110 lines
2.7 KiB
JavaScript
110 lines
2.7 KiB
JavaScript
import { execSync, spawnSync } from 'node:child_process';
|
|
import fs from 'node:fs';
|
|
import os from 'node:os';
|
|
import path from 'node:path';
|
|
|
|
import { CA_CERT, CERTS_DIR, HOST, SERVER_CERT, SERVER_KEY } from './config.mjs';
|
|
|
|
export function certHosts(host) {
|
|
const hosts = new Set([host, '127.0.0.1', 'localhost']);
|
|
for (const iface of Object.values(os.networkInterfaces())) {
|
|
for (const addr of iface || []) {
|
|
if (addr.family === 'IPv4' && !addr.internal) {
|
|
hosts.add(addr.address);
|
|
}
|
|
}
|
|
}
|
|
return [...hosts];
|
|
}
|
|
|
|
export function ensureCerts(host = HOST) {
|
|
fs.mkdirSync(CERTS_DIR, { recursive: true });
|
|
const hosts = certHosts(host);
|
|
const marker = path.join(CERTS_DIR, 'hosts.txt');
|
|
const hostList = hosts.join('\n');
|
|
if (
|
|
fs.existsSync(SERVER_CERT) &&
|
|
fs.existsSync(SERVER_KEY) &&
|
|
fs.existsSync(CA_CERT) &&
|
|
fs.existsSync(marker) &&
|
|
fs.readFileSync(marker, 'utf8') === hostList
|
|
) {
|
|
return;
|
|
}
|
|
|
|
const cnf = `${CERTS_DIR}/openssl.cnf`;
|
|
const altNames = hosts
|
|
.map((h, i) => (/^\d+\./.test(h) ? `IP.${i + 1} = ${h}` : `DNS.${i + 1} = ${h}`))
|
|
.join('\n');
|
|
|
|
fs.writeFileSync(
|
|
cnf,
|
|
`[req]
|
|
distinguished_name = req_distinguished_name
|
|
x509_extensions = v3_req
|
|
prompt = no
|
|
|
|
[req_distinguished_name]
|
|
CN = ${host}
|
|
|
|
[v3_req]
|
|
subjectAltName = @alt_names
|
|
basicConstraints = CA:FALSE
|
|
keyUsage = digitalSignature, keyEncipherment
|
|
extendedKeyUsage = serverAuth
|
|
|
|
[alt_names]
|
|
${altNames}
|
|
`
|
|
);
|
|
|
|
execSync(
|
|
`openssl req -x509 -newkey rsa:2048 -nodes -days 3650 \
|
|
-keyout "${CERTS_DIR}/ca-key.pem" -out "${CA_CERT}" \
|
|
-subj "/CN=JTL S3 Backup CA/O=JTL/C=DE"`,
|
|
{ stdio: 'pipe' }
|
|
);
|
|
|
|
execSync(
|
|
`openssl req -newkey rsa:2048 -nodes \
|
|
-keyout "${SERVER_KEY}" -out "${CERTS_DIR}/server.csr" \
|
|
-config "${cnf}"`,
|
|
{ stdio: 'pipe' }
|
|
);
|
|
|
|
execSync(
|
|
`openssl x509 -req -in "${CERTS_DIR}/server.csr" \
|
|
-CA "${CA_CERT}" -CAkey "${CERTS_DIR}/ca-key.pem" -CAcreateserial \
|
|
-out "${SERVER_CERT}" -days 3650 -extensions v3_req -extfile "${cnf}"`,
|
|
{ stdio: 'pipe' }
|
|
);
|
|
fs.writeFileSync(marker, hostList);
|
|
}
|
|
|
|
export function installCaTrust(container = process.env.MSSQL_DOCKER_CONTAINER || 'mssql') {
|
|
if (!fs.existsSync(CA_CERT)) {
|
|
ensureCerts();
|
|
}
|
|
|
|
const copied = spawnSync('docker', ['cp', CA_CERT, `${container}:/tmp/jtlsrv-s3-ca.pem`], {
|
|
stdio: 'pipe',
|
|
});
|
|
if (copied.status !== 0) {
|
|
return false;
|
|
}
|
|
const installed = spawnSync(
|
|
'docker',
|
|
[
|
|
'exec',
|
|
'-u',
|
|
'root',
|
|
container,
|
|
'bash',
|
|
'-lc',
|
|
'cp /tmp/jtlsrv-s3-ca.pem /usr/local/share/ca-certificates/jtlsrv-s3.crt && update-ca-certificates',
|
|
],
|
|
{ stdio: 'pipe' }
|
|
);
|
|
return installed.status === 0;
|
|
}
|