mirror of
https://github.com/absmach/supermq.git
synced 2026-06-23 06:40:19 +00:00
NOISSUE - Update to using OpenBao in certs service (#259)
* chore: update smq dep Signed-off-by: Felix Gateru <felix.gateru@gmail.com> * chore: remove am-certs and replace with open-bao Signed-off-by: Felix Gateru <felix.gateru@gmail.com> * refactor: remove vault references Signed-off-by: Felix Gateru <felix.gateru@gmail.com> --------- Signed-off-by: Felix Gateru <felix.gateru@gmail.com>
This commit is contained in:
Felix Gateru
GitHub
@@ -15,6 +15,3 @@ coverage
|
||||
|
||||
# Schemathesis
|
||||
.hypothesis
|
||||
|
||||
# Ignore Vault data directory as it contains runtime-generated data
|
||||
docker/addons/vault/data/
|
||||
|
||||
@@ -72,7 +72,7 @@ endef
|
||||
|
||||
ADDON_SERVICES = bootstrap provision certs timescale-reader timescale-writer postgres-reader postgres-writer
|
||||
|
||||
EXTERNAL_SERVICES = vault prometheus
|
||||
EXTERNAL_SERVICES = prometheus
|
||||
|
||||
ifneq ($(filter run%,$(firstword $(MAKECMDGOALS))),)
|
||||
temp_args := $(wordlist 2,$(words $(MAKECMDGOALS)),$(MAKECMDGOALS))
|
||||
|
||||
@@ -114,13 +114,13 @@ services:
|
||||
networks: !override
|
||||
- magistrala-base-net
|
||||
|
||||
am-certs-db:
|
||||
openbao:
|
||||
volumes:
|
||||
- ./addons/certs/prod-entrypoint.sh:/entrypoint.sh
|
||||
networks: !override
|
||||
- magistrala-base-net
|
||||
|
||||
am-certs:
|
||||
volumes: !override
|
||||
- ./addons/certs/config.yaml:/config/config.yaml
|
||||
certs-db:
|
||||
networks: !override
|
||||
- magistrala-base-net
|
||||
|
||||
|
||||
+26
-52
@@ -424,65 +424,18 @@ SMQ_WS_ADAPTER_CACHE_BUFFER_ITEMS=64
|
||||
SMQ_WS_ADAPTER_INSTANCE_ID=
|
||||
|
||||
## Addons Services
|
||||
### Vault
|
||||
SMQ_VAULT_HOST=vault
|
||||
SMQ_VAULT_PORT=8200
|
||||
SMQ_VAULT_ADDR=http://vault:8200
|
||||
SMQ_VAULT_NAMESPACE=supermq
|
||||
SMQ_VAULT_UNSEAL_KEY_1=
|
||||
SMQ_VAULT_UNSEAL_KEY_2=
|
||||
SMQ_VAULT_UNSEAL_KEY_3=
|
||||
SMQ_VAULT_TOKEN=
|
||||
|
||||
SMQ_VAULT_PKI_PATH=pki
|
||||
SMQ_VAULT_PKI_ROLE_NAME=supermq_int_ca
|
||||
SMQ_VAULT_PKI_FILE_NAME=mg_root
|
||||
SMQ_VAULT_PKI_CA_CN='SuperMQ Root Certificate Authority'
|
||||
SMQ_VAULT_PKI_CA_OU='SuperMQ'
|
||||
SMQ_VAULT_PKI_CA_O='SuperMQ'
|
||||
SMQ_VAULT_PKI_CA_C='FRANCE'
|
||||
SMQ_VAULT_PKI_CA_L='PARIS'
|
||||
SMQ_VAULT_PKI_CA_ST='PARIS'
|
||||
SMQ_VAULT_PKI_CA_ADDR='5 Av. Anatole'
|
||||
SMQ_VAULT_PKI_CA_PO='75007'
|
||||
SMQ_VAULT_PKI_CLUSTER_PATH=http://localhost
|
||||
SMQ_VAULT_PKI_CLUSTER_AIA_PATH=http://localhost
|
||||
|
||||
SMQ_VAULT_PKI_INT_PATH=pki_int
|
||||
SMQ_VAULT_PKI_INT_SERVER_CERTS_ROLE_NAME=supermq_server_certs
|
||||
SMQ_VAULT_PKI_INT_CLIENTS_CERTS_ROLE_NAME=supermq_clients_certs
|
||||
SMQ_VAULT_PKI_INT_FILE_NAME=mg_int
|
||||
SMQ_VAULT_PKI_INT_CA_CN='SuperMQ Intermediate Certificate Authority'
|
||||
SMQ_VAULT_PKI_INT_CA_OU='SuperMQ'
|
||||
SMQ_VAULT_PKI_INT_CA_O='SuperMQ'
|
||||
SMQ_VAULT_PKI_INT_CA_C='FRANCE'
|
||||
SMQ_VAULT_PKI_INT_CA_L='PARIS'
|
||||
SMQ_VAULT_PKI_INT_CA_ST='PARIS'
|
||||
SMQ_VAULT_PKI_INT_CA_ADDR='5 Av. Anatole'
|
||||
SMQ_VAULT_PKI_INT_CA_PO='75007'
|
||||
SMQ_VAULT_PKI_INT_CLUSTER_PATH=http://localhost
