martin/ProxmoxVE
1
0
Fork 0
mirror of https://github.com/community-scripts/ProxmoxVE synced 2025-02-07 00:09:18 +00:00
Code Issues Actions 7 Packages Projects Releases Wiki Activity

Setup remote management for policies

Browse Source
This commit is contained in:
fwiegerinck 2025-01-18 00:40:28 +01:00
parent 0e1f064287
commit 8769ebc969
1 changed files with 47 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

62
install/alpine-step-ca-install.sh
View File

@ -28,8 +28,8 @@ if [ "$VERBOSE" = "yes" ]; then
env #Display environment details env #Display environment details
fi fi
x509_policy_dns=($(echo "${CA_X509_POLICY_DNS}" | tr ' ' '\n')) #x509_policy_dns=($(echo "${CA_X509_POLICY_DNS}" | tr ' ' '\n'))
x509_policy_ips=($(echo "${CA_X509_POLICY_IPS}" | tr ' ' '\n')) #x509_policy_ips=($(echo "${CA_X509_POLICY_IPS}" | tr ' ' '\n'))
msg_ok "Environment prepared" msg_ok "Environment prepared"
@ -40,41 +40,73 @@ msg_ok "Installed Alpine Step-CA"
# Initialize CA # Initialize CA
config_dir="/etc/step-ca" config_dir="/etc/step-ca"
passwd_file="${config_dir}/password.txt" passwd_file="${config_dir}/password.txt"
ca_admin_provisioner="Admin JWK"
ca_admin_subject="admin@localhost"
ca_admin_provisioner_passwd_file="${config_dir}/admin-jwk-password.txt"
msg_info "Generate CA secrets" msg_info "Generate CA secrets"
CA_PASS="$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-13)" CA_PASS="$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-13)"
$STD cat <<EOF >${passwd_file} $STD cat <<EOF >${passwd_file}
${CA_PASS} ${CA_PASS}
EOF EOF
CA_ADMIN_PASS="$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-13)"
$STD cat <<EOF >${ca_admin_provisioner_passwd_file}
${CA_ADMIN_PASS}
EOF
chmod 600 ${passwd_file}
chmod 600 ${ca_admin_provisioner_passwd_file}
msg_ok "Generated CA secrets" msg_ok "Generated CA secrets"
msg_info "Initialize base CA" msg_info "Initialize base CA"
$STD step ca init --name "${CA_NAME}" $CA_DNS --password-file ${passwd_file} --deployment-type standalone --address ":443" --provisioner admin
#for dns_entry in "${x509_policy_dns[@]}"; do # Do initialize and immediately start it for further configuration
# $STD step ca policy authority x509 allow dns "${dns_entry}" $STD step ca init --name "${CA_NAME}" --dns localhost $CA_DNS --password-file ${passwd_file} --deployment-type standalone --address ":443" --provisioner "${ca_admin_provisioner}" --admin-subject "${ca_admin_subject}" --provisioner-password-file ${ca_admin_provisioner_passwd_file} --remote-management
#done $STD rc-service step-ca start
#for ip_entry in "${x509_policy_ips[@]}"; do
# $STD step ca policy authority x509 allow ip ${ip_entry} # Verify whether CA policy is requested
#done if [ -n "${CA_X509_POLICY_DNS}" ] || [ -n "${CA_X509_POLICY_IPS}" ]; then
# Ensure admin subject is added to the allow list
$STD step ca policy authority x509 allow dns "${ca_admin_subject}" --admin-provisioner "${ca_admin_provisioner}" --admin-subject "${ca_admin_subject}" --password-file ${ca_admin_provisioner_passwd_file}
if [ -n "${CA_X509_POLICY_DNS}" ]; then
$STD step ca policy authority x509 allow dns ${CA_X509_POLICY_DNS} --admin-provisioner "${ca_admin_provisioner}" --admin-subject "${ca_admin_subject}" --password-file ${ca_admin_provisioner_passwd_file}
fi
if [ -n "${CA_X509_POLICY_IPS}" ]; then
$STD step ca policy authority x509 allow ip ${CA_X509_POLICY_IPS} --admin-provisioner "${ca_admin_provisioner}" --admin-subject "${ca_admin_subject}" --password-file ${ca_admin_provisioner_passwd_file}
fi
#for dns_entry in "${x509_policy_dns[@]}"; do
# $STD step ca policy authority x509 allow dns "${dns_entry}"
#done
#for ip_entry in "${x509_policy_ips[@]}"; do
# $STD step ca policy authority x509 allow ip ${ip_entry}
#done
fi
if [ "${CA_ACME}" = "yes" ]; then if [ "${CA_ACME}" = "yes" ]; then
msg_info "Initialize ACME for CA" msg_info "Initialize ACME for CA"
$STD step ca provisioner add ${CA_ACME_NAME} --type ACME --x509-min-dur=20m --x509-max-dur=32h --x509-default-dur=24h $STD step ca provisioner add "${CA_ACME_NAME}" --type ACME --x509-min-dur=20m --x509-max-dur=32h --x509-default-dur=24h --admin-provisioner "${ca_admin_provisioner}" --admin-subject "${ca_admin_subject}" --password-file ${ca_admin_provisioner_passwd_file}
fi fi
msg_ok "Finished initialization of CA" msg_ok "Finished initialization of CA"
# Start application # Start application
msg_info "Starting Alpine Step-CA" msg_info "Starting Alpine Step-CA"
$STD rc-service step-ca start $STD rc-service step-ca restart
$STD rc-update add step-ca default $STD rc-update add step-ca default
msg_ok "Started Alpine Step-CA" msg_ok "Started Alpine Step-CA"
motd_ssh motd_ssh
# Extend motd with step-ca fingerprint of root CA
# add fingerprint to motd MOTD_FILE="/etc/motd"
ca_root_fingerprint=$(step certificate fingerprint ${STEPPATH}/certs/root_ca.crt) if [ -f "$MOTD_FILE" ]; then
echo -e "${TAB}${DEFAULT}${YW} Fingerprint CA Root Certificate: ${GN}${ca_root_fingerprint}${CL}" >> /etc/motd ca_root_fingerprint=$(step certificate fingerprint ${STEPPATH}/certs/root_ca.crt)
echo -e "\n${TAB}${DEFAULT}${YW} Fingerprint CA Root Certificate: ${GN}${ca_root_fingerprint}${CL}" >> "$MOTD_FILE"
fi
customize customize