u

2026-07-15 01:25:38 +02:00
parent 7fa839da4d
commit 056c9e18cd
21 changed files with 1181 additions and 64 deletions
--- a/scripts/s3-backup/ensure-certs.mjs
+++ b/scripts/s3-backup/ensure-certs.mjs
@@ -0,0 +1,109 @@
+import { execSync, spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+import { CA_CERT, CERTS_DIR, HOST, SERVER_CERT, SERVER_KEY } from './config.mjs';
+
+export function certHosts(host) {
+  const hosts = new Set([host, '127.0.0.1', 'localhost']);
+  for (const iface of Object.values(os.networkInterfaces())) {
+    for (const addr of iface || []) {
+      if (addr.family === 'IPv4' && !addr.internal) {
+        hosts.add(addr.address);
+      }
+    }
+  }
+  return [...hosts];
+}
+
+export function ensureCerts(host = HOST) {
+  fs.mkdirSync(CERTS_DIR, { recursive: true });
+  const hosts = certHosts(host);
+  const marker = path.join(CERTS_DIR, 'hosts.txt');
+  const hostList = hosts.join('\n');
+  if (
+    fs.existsSync(SERVER_CERT) &&
+    fs.existsSync(SERVER_KEY) &&
+    fs.existsSync(CA_CERT) &&
+    fs.existsSync(marker) &&
+    fs.readFileSync(marker, 'utf8') === hostList
+  ) {
+    return;
+  }
+
+  const cnf = `${CERTS_DIR}/openssl.cnf`;
+  const altNames = hosts
+    .map((h, i) => (/^\d+\./.test(h) ? `IP.${i + 1} = ${h}` : `DNS.${i + 1} = ${h}`))
+    .join('\n');
+
+  fs.writeFileSync(
+    cnf,
+    `[req]
+distinguished_name = req_distinguished_name
+x509_extensions = v3_req
+prompt = no
+
+[req_distinguished_name]
+CN = ${host}
+
+[v3_req]
+subjectAltName = @alt_names
+basicConstraints = CA:FALSE
+keyUsage = digitalSignature, keyEncipherment
+extendedKeyUsage = serverAuth
+
+[alt_names]
+${altNames}
+`
+  );
+
+  execSync(
+    `openssl req -x509 -newkey rsa:2048 -nodes -days 3650 \
+      -keyout "${CERTS_DIR}/ca-key.pem" -out "${CA_CERT}" \
+      -subj "/CN=JTL S3 Backup CA/O=JTL/C=DE"`,
+    { stdio: 'pipe' }
+  );
+
+  execSync(
+    `openssl req -newkey rsa:2048 -nodes \
+      -keyout "${SERVER_KEY}" -out "${CERTS_DIR}/server.csr" \
+      -config "${cnf}"`,
+    { stdio: 'pipe' }
+  );
+
+  execSync(
+    `openssl x509 -req -in "${CERTS_DIR}/server.csr" \
+      -CA "${CA_CERT}" -CAkey "${CERTS_DIR}/ca-key.pem" -CAcreateserial \
+      -out "${SERVER_CERT}" -days 3650 -extensions v3_req -extfile "${cnf}"`,
+    { stdio: 'pipe' }
+  );
+  fs.writeFileSync(marker, hostList);
+}
+
+export function installCaTrust(container = process.env.MSSQL_DOCKER_CONTAINER || 'mssql') {
+  if (!fs.existsSync(CA_CERT)) {
+    ensureCerts();
+  }
+
+  const copied = spawnSync('docker', ['cp', CA_CERT, `${container}:/tmp/jtlsrv-s3-ca.pem`], {
+    stdio: 'pipe',
+  });
+  if (copied.status !== 0) {
+    return false;
+  }
+  const installed = spawnSync(
+    'docker',
+    [
+      'exec',
+      '-u',
+      'root',
+      container,
+      'bash',
+      '-lc',
+      'cp /tmp/jtlsrv-s3-ca.pem /usr/local/share/ca-certificates/jtlsrv-s3.crt && update-ca-certificates',
+    ],
+    { stdio: 'pipe' }
+  );
+  return installed.status === 0;
+}