|
||||
SMQ_VAULT_PKI_INT_CLUSTER_AIA_PATH=http://localhost
|
||||
|
||||
SMQ_VAULT_CLIENTS_CERTS_ISSUER_ROLEID=supermq
|
||||
SMQ_VAULT_CLIENTS_CERTS_ISSUER_SECRET=supermq
|
||||
|
||||
# Certs
|
||||
SMQ_ADDONS_CERTS_PATH_PREFIX=./
|
||||
SMQ_CERTS_LOG_LEVEL=debug
|
||||
SMQ_CERTS_SIGN_CA_PATH=/etc/ssl/certs/ca.crt
|
||||
SMQ_CERTS_SIGN_CA_KEY_PATH=/etc/ssl/certs/ca.key
|
||||
SMQ_CERTS_VAULT_HOST=${SMQ_VAULT_ADDR}
|
||||
SMQ_CERTS_VAULT_NAMESPACE=${SMQ_VAULT_NAMESPACE}
|
||||
SMQ_CERTS_VAULT_APPROLE_ROLEID=${SMQ_VAULT_CLIENTS_CERTS_ISSUER_ROLEID}
|
||||
SMQ_CERTS_VAULT_APPROLE_SECRET=${SMQ_VAULT_CLIENTS_CERTS_ISSUER_SECRET}
|
||||
SMQ_CERTS_VAULT_CLIENTS_CERTS_PKI_PATH=${SMQ_VAULT_PKI_INT_PATH}
|
||||
SMQ_CERTS_VAULT_CLIENTS_CERTS_PKI_ROLE_NAME=${SMQ_VAULT_PKI_INT_CLIENTS_CERTS_ROLE_NAME}
|
||||
SMQ_CERTS_HTTP_HOST=certs
|
||||
SMQ_CERTS_HTTP_PORT=9019
|
||||
SMQ_CERTS_HTTP_SERVER_CERT=
|
||||
SMQ_CERTS_HTTP_SERVER_KEY=
|
||||
SMQ_CERTS_GRPC_HOST=
|
||||
SMQ_CERTS_GRPC_PORT=
|
||||
SMQ_CERTS_DB_HOST=am-certs-db
|
||||
SMQ_CERTS_DB_HOST=certs-db
|
||||
SMQ_CERTS_DB_PORT=5432
|
||||
SMQ_CERTS_DB_USER=supermq
|
||||
SMQ_CERTS_DB_PASS=supermq
|
||||
@@ -492,9 +445,30 @@ SMQ_CERTS_DB_SSL_CERT=
|
||||
SMQ_CERTS_DB_SSL_KEY=
|
||||
SMQ_CERTS_DB_SSL_ROOT_CERT=
|
||||
SMQ_CERTS_INSTANCE_ID=
|
||||
SMQ_CERTS_SDK_HOST=http://supermq-am-certs
|
||||
SMQ_CERTS_SDK_CERTS_URL=${SMQ_CERTS_SDK_HOST}:9010
|
||||
SMQ_CERTS_SDK_TLS_VERIFICATION=false
|
||||
|
||||
### OpenBao
|
||||
SMQ_OPENBAO_HOST=supermq-openbao
|
||||
SMQ_OPENBAO_PORT=8200
|
||||
SMQ_OPENBAO_ADDR=http://supermq-openbao:8200
|
||||
SMQ_OPENBAO_NAMESPACE=supermq
|
||||
SMQ_OPENBAO_UNSEAL_KEY_1=
|
||||
SMQ_OPENBAO_UNSEAL_KEY_2=
|
||||
SMQ_OPENBAO_UNSEAL_KEY_3=
|
||||
SMQ_OPENBAO_TOKEN=
|
||||
SMQ_OPENBAO_ROOT_TOKEN=openbao-root-token
|
||||
SMQ_OPENBAO_APP_ROLE=supermq
|
||||
SMQ_OPENBAO_APP_SECRET=supermq
|
||||
SMQ_OPENBAO_PKI_PATH=pki
|
||||
SMQ_OPENBAO_PKI_ROLE=supermq
|
||||
SMQ_OPENBAO_PKI_CA_CN='SuperMQ Root Certificate Authority'
|
||||
SMQ_OPENBAO_PKI_CA_OU='SuperMQ'
|
||||
SMQ_OPENBAO_PKI_CA_O='SuperMQ'
|
||||
SMQ_OPENBAO_PKI_CA_C='FRANCE'
|
||||
SMQ_OPENBAO_PKI_CA_L='PARIS'
|
||||
SMQ_OPENBAO_PKI_CA_ST='PARIS'
|
||||
SMQ_OPENBAO_PKI_CA_ADDR='5 Av. Anatole'
|
||||
SMQ_OPENBAO_PKI_CA_PO='75007'
|
||||
SMQ_OPENBAO_PKI_ROLE_NAME=supermq
|
||||
|
||||
### Postgres
|
||||
SMQ_POSTGRES_HOST=supermq-postgres
|
||||
|
||||
@@ -0,0 +1,181 @@
|
||||
# OpenBao Configuration for SuperMQ
|
||||
|
||||
This directory contains both development and production OpenBao configurations for SuperMQ certificate management.
|
||||
|
||||
## Overview
|
||||
|
||||
Two entrypoint scripts are provided:
|
||||
|
||||
- **`dev-entrypoint.sh`**: Development mode with in-memory storage and simple setup
|
||||
- **`prod-entrypoint.sh`**: Production mode with persistent file storage and proper initialization
|
||||
|
||||
Both scripts use environment variables for flexible configuration, allowing you to customize OpenBao behavior without modifying the scripts directly. All configuration is centralized in the `.env` file using the `SMQ_OPENBAO_*` naming convention.
