initial commit

deploy/tls/.gitignore

@@ -0,0 +1 @@
+*/

deploy/tls/Dockerfile

@@ -0,0 +1,7 @@
+FROM alpine:3.11
+ENTRYPOINT [ "/entrypoint.sh" ]
+
+RUN apk add --no-cache --update --upgrade ca-certificates postgresql-client
+RUN apk add --no-cache --update --upgrade --repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing cfssl
+
+COPY . .

deploy/tls/ca-config.json

@@ -0,0 +1,17 @@
+{
+  "signing": {
+    "default": {
+      "expiry": "168h"
+    },
+    "profiles": {
+      "server": {
+        "expiry": "8760h",
+        "usages": ["signing", "key encipherment", "server auth"]
+      },
+      "signing": {
+        "expiry": "8760h",
+        "usages": ["signing", "key encipherment"]
+      }
+    }
+  }
+}

deploy/tls/ca.in.json

@@ -0,0 +1,12 @@
+{
+  "CN": "Autogenerated CA",
+  "key": {
+    "algo": "rsa",
+    "size": 2048
+  },
+  "names": [
+    {
+      "L": "@FACILITY@"
+    }
+  ]
+}

deploy/tls/entrypoint.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env sh
+
+# set -o errexit -o nounset -o pipefail
+
+if [ -z "${TINKERBELL_TLS_CERT:-}" ]; then
+	(
+		echo "creating directory"
+		mkdir -p "certs"
+		./gencerts.sh
+	)
+fi
+
+"$@"

deploy/tls/gencerts.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env sh
+
+set -eux
+
+cd /certs
+
+if [ ! -f ca-key.pem ]; then
+	cfssl gencert \
+		-initca ca.json | cfssljson -bare ca
+fi
+
+if [ ! -f server.pem ]; then
+	cfssl gencert \
+		-ca=ca.pem \
+		-ca-key=ca-key.pem \
+		-config=/ca-config.json \
+		-profile=server \
+		server-csr.json |
+		cfssljson -bare server
+fi
+
+cat server.pem ca.pem >bundle.pem.tmp
+
+# only "modify" the file if truly necessary since workflow will serve it with
+# modtime info for client caching purposes
+if ! cmp -s bundle.pem.tmp bundle.pem; then
+	mv bundle.pem.tmp bundle.pem
+else
+	rm bundle.pem.tmp
+fi

deploy/tls/server-csr.in.json

@@ -0,0 +1,19 @@
+{
+  "CN": "tinkerbell",
+  "hosts": [
+    "tinkerbell.registry",
+    "tinkerbell.tinkerbell",
+    "tinkerbell",
+    "localhost",
+    "127.0.0.1"
+  ],
+  "key": {
+    "algo": "rsa",
+    "size": 2048
+  },
+  "names": [
+    {
+      "L": "@FACILITY@"
+    }
+  ]
+}