tixie/nixcfg
1
0
Fork 0
forked from Deuxfleurs/nixcfg
Code Pull requests Activity

Move pki to pass

Browse source
This commit is contained in:
Alex 2022-04-20 15:03:04 +02:00
parent a8717f9bf5
commit 7c1444b714
Signed by untrusted user: lx
GPG key ID: 0E496D15096376BE
2 changed files with 40 additions and 41 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
deploy_pki
View file

@ -1,13 +1,13 @@
#!/usr/bin/env ./sshtool #!/usr/bin/env ./sshtool
PKI=cluster/$CLUSTER/secrets/pki PKI=deuxfleurs/cluster/$CLUSTER
YEAR=$(date +%Y) YEAR=$(date +%Y)
cmd mkdir -p /var/lib/nomad/pki /var/lib/consul/pki cmd mkdir -p /var/lib/nomad/pki /var/lib/consul/pki
for file in consul-ca.crt consul$YEAR.crt consul$YEAR.key consul$YEAR-client.crt consul$YEAR-client.key; do for file in consul-ca.crt consul$YEAR.crt consul$YEAR.key consul$YEAR-client.crt consul$YEAR-client.key; do
if [ -f "$PKI/$file" ]; then if pass $PKI/$file >/dev/null; then
copy_secret $PKI/$file /var/lib/consul/pki/$file write_pass $PKI/$file /var/lib/consul/pki/$file
cmd chown consul:root /var/lib/consul/pki/$file cmd chown consul:root /var/lib/consul/pki/$file
fi fi
done done
@ -16,8 +16,8 @@ cmd systemctl restart consul
cmd sleep 10 cmd sleep 10
for file in nomad-ca.crt nomad$YEAR.crt nomad$YEAR.key; do for file in nomad-ca.crt nomad$YEAR.crt nomad$YEAR.key; do
if [ -f "$PKI/$file" ]; then if pass $PKI/$file >/dev/null; then
copy_secret $PKI/$file /var/lib/nomad/pki/$file write_pass $PKI/$file /var/lib/nomad/pki/$file
fi fi
done done