|
||||
|
||||
## Configuration Management
|
||||
|
||||
### Environment-Based Configuration
|
||||
All OpenBao configuration is managed through environment variables defined in `/docker/.env`. This approach provides:
|
||||
|
||||
- **Consistency**: All OpenBao variables use the `SMQ_OPENBAO_*` naming pattern
|
||||
- **Flexibility**: Easy customization without script modifications
|
||||
- **Security**: Sensitive values (tokens, keys) can be externally managed
|
||||
- **Development/Production Parity**: Same configuration approach for both environments
|
||||
|
||||
### Variable Organization
|
||||
Variables are logically grouped by function:
|
||||
- **Core**: Basic OpenBao server configuration
|
||||
- **Authentication**: AppRole and token configuration
|
||||
- **PKI Engine**: Certificate authority and PKI role settings
|
||||
- **PKI CA**: Certificate authority details (CN, organization, etc.)
|
||||
- **Unsealing**: Production unsealing keys and tokens
|
||||
|
||||
## Quick Start
|
||||
|
||||
### Development Mode (Default)
|
||||
```bash
|
||||
docker compose -f docker/docker-compose.yaml -f docker/addons/certs/docker-compose.yaml up -d openbao
|
||||
```
|
||||
|
||||
### Production Mode
|
||||
To switch to production mode, edit `docker-compose.yaml` and change:
|
||||
```yaml
|
||||
- ./dev-entrypoint.sh:/entrypoint.sh
|
||||
```
|
||||
to:
|
||||
```yaml
|
||||
- ./prod-entrypoint.sh:/entrypoint.sh
|
||||
```
|
||||
|
||||
Then start the service:
|
||||
```bash
|
||||
docker compose -f docker/docker-compose.yaml -f docker/addons/certs/docker-compose.yaml up -d openbao
|
||||
```
|
||||
|
||||
## Development Mode Features
|
||||
|
||||
- **In-memory storage**: No data persistence (resets on restart)
|
||||
- **Development server**: Uses `-dev` flag for simple setup
|
||||
- **Hardcoded tokens**: Uses predictable root token for easy access
|
||||
- **Quick setup**: Minimal configuration for development
|
||||
- **No unseal process**: Automatically unsealed
|
||||
|
||||
### Development Access
|
||||
- **Root Token**: `openbao-root-token` (or `SMQ_OPENBAO_ROOT_TOKEN` env var)
|
||||
- **Web UI**: http://localhost:8200/ui
|
||||
- **API**: http://localhost:8200
|
||||
|
||||
## Production Mode Features
|
||||
|
||||
- **File-based storage**: Persistent storage using file backend
|
||||
- **Proper initialization**: Uses unseal keys and root token
|
||||
- **Security policies**: Restricted access policies for PKI operations
|
||||
- **AppRole authentication**: Service-to-service authentication
|
||||
- **PKI engine**: Certificate authority for SuperMQ services
|
||||
- **Automatic unsealing**: Handles unsealing on container restart
|
||||
|
||||
### Production Security
|
||||
|
||||
#### Initial Setup
|
||||
- On first startup, OpenBao will be automatically initialized with 5 unseal keys and 1 root token
|
||||
- The initialization data is stored in `/opt/openbao/data/init.json`
|
||||
- **You must backup this file securely** - it contains the unseal keys and root token
|
||||
|
||||
#### Access Production Instance
|
||||
To get the root token and unseal keys:
|
||||
```bash
|
||||
docker exec supermq-openbao cat /opt/openbao/data/init.json
|
||||
```
|
||||
|
||||
Or to get just the root token:
|
||||
```bash
|
||||
docker exec supermq-openbao jq -r '.root_token' /opt/openbao/data/init.json
|
||||
```
|
||||
|
||||
#### Manual Operations
|
||||
```bash
|
||||
docker exec supermq-openbao bao status
|
||||
|
||||
docker exec supermq-openbao bao operator unseal <unseal-key>
|
||||
|
||||
docker exec supermq-openbao bao operator seal
|
||||
```
|
||||
|
||||
## Configuration Details
|
||||
|
||||
### Development Mode Configuration
|
||||
- **Storage**: In-memory (no persistence)
|
||||
- **Listener**: TCP on `0.0.0.0:8200` (TLS disabled)
|
||||
- **Authentication**: Simple root token
|
||||
- **PKI**: Basic setup for testing
|
||||
|
||||
### Production Mode Configuration
|
||||
- **Storage**: File backend at `/opt/openbao/data`
|
||||
- **Listener**: TCP on `0.0.0.0:8200` (TLS disabled for internal use)
|
||||
- **UI**: Enabled for administration
|
||||
- **Logging**: Info level
|
||||
- **Initialization**: 5 unseal keys, 3 required
|
||||
