Move pki to pass

This commit is contained in:
Alex 2022-04-20 15:03:04 +02:00
parent a8717f9bf5
commit 7c1444b714
Signed by untrusted user: lx
GPG key ID: 0E496D15096376BE
2 changed files with 40 additions and 41 deletions

View file

@ -1,13 +1,13 @@
#!/usr/bin/env ./sshtool
PKI=cluster/$CLUSTER/secrets/pki
PKI=deuxfleurs/cluster/$CLUSTER
YEAR=$(date +%Y)
cmd mkdir -p /var/lib/nomad/pki /var/lib/consul/pki
for file in consul-ca.crt consul$YEAR.crt consul$YEAR.key consul$YEAR-client.crt consul$YEAR-client.key; do
if [ -f "$PKI/$file" ]; then
copy_secret $PKI/$file /var/lib/consul/pki/$file
if pass $PKI/$file >/dev/null; then
write_pass $PKI/$file /var/lib/consul/pki/$file
cmd chown consul:root /var/lib/consul/pki/$file
fi
done
@ -16,8 +16,8 @@ cmd systemctl restart consul
cmd sleep 10
for file in nomad-ca.crt nomad$YEAR.crt nomad$YEAR.key; do
if [ -f "$PKI/$file" ]; then
copy_secret $PKI/$file /var/lib/nomad/pki/$file
if pass $PKI/$file >/dev/null; then
write_pass $PKI/$file /var/lib/nomad/pki/$file
fi
done

View file

@ -1,8 +1,6 @@
#!/bin/bash
#!/usr/bin/env sh
set -xe
# Enter proper cluster subdirectory
set -ex
cd $(dirname $0)
@ -13,38 +11,34 @@ if [ -z "$CLUSTER" ] || [ ! -d "cluster/$CLUSTER" ]; then
exit 1
fi
cd cluster/$CLUSTER
mkdir -p secrets/pki
cd secrets/pki
# Do actual stuff
PREFIX="deuxfleurs/cluster/$CLUSTER"
YEAR=$(date +%Y)
for APP in consul nomad; do
# 1. Create certificate authority
if [ ! -f $APP-ca.key ]; then
if ! pass $PREFIX/$APP-ca.key >/dev/null; then
echo "Generating $APP CA keys..."
#openssl genpkey -algorithm ED25519 -out $APP-ca.key
openssl genrsa -out $APP-ca.key 4096
openssl genrsa 4096 | pass insert -m $PREFIX/$APP-ca.key
openssl req -x509 -new -nodes -key $APP-ca.key -sha256 -days 3650 -out $APP-ca.crt -subj "/C=FR/O=Deuxfleurs/CN=$APP"
openssl req -x509 -new -nodes \
-key <(pass $PREFIX/$APP-ca.key) -sha256 \
-days 3650 -subj "/C=FR/O=Deuxfleurs/CN=$APP" \
| pass insert -m -f $PREFIX/$APP-ca.crt
fi
CERT="${APP}${YEAR}"
# 2. Create and sign certificates for inter-node communication
if [ ! -f $CERT.crt ]; then
if ! pass $PREFIX/$CERT.crt >/dev/null; then
echo "Generating $CERT agent keys..."
if [ ! -f $CERT.key ]; then
#openssl genpkey -algorithm ED25519 -out $CERT.key
openssl genrsa -out $CERT.key 4096
if ! pass $PREFIX/$CERT.key >/dev/null; then
openssl genrsa 4096 | pass insert -m $PREFIX/$CERT.key
fi
openssl req -new -sha256 -key $CERT.key \
openssl req -new -sha256 -key <(pass $PREFIX/$CERT.key) \
-subj "/C=FR/O=Deuxfleurs/CN=$APP" \
-out $CERT.csr
openssl req -in $CERT.csr -noout -text
openssl x509 -req -in $CERT.csr \
-out /tmp/tmp-$CLUSTER-$CERT.csr
openssl req -in /tmp/tmp-$CLUSTER-$CERT.csr -noout -text
openssl x509 -req -in /tmp/tmp-$CLUSTER-$CERT.csr \
-extensions v3_req \
-extfile <(cat <<EOF
[req]
@ -69,23 +63,25 @@ DNS.3 = localhost
DNS.4 = 127.0.0.1
EOF
) \
-CA $APP-ca.crt -CAkey $APP-ca.key -CAcreateserial \
-out $CERT.crt -days 700
rm $CERT.csr
-CA <(pass $PREFIX/$APP-ca.crt) \
-CAkey <(pass $PREFIX/$APP-ca.key) -CAcreateserial \
-CAserial /tmp/tmp-$CLUSTER-$CERT.srl \
-days 700 \
| pass insert -m $PREFIX/$CERT.crt
rm /tmp/tmp-$CLUSTER-$CERT.{csr,srl}
fi
# 3. Create client-only certificate used for the CLI
if [ ! -f $CERT-client.crt ]; then
if ! pass $PREFIX/$CERT-client.crt >/dev/null; then
echo "Generating $CERT client keys..."
if [ ! -f $CERT-client.key ]; then
#openssl genpkey -algorithm ED25519 -out $CERT-client.key
openssl genrsa -out $CERT-client.key 4096
if ! pass $PREFIX/$CERT-client.key >/dev/null; then
openssl genrsa 4096 | pass insert -m $PREFIX/$CERT-client.key
fi
openssl req -new -sha256 -key $CERT-client.key \
openssl req -new -sha256 -key <(pass $PREFIX/$CERT-client.key) \
-subj "/C=FR/O=Deuxfleurs/CN=$APP-client" \
-out $CERT-client.csr
openssl req -in $CERT-client.csr -noout -text
openssl x509 -req -in $CERT-client.csr \
-out /tmp/tmp-$CLUSTER-$CERT-client.csr
openssl req -in /tmp/tmp-$CLUSTER-$CERT-client.csr -noout -text
openssl x509 -req -in /tmp/tmp-$CLUSTER-$CERT-client.csr \
-extensions v3_req \
-extfile <(cat <<EOF
[req]
@ -107,9 +103,12 @@ subjectAltName = @alt_names
DNS.1 = client.$CLUSTER.$APP
EOF
) \
-CA $APP-ca.crt -CAkey $APP-ca.key -CAcreateserial \
-out $CERT-client.crt -days 700
rm $CERT-client.csr
-CA <(pass $PREFIX/$APP-ca.crt) \
-CAkey <(pass $PREFIX/$APP-ca.key) \
-CAcreateserial -days 700 \
-CAserial /tmp/tmp-$CLUSTER-$CERT-client.srl \
| pass insert -m $PREFIX/$CERT-client.crt
rm /tmp/tmp-$CLUSTER-$CERT-client.{csr,srl}
fi
#if [ ! -f $CERT-client.p12 ]; then