTER-$CERT-client.csr
|
||||
openssl req -in /tmp/tmp-$CLUSTER-$CERT-client.csr -noout -text
|
||||
openssl x509 -req -in /tmp/tmp-$CLUSTER-$CERT-client.csr \
|
||||
-extensions v3_req \
|
||||
-extfile <(cat <<EOF
|
||||
[req]
|
||||
|
|
@ -107,9 +103,12 @@ subjectAltName = @alt_names
|
|||
DNS.1 = client.$CLUSTER.$APP
|
||||
EOF
|
||||
) \
|
||||
-CA $APP-ca.crt -CAkey $APP-ca.key -CAcreateserial \
|
||||
-out $CERT-client.crt -days 700
|
||||
rm $CERT-client.csr
|
||||
-CA <(pass $PREFIX/$APP-ca.crt) \
|
||||
-CAkey <(pass $PREFIX/$APP-ca.key) \
|
||||
-CAcreateserial -days 700 \
|
||||
-CAserial /tmp/tmp-$CLUSTER-$CERT-client.srl \
|
||||
| pass insert -m $PREFIX/$CERT-client.crt
|
||||
rm /tmp/tmp-$CLUSTER-$CERT-client.{csr,srl}
|
||||
fi
|
||||
|
||||
#if [ ! -f $CERT-client.p12 ]; then
|
||||
Loading…
Reference in New Issue