- **Authentication**: AppRole for services
|
||||
|
||||
### PKI Engine (Both Modes)
|
||||
- **Path**: `/pki`
|
||||
- **Root CA**: SuperMQ Root CA
|
||||
- **Certificate Role**: `supermq` role for service certificates
|
||||
- **Max TTL**: 720 hours (30 days) for dev, 87600 hours (10 years) for root CA in prod
|
||||
|
||||
### AppRole Authentication
|
||||
- **Role**: `supermq`
|
||||
- **Policies**: `pki-policy` (restricted PKI access)
|
||||
- **Token TTL**: 1 hour (renewable up to 4 hours)
|
||||
|
||||
## Environment Variables
|
||||
|
||||
### OpenBao Core Configuration
|
||||
- `SMQ_OPENBAO_HOST`: OpenBao server hostname (default: `supermq-openbao`)
|
||||
- `SMQ_OPENBAO_PORT`: OpenBao server port (default: `8200`)
|
||||
- `SMQ_OPENBAO_ADDR`: Full OpenBao server URL (default: `http://supermq-openbao:8200`)
|
||||
- `SMQ_OPENBAO_NAMESPACE`: OpenBao namespace
|
||||
- `SMQ_OPENBAO_ROOT_TOKEN`: Custom root token for development mode
|
||||
- `SMQ_OPENBAO_TOKEN`: Custom token for production mode
|
||||
- `SMQ_OPENBAO_UNSEAL_KEY_1`: First unseal key for production mode
|
||||
- `SMQ_OPENBAO_UNSEAL_KEY_2`: Second unseal key for production mode
|
||||
- `SMQ_OPENBAO_UNSEAL_KEY_3`: Third unseal key for production mode
|
||||
|
||||
### OpenBao Authentication Configuration
|
||||
- `SMQ_OPENBAO_APP_ROLE`: AppRole role ID for service authentication
|
||||
- `SMQ_OPENBAO_APP_SECRET`: AppRole secret ID for service authentication
|
||||
|
||||
### OpenBao PKI Configuration
|
||||
- `SMQ_OPENBAO_PKI_PATH`: PKI secrets engine path (default: `pki`)
|
||||
- `SMQ_OPENBAO_PKI_ROLE`: PKI role name for certificate issuance (default: `supermq`)
|
||||
- `SMQ_OPENBAO_PKI_ROLE_NAME`: PKI role name for certificate generation (default: `supermq`)
|
||||
|
||||
### OpenBao PKI Certificate Authority Configuration
|
||||
- `SMQ_OPENBAO_PKI_CA_CN`: Certificate Authority Common Name
|
||||
- `SMQ_OPENBAO_PKI_CA_OU`: Certificate Authority Organizational Unit
|
||||
- `SMQ_OPENBAO_PKI_CA_O`: Certificate Authority Organization
|
||||
- `SMQ_OPENBAO_PKI_CA_C`: Certificate Authority Country
|
||||
- `SMQ_OPENBAO_PKI_CA_L`: Certificate Authority Locality
|
||||
- `SMQ_OPENBAO_PKI_CA_ST`: Certificate Authority State/Province
|
||||
- `SMQ_OPENBAO_PKI_CA_ADDR`: Certificate Authority Street Address
|
||||
- `SMQ_OPENBAO_PKI_CA_PO`: Certificate Authority Postal Code
|
||||
|
||||
### Certs Service OpenBao Integration
|
||||
For the SuperMQ certs service, the following variables are used internally:
|
||||
- `SMQ_CERTS_OPENBAO_HOST`: Maps to `SMQ_OPENBAO_HOST` and `SMQ_OPENBAO_PORT`
|
||||
- `SMQ_CERTS_OPENBAO_APP_ROLE`: Maps to `SMQ_OPENBAO_APP_ROLE`
|
||||
- `SMQ_CERTS_OPENBAO_APP_SECRET`: Maps to `SMQ_OPENBAO_APP_SECRET`
|
||||
- `SMQ_CERTS_OPENBAO_NAMESPACE`: Maps to `SMQ_OPENBAO_NAMESPACE`
|
||||
- `SMQ_CERTS_OPENBAO_PKI_PATH`: Maps to `SMQ_OPENBAO_PKI_PATH`
|
||||
- `SMQ_CERTS_OPENBAO_ROLE`: Maps to `SMQ_OPENBAO_PKI_ROLE`
|
||||
|
||||
## Switching Between Modes
|
||||
|
||||
### To Switch to Production Mode:
|
||||
1. Edit `docker-compose.yaml`
|
||||
2. Change `./dev-entrypoint.sh:/entrypoint.sh` to `./prod-entrypoint.sh:/entrypoint.sh`
|
||||
3. Restart the container
|
||||
|
||||
### To Switch to Development Mode:
|
||||
1. Edit `docker-compose.yaml`
|
||||
2. Change `./prod-entrypoint.sh:/entrypoint.sh` to `./dev-entrypoint.sh:/entrypoint.sh`
|
||||
3. Restart the container
|
||||
@@ -1,20 +0,0 @@
|
||||
# Copyright (c) Abstract Machines
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
common_name: "AbstractMachines_Selfsigned_ca"
|
||||
organization:
|
||||
- "AbstractMacines"
|
||||
organizational_unit:
|
||||
- "AbstractMachines_ca"
|
||||
country:
|
||||
- "France"
|
||||
province:
|
||||
- "Paris"
|
||||
locality:
|
||||
- "Quai de Valmy"
|
||||
postal_code:
|
||||
- "75010 Paris"
|
||||
dns_names:
|
||||
- "localhost"
|
||||
ip_addresses:
|
||||
- "localhost"
|
||||
+72
@@ -0,0 +1,72 @@
|
||||
#!/bin/sh
|
||||
# Copyright (c) Abstract Machines
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
set -e
|
||||
|
||||
bao server -dev \
|
||||
-dev-root-token-id="${BAO_DEV_ROOT_TOKEN_ID}" \
|
||||
-dev-listen-address="0.0.0.0:8200" \
|
||||
-log-level=info &
|
||||
|
||||
BAO_PID=$!
|
||||
sleep 5
|
||||
|
||||
export BAO_ADDR=http://localhost:8200
|
||||
export BAO_TOKEN="${BAO_DEV_ROOT_TOKEN_ID}"
|
||||
|
||||
if [ -n "$SMQ_OPENBAO_NAMESPACE" ]; then
|
||||
export BAO_NAMESPACE=$SMQ_OPENBAO_NAMESPACE
|
||||
fi
|
||||
|
||||
bao auth enable approle 2>/dev/null || echo "AppRole already enabled"
|
||||
bao secrets enable -path=$SMQ_OPENBAO_PKI_PATH pki 2>/dev/null || echo "PKI already enabled"
|
||||
|
||||
bao secrets tune -max-lease-ttl=87600h $SMQ_OPENBAO_PKI_PATH >/dev/null 2>&1 || true
|
||||
bao write -field=certificate $SMQ_OPENBAO_PKI_PATH/root/generate/internal \
|
||||
common_name="$SMQ_OPENBAO_PKI_CA_CN" \
|
||||
organization="$SMQ_OPENBAO_PKI_CA_O" \
|
||||
ou="$SMQ_OPENBAO_PKI_CA_OU" \
|
||||
country="$SMQ_OPENBAO_PKI_CA_C" \
|
||||
locality="$SMQ_OPENBAO_PKI_CA_L" \
|
||||
province="$SMQ_OPENBAO_PKI_CA_ST" \
|
||||
street_address="$SMQ_OPENBAO_PKI_CA_ADDR" \
|
||||
postal_code="$SMQ_OPENBAO_PKI_CA_PO" \
|
||||
ttl=87600h >/dev/null 2>&1 || true
|
||||
|
||||
bao write $SMQ_OPENBAO_PKI_PATH/config/urls \
|
||||
issuing_certificates="http://localhost:8200/v1/$SMQ_OPENBAO_PKI_PATH/ca" \
|
||||
crl_distribution_points="http://localhost:8200/v1/$SMQ_OPENBAO_PKI_PATH/crl" >/dev/null 2>&1 || true
|
||||
|
||||
bao write $SMQ_OPENBAO_PKI_PATH/roles/$SMQ_OPENBAO_PKI_ROLE_NAME \
|
||||
allow_any_name=true enforce_hostnames=false allow_ip_sans=true \
|
||||
allow_localhost=true max_ttl=720h ttl=720h >/dev/null 2>&1 || true
|
||||
|
||||
cat > /tmp/policy.hcl << EOF
|
||||
path "$SMQ_OPENBAO_PKI_PATH/issue/$SMQ_OPENBAO_PKI_ROLE_NAME" { capabilities = ["create", "update"] }
|
||||
path "$SMQ_OPENBAO_PKI_PATH/certs" { capabilities = ["list"] }
|
||||
path "$SMQ_OPENBAO_PKI_PATH/cert/*" { capabilities = ["read"] }
|
||||
path "$SMQ_OPENBAO_PKI_PATH/revoke" { capabilities = ["create", "update"] }
|
||||
path "auth/token/renew-self" { capabilities = ["update"] }
|
||||
path "auth/token/lookup-self" { capabilities = ["read"] }
|
||||
EOF
|
||||
|
||||
bao policy write pki-policy /tmp/policy.hcl >/dev/null 2>&1 || true
|
||||
|
||||
bao write auth/approle/role/supermq \
|
||||
token_policies=pki-policy token_ttl=1h token_max_ttl=4h renewable=true \
|
||||
bind_secret_id=true >/dev/null 2>&1 || true
|
||||
|
||||
if [ -n "$SMQ_OPENBAO_APP_ROLE" ]; then
|
||||
bao write auth/approle/role/supermq/role-id role_id="$SMQ_OPENBAO_APP_ROLE" >/dev/null 2>&1 || true
|
||||
fi
|
||||
|
||||
if [ -n "$SMQ_OPENBAO_APP_SECRET" ]; then
|
||||
bao write auth/approle/role/supermq/custom-secret-id secret_id="$SMQ_OPENBAO_APP_SECRET" >/dev/null 2>&1 || true
|
||||
fi
|
||||
|
||||
echo "OpenBao configuration completed successfully!"
|
||||
echo "OpenBao is ready for SuperMQ on port 8200"
|
||||
echo "Root Token: ${BAO_DEV_ROOT_TOKEN_ID}"
|
||||
|
||||
wait $BAO_PID
|
||||
@@ -11,16 +11,31 @@ networks:
|
||||
name: supermq-base-net
|
||||
external: true
|
||||
|
||||
# Volumes for OpenBao data and configuration
|
||||
volumes:
|
||||
supermq-openbao-volume:
|
||||
supermq-certs-db-volume:
|
||||
|
||||
|
||||
services:
|
||||
certs-db:
|
||||
image: postgres:16.1-alpine
|
||||
container_name: supermq-certs-db
|
||||
restart: on-failure
|
||||
environment:
|
||||
POSTGRES_USER: ${SMQ_CERTS_DB_USER}
|
||||
POSTGRES_PASSWORD: ${SMQ_CERTS_DB_PASS}
|
||||
POSTGRES_DB: ${SMQ_CERTS_DB_NAME}
|
||||
networks:
|
||||
- supermq-base-net
|
||||
volumes:
|
||||
- supermq-certs-db-volume:/var/lib/postgresql/data
|
||||
|
||||
certs:
|
||||
image: supermq/certs:${SMQ_RELEASE_TAG}
|
||||
container_name: supermq-certs
|
||||
depends_on:
|
||||
- am-certs
|
||||
- openbao
|
||||
- certs-db
|
||||
restart: on-failure
|
||||
networks:
|
||||
- supermq-base-net
|
||||
@@ -30,12 +45,12 @@ services:
|
||||
SMQ_CERTS_LOG_LEVEL: ${SMQ_CERTS_LOG_LEVEL}
|
||||
SMQ_CERTS_SIGN_CA_PATH: ${SMQ_CERTS_SIGN_CA_PATH}
|
||||
SMQ_CERTS_SIGN_CA_KEY_PATH: ${SMQ_CERTS_SIGN_CA_KEY_PATH}
|
||||
SMQ_CERTS_VAULT_HOST: ${SMQ_CERTS_VAULT_HOST}
|
||||
SMQ_CERTS_VAULT_NAMESPACE: ${SMQ_CERTS_VAULT_NAMESPACE}
|
||||
SMQ_CERTS_VAULT_APPROLE_ROLEID: ${SMQ_CERTS_VAULT_APPROLE_ROLEID}
|
||||
SMQ_CERTS_VAULT_APPROLE_SECRET: ${SMQ_CERTS_VAULT_APPROLE_SECRET}
|
||||
SMQ_CERTS_VAULT_CLIENTS_CERTS_PKI_PATH: ${SMQ_CERTS_VAULT_CLIENTS_CERTS_PKI_PATH}
|
||||
SMQ_CERTS_VAULT_CLIENTS_CERTS_PKI_ROLE_NAME: ${SMQ_CERTS_VAULT_CLIENTS_CERTS_PKI_ROLE_NAME}
|
||||
SMQ_CERTS_OPENBAO_HOST: http://${SMQ_OPENBAO_HOST}:${SMQ_OPENBAO_PORT}
|
||||
SMQ_CERTS_OPENBAO_APP_ROLE: ${SMQ_OPENBAO_APP_ROLE}
|
||||
SMQ_CERTS_OPENBAO_APP_SECRET: ${SMQ_OPENBAO_APP_SECRET}
|
||||
SMQ_CERTS_OPENBAO_NAMESPACE: ${SMQ_OPENBAO_NAMESPACE}
|
||||
SMQ_CERTS_OPENBAO_PKI_PATH: ${SMQ_OPENBAO_PKI_PATH}
|
||||
SMQ_CERTS_OPENBAO_ROLE: ${SMQ_OPENBAO_PKI_ROLE}
|
||||
SMQ_CERTS_HTTP_HOST: ${SMQ_CERTS_HTTP_HOST}
|
||||
SMQ_CERTS_HTTP_PORT: ${SMQ_CERTS_HTTP_PORT}
|
||||
SMQ_CERTS_HTTP_SERVER_CERT: ${SMQ_CERTS_HTTP_SERVER_CERT}
|
||||
@@ -49,9 +64,6 @@ services:
|
||||
SMQ_CERTS_DB_SSL_CERT: ${SMQ_CERTS_DB_SSL_CERT}
|
||||
SMQ_CERTS_DB_SSL_KEY: ${SMQ_CERTS_DB_SSL_KEY}
|
||||
SMQ_CERTS_DB_SSL_ROOT_CERT: ${SMQ_CERTS_DB_SSL_ROOT_CERT}
|
||||
SMQ_CERTS_SDK_HOST: ${SMQ_CERTS_SDK_HOST}
|
||||
SMQ_CERTS_SDK_CERTS_URL: ${SMQ_CERTS_SDK_CERTS_URL}
|
||||
SMQ_CERTS_SDK_TLS_VERIFICATION: ${SMQ_CERTS_SDK_TLS_VERIFICATION}
|
||||
SMQ_AUTH_GRPC_URL: ${SMQ_AUTH_GRPC_URL}
|
||||
SMQ_AUTH_GRPC_TIMEOUT: ${SMQ_AUTH_GRPC_TIMEOUT}
|
||||
SMQ_AUTH_GRPC_CLIENT_CERT: ${SMQ_AUTH_GRPC_CLIENT_CERT:+/auth-grpc-client.crt}
|
||||
@@ -81,46 +93,41 @@ services:
|
||||
bind:
|
||||
create_host_path: true
|
||||
|
||||
am-certs-db:
|
||||
image: postgres:16.2-alpine
|
||||
container_name: supermq-am-certs-db
|
||||
openbao:
|
||||
image: openbao/openbao:latest
|
||||
container_name: supermq-openbao
|
||||
restart: on-failure
|
||||
networks:
|
||||
- supermq-base-net
|
||||
command: postgres -c "max_connections=${SMQ_POSTGRES_MAX_CONNECTIONS}"
|
||||
environment:
|
||||
POSTGRES_USER: ${SMQ_CERTS_DB_USER}
|
||||
POSTGRES_PASSWORD: ${SMQ_CERTS_DB_PASS}
|
||||
POSTGRES_DB: ${SMQ_CERTS_DB_NAME}
|
||||
ports:
|
||||
- 5454:5432
|
||||
volumes:
|
||||
- supermq-certs-db-volume:/var/lib/postgresql/data
|
||||
|
||||
am-certs:
|
||||
image: ghcr.io/absmach/certs:${SMQ_RELEASE_TAG}
|
||||
container_name: supermq-am-certs
|
||||
depends_on:
|
||||
- am-certs-db
|
||||
restart: on-failure
|
||||
networks:
|
||||
- supermq-base-net
|
||||
- ${SMQ_OPENBAO_PORT}:${SMQ_OPENBAO_PORT}
|
||||
environment:
|
||||
AM_CERTS_LOG_LEVEL: ${SMQ_CERTS_LOG_LEVEL}
|
||||
AM_CERTS_DB_HOST: ${SMQ_CERTS_DB_HOST}
|
||||
AM_CERTS_DB_PORT: ${SMQ_CERTS_DB_PORT}
|
||||
AM_CERTS_DB_USER: ${SMQ_CERTS_DB_USER}
|
||||
AM_CERTS_DB_PASS: ${SMQ_CERTS_DB_PASS}
|
||||
AM_CERTS_DB: ${SMQ_CERTS_DB_NAME}
|
||||
AM_CERTS_DB_SSL_MODE: ${SMQ_CERTS_DB_SSL_MODE}
|
||||
AM_CERTS_HTTP_HOST: supermq-am-certs
|
||||
AM_CERTS_HTTP_PORT: 9010
|
||||
AM_CERTS_GRPC_HOST: supermq-am-certs
|
||||
AM_CERTS_GRPC_PORT: 7012
|
||||
AM_JAEGER_URL: ${SMQ_JAEGER_URL}
|
||||
AM_JAEGER_TRACE_RATIO: ${SMQ_JAEGER_TRACE_RATIO}
|
||||
- BAO_DEV_ROOT_TOKEN_ID=${SMQ_OPENBAO_ROOT_TOKEN}
|
||||
- BAO_ADDR=http://127.0.0.1:${SMQ_OPENBAO_PORT}
|
||||
- SMQ_OPENBAO_PKI_ROLE=${SMQ_OPENBAO_PKI_ROLE}
|
||||
- SMQ_OPENBAO_APP_ROLE=${SMQ_OPENBAO_APP_ROLE}
|
||||
- SMQ_OPENBAO_APP_SECRET=${SMQ_OPENBAO_APP_SECRET}
|
||||
- SMQ_OPENBAO_PORT=${SMQ_OPENBAO_PORT}
|
||||
- SMQ_OPENBAO_NAMESPACE=${SMQ_OPENBAO_NAMESPACE}
|
||||
- SMQ_OPENBAO_UNSEAL_KEY_1=${SMQ_OPENBAO_UNSEAL_KEY_1}
|
||||
- SMQ_OPENBAO_UNSEAL_KEY_2=${SMQ_OPENBAO_UNSEAL_KEY_2}
|
||||
- SMQ_OPENBAO_UNSEAL_KEY_3=${SMQ_OPENBAO_UNSEAL_KEY_3}
|
||||
- SMQ_OPENBAO_TOKEN=${SMQ_OPENBAO_TOKEN}
|
||||
- SMQ_OPENBAO_PKI_CA_CN=${SMQ_OPENBAO_PKI_CA_CN}
|
||||
- SMQ_OPENBAO_PKI_CA_OU=${SMQ_OPENBAO_PKI_CA_OU}
|
||||
- SMQ_OPENBAO_PKI_CA_O=${SMQ_OPENBAO_PKI_CA_O}
|
||||
- SMQ_OPENBAO_PKI_CA_C=${SMQ_OPENBAO_PKI_CA_C}
|
||||
- SMQ_OPENBAO_PKI_CA_L=${SMQ_OPENBAO_PKI_CA_L}
|
||||
- SMQ_OPENBAO_PKI_CA_ST=${SMQ_OPENBAO_PKI_CA_ST}
|
||||
- SMQ_OPENBAO_PKI_CA_ADDR=${SMQ_OPENBAO_PKI_CA_ADDR}
|
||||
- SMQ_OPENBAO_PKI_CA_PO=${SMQ_OPENBAO_PKI_CA_PO}
|
||||
- SMQ_OPENBAO_PKI_ROLE_NAME=${SMQ_OPENBAO_PKI_ROLE_NAME}
|
||||
cap_add:
|
||||
- IPC_LOCK
|
||||
mem_swappiness: 0
|
||||
volumes:
|
||||
- ./config.yaml:/config/config.yaml
|
||||
ports:
|
||||
- 9010:9010
|
||||
- 7012:7012
|
||||
- supermq-openbao-volume:/opt/openbao/data
|
||||
- supermq-openbao-volume:/opt/openbao/config
|
||||
- ./prod-entrypoint.sh:/entrypoint.sh
|
||||
entrypoint: /bin/sh
|
||||
command: /entrypoint.sh
|
||||
|
||||
+181
@@ -0,0 +1,181 @@
|
||||
#!/bin/sh
|
||||
# Copyright (c) Abstract Machines
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
set -e
|
||||
|
||||
apk add --no-cache jq
|
||||
|
||||
mkdir -p /opt/openbao/config /opt/openbao/data /opt/openbao/logs
|
||||
|
||||
cat > /opt/openbao/config/config.hcl << 'EOF'
|
||||
storage "file" {
|
||||
path = "/opt/openbao/data"
|
||||
}
|
||||
listener "tcp" {
|
||||
address = "0.0.0.0:8200"
|
||||
tls_disable = true
|
||||
}
|
||||
ui = true
|
||||
log_level = "Info"
|
||||
disable_mlock = true
|
||||
# API timeout settings
|
||||
default_lease_ttl = "168h"
|
||||
max_lease_ttl = "720h"
|
||||
EOF
|
||||
|
||||
export BAO_ADDR=http://127.0.0.1:8200
|
||||
|
||||
if [ -n "$SMQ_OPENBAO_UNSEAL_KEY_1" ] && [ -n "$SMQ_OPENBAO_UNSEAL_KEY_2" ] && [ -n "$SMQ_OPENBAO_UNSEAL_KEY_3" ] && [ -n "$SMQ_OPENBAO_ROOT_TOKEN" ]; then
|
||||
bao server -config=/opt/openbao/config/config.hcl > /opt/openbao/logs/server.log 2>&1 &
|
||||
BAO_PID=$!