71
genpki.sh → gen_pki
View file

@ -1,8 +1,6 @@
#!/bin/bash #!/usr/bin/env sh
set -xe set -ex
# Enter proper cluster subdirectory
cd $(dirname $0) cd $(dirname $0)
@ -13,38 +11,34 @@ if [ -z "$CLUSTER" ] || [ ! -d "cluster/$CLUSTER" ]; then
exit 1 exit 1
fi fi
cd cluster/$CLUSTER PREFIX="deuxfleurs/cluster/$CLUSTER"
mkdir -p secrets/pki
cd secrets/pki
# Do actual stuff
YEAR=$(date +%Y) YEAR=$(date +%Y)
for APP in consul nomad; do for APP in consul nomad; do
# 1. Create certificate authority # 1. Create certificate authority
if [ ! -f $APP-ca.key ]; then if ! pass $PREFIX/$APP-ca.key >/dev/null; then
echo "Generating $APP CA keys..." echo "Generating $APP CA keys..."
#openssl genpkey -algorithm ED25519 -out $APP-ca.key openssl genrsa 4096 | pass insert -m $PREFIX/$APP-ca.key
openssl genrsa -out $APP-ca.key 4096
openssl req -x509 -new -nodes -key $APP-ca.key -sha256 -days 3650 -out $APP-ca.crt -subj "/C=FR/O=Deuxfleurs/CN=$APP" openssl req -x509 -new -nodes \
-key <(pass $PREFIX/$APP-ca.key) -sha256 \
-days 3650 -subj "/C=FR/O=Deuxfleurs/CN=$APP" \
| pass insert -m -f $PREFIX/$APP-ca.crt
fi fi
CERT="${APP}${YEAR}" CERT="${APP}${YEAR}"
# 2. Create and sign certificates for inter-node communication # 2. Create and sign certificates for inter-node communication
if [ ! -f $CERT.crt ]; then if ! pass $PREFIX/$CERT.crt >/dev/null; then
echo "Generating $CERT agent keys..." echo "Generating $CERT agent keys..."
if [ ! -f $CERT.key ]; then if ! pass $PREFIX/$CERT.key >/dev/null; then
#openssl genpkey -algorithm ED25519 -out $CERT.key openssl genrsa 4096 | pass insert -m $PREFIX/$CERT.key
openssl genrsa -out $CERT.key 4096
fi fi
openssl req -new -sha256 -key $CERT.key \ openssl req -new -sha256 -key <(pass $PREFIX/$CERT.key) \
-subj "/C=FR/O=Deuxfleurs/CN=$APP" \ -subj "/C=FR/O=Deuxfleurs/CN=$APP" \
-out $CERT.csr -out /tmp/tmp-$CLUSTER-$CERT.csr
openssl req -in $CERT.csr -noout -text openssl req -in /tmp/tmp-$CLUSTER-$CERT.csr -noout -text
openssl x509 -req -in $CERT.csr \ openssl x509 -req -in /tmp/tmp-$CLUSTER-$CERT.csr \
-extensions v3_req \ -extensions v3_req \
-extfile <(cat <<EOF -extfile <(cat <<EOF
[req] [req]
@ -69,23 +63,25 @@ DNS.3 = localhost
DNS.4 = 127.0.0.1 DNS.4 = 127.0.0.1
EOF EOF
) \ ) \
-CA $APP-ca.crt -CAkey $APP-ca.key -CAcreateserial \ -CA <(pass $PREFIX/$APP-ca.crt) \
-out $CERT.crt -days 700 -CAkey <(pass $PREFIX/$APP-ca.key) -CAcreateserial \
rm $CERT.csr -CAserial /tmp/tmp-$CLUSTER-$CERT.srl \
-days 700 \
| pass insert -m $PREFIX/$CERT.crt
rm /tmp/tmp-$CLUSTER-$CERT.{csr,srl}
fi fi
# 3. Create client-only certificate used for the CLI # 3. Create client-only certificate used for the CLI
if [ ! -f $CERT-client.crt ]; then if ! pass $PREFIX/$CERT-client.crt >/dev/null; then
echo "Generating $CERT client keys..." echo "Generating $CERT client keys..."
if [ ! -f $CERT-client.key ]; then if ! pass $PREFIX/$CERT-client.key >/dev/null; then
#openssl genpkey -algorithm ED25519 -out $CERT-client.key openssl genrsa 4096 | pass insert -m $PREFIX/$CERT-client.key
openssl genrsa -out $CERT-client.key 4096
fi fi
openssl req -new -sha256 -key $CERT-client.key \ openssl req -new -sha256 -key <(pass $PREFIX/$CERT-client.key) \
-subj "/C=FR/O=Deuxfleurs/CN=$APP-client" \ -subj "/C=FR/O=Deuxfleurs/CN=$APP-client" \
-out $CERT-client.csr -out /tmp/tmp-$CLUSTER-$CERT-client.csr
openssl req -in $CERT-client.csr -noout -text openssl req -in /tmp/tmp-$CLUSTER-$CERT-client.csr -noout -text
openssl x509 -req -in $CERT-client.csr \ openssl x509 -req -in /tmp/tmp-$CLUSTER-$CERT-client.csr \
-extensions v3_req \ -extensions v3_req \
-extfile <(cat <<EOF -extfile <(cat <<EOF
[req] [req]
@ -107,9 +103,12 @@ subjectAltName = @alt_names
DNS.1 = client.$CLUSTER.$APP DNS.1 = client.$CLUSTER.$APP
EOF EOF
) \ ) \
-CA $APP-ca.crt -CAkey $APP-ca.key -CAcreateserial \ -CA <(pass $PREFIX/$APP-ca.crt) \
-out $CERT-client.crt -days 700 -CAkey <(pass $PREFIX/$APP-ca.key) \
rm $CERT-client.csr -CAcreateserial -days 700 \
-CAserial /tmp/tmp-$CLUSTER-$CERT-client.srl \
| pass insert -m $PREFIX/$CERT-client.crt
rm /tmp/tmp-$CLUSTER-$CERT-client.{csr,srl}
fi fi
#if [ ! -f $CERT-client.p12 ]; then #if [ ! -f $CERT-client.p12 ]; then