prelöoad experiment

scripts/generate-cert.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# Generate a self-signed TLS cert for local HTTPS (Vite on :4308).
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+CERT_DIR="${CERT_DIR:-$ROOT/certs}"
+DAYS="${CERT_DAYS:-825}"
+KEY="$CERT_DIR/key.pem"
+CERT="$CERT_DIR/cert.pem"
+CNF="$CERT_DIR/openssl.cnf"
+
+mkdir -p "$CERT_DIR"
+
+# Extra hostnames / IPs: ./scripts/generate-cert.sh 192.168.188.22 myhost.local
+EXTRA=("$@")
+
+SAN="DNS:localhost,IP:127.0.0.1"
+for entry in "${EXTRA[@]}"; do
+  if [[ "$entry" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+    SAN+=",IP:$entry"
+  else
+    SAN+=",DNS:$entry"
+  fi
+done
+
+# Include non-loopback IPv4 addresses so LAN / WebView origins work.
+while read -r ip; do
+  [[ -n "$ip" ]] || continue
+  [[ "$SAN" == *",$ip"* || "$SAN" == *"IP:$ip"* ]] && continue
+  SAN+=",IP:$ip"
+done < <(hostname -I 2>/dev/null | tr ' ' '\n' | grep -E '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$' || true)
+
+cat >"$CNF" <<EOF
+[req]
+default_bits = 2048
+prompt = no
+default_md = sha256
+distinguished_name = dn
+x509_extensions = v3_req
+
+[dn]
+CN = localhost
+
+[v3_req]
+subjectAltName = $SAN
+keyUsage = digitalSignature, keyEncipherment
+extendedKeyUsage = serverAuth
+EOF
+
+openssl req -x509 -newkey rsa:2048 -sha256 -days "$DAYS" -nodes \
+  -keyout "$KEY" \
+  -out "$CERT" \
+  -config "$CNF"
+
+chmod 600 "$KEY"
+rm -f "$CNF"
+
+# Base64(DER) — preferred QR payload (plain text, no JSON/URL/PEM wrappers).
+DER_B64="$(openssl x509 -in "$CERT" -outform DER | base64 -w0)"
+printf '%s\n' "$DER_B64" >"$CERT_DIR/cert.der.b64"
+
+echo "Wrote $CERT"
+echo "Wrote $KEY"
+echo "Wrote $CERT_DIR/cert.der.b64"
+echo "SAN: $SAN"
+echo "Valid for $DAYS days."
+echo
+echo "=== certificate ==="
+openssl x509 -in "$CERT" -noout -subject -issuer -dates -fingerprint -sha256 -ext subjectAltName
+echo
+echo "=== QR (base64 DER, raw payload) ==="
+printf '%s' "$DER_B64" | node "$ROOT/scripts/qr-cert.mjs"
+echo
+echo "Start HTTPS: npm run dev:https"
+echo "URL: https://localhost:4308/"