|
||||
sleep 5
|
||||
|
||||
bao operator unseal "$SMQ_OPENBAO_UNSEAL_KEY_1"
|
||||
bao operator unseal "$SMQ_OPENBAO_UNSEAL_KEY_2"
|
||||
bao operator unseal "$SMQ_OPENBAO_UNSEAL_KEY_3"
|
||||
|
||||
export BAO_TOKEN=$SMQ_OPENBAO_ROOT_TOKEN
|
||||
else
|
||||
if [ ! -f /opt/openbao/data/init.json ]; then
|
||||
bao server -config=/opt/openbao/config/config.hcl > /opt/openbao/logs/server.log 2>&1 &
|
||||
BAO_PID=$!
|
||||
sleep 5
|
||||
|
||||
bao operator init -key-shares=5 -key-threshold=3 -format=json > /opt/openbao/data/init.json
|
||||
|
||||
UNSEAL_KEY_1=$(cat /opt/openbao/data/init.json | jq -r '.unseal_keys_b64[0]')
|
||||
UNSEAL_KEY_2=$(cat /opt/openbao/data/init.json | jq -r '.unseal_keys_b64[1]')
|
||||
UNSEAL_KEY_3=$(cat /opt/openbao/data/init.json | jq -r '.unseal_keys_b64[2]')
|
||||
ROOT_TOKEN=$(cat /opt/openbao/data/init.json | jq -r '.root_token')
|
||||
|
||||
bao operator unseal "$UNSEAL_KEY_1"
|
||||
bao operator unseal "$UNSEAL_KEY_2"
|
||||
bao operator unseal "$UNSEAL_KEY_3"
|
||||
|
||||
export BAO_TOKEN=$ROOT_TOKEN
|
||||
else
|
||||
bao server -config=/opt/openbao/config/config.hcl > /opt/openbao/logs/server.log 2>&1 &
|
||||
BAO_PID=$!
|
||||
sleep 5
|
||||
|
||||
if bao status | grep -q "Sealed.*true"; then
|
||||
UNSEAL_KEY_1=$(cat /opt/openbao/data/init.json | jq -r '.unseal_keys_b64[0]')
|
||||
UNSEAL_KEY_2=$(cat /opt/openbao/data/init.json | jq -r '.unseal_keys_b64[1]')
|
||||
UNSEAL_KEY_3=$(cat /opt/openbao/data/init.json | jq -r '.unseal_keys_b64[2]')
|
||||
|
||||
bao operator unseal "$UNSEAL_KEY_1"
|
||||
bao operator unseal "$UNSEAL_KEY_2"
|
||||
bao operator unseal "$UNSEAL_KEY_3"
|
||||
fi
|
||||
|
||||
ROOT_TOKEN=$(cat /opt/openbao/data/init.json | jq -r '.root_token')
|
||||
export BAO_TOKEN=$ROOT_TOKEN
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ ! -f /opt/openbao/data/configured ]; then
|
||||
if bao namespace create "$SMQ_OPENBAO_NAMESPACE" 2>/dev/null; then
|
||||
export BAO_NAMESPACE="$SMQ_OPENBAO_NAMESPACE"
|
||||
echo "$SMQ_OPENBAO_NAMESPACE" > /opt/openbao/data/namespace
|
||||
fi
|
||||
|
||||
bao auth enable approle || echo "AppRole already enabled"
|
||||
bao secrets enable -path=pki pki || echo "PKI already enabled"
|
||||
bao secrets tune -max-lease-ttl=87600h pki
|
||||
|
||||
bao write -field=certificate pki/root/generate/internal \
|
||||
common_name="${SMQ_OPENBAO_PKI_CA_CN}" \
|
||||
organization="${SMQ_OPENBAO_PKI_CA_O}" \
|
||||
ou="${SMQ_OPENBAO_PKI_CA_OU}" \
|
||||
country="${SMQ_OPENBAO_PKI_CA_C}" \
|
||||
locality="${SMQ_OPENBAO_PKI_CA_L}" \
|
||||
province="${SMQ_OPENBAO_PKI_CA_ST}" \
|
||||
street_address="${SMQ_OPENBAO_PKI_CA_ADDR}" \
|
||||
postal_code="${SMQ_OPENBAO_PKI_CA_PO}" \
|
||||
ttl=87600h \
|
||||
key_bits=2048 \
|
||||
exclude_cn_from_sans=true
|
||||
|
||||
bao write pki/config/urls \
|
||||
issuing_certificates='http://127.0.0.1:8200/v1/pki/ca' \
|
||||
crl_distribution_points='http://127.0.0.1:8200/v1/pki/crl'
|
||||
|
||||
bao write pki/roles/"${SMQ_OPENBAO_PKI_ROLE_NAME:-supermq}" \
|
||||
allow_any_name=true \
|
||||
enforce_hostnames=false \
|
||||
allow_ip_sans=true \
|
||||
allow_localhost=true \
|
||||
max_ttl=720h \
|
||||
ttl=720h \
|
||||
key_bits=2048
|
||||
|
||||
cat > /opt/openbao/config/pki-policy.hcl << EOF
|
||||
path "pki/issue/${SMQ_OPENBAO_PKI_ROLE_NAME:-supermq}" {
|
||||
capabilities = ["create", "update"]
|
||||
}
|
||||
path "pki/certs" {
|
||||
capabilities = ["list"]
|
||||
}
|
||||
path "pki/cert/*" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
path "pki/revoke" {
|
||||
capabilities = ["create", "update"]
|
||||
}
|
||||
path "auth/token/renew-self" {
|
||||
capabilities = ["update"]
|
||||
}
|
||||
path "auth/token/lookup-self" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
EOF
|
||||
|
||||
bao policy write pki-policy /opt/openbao/config/pki-policy.hcl
|
||||
|
||||
bao write auth/approle/role/"${SMQ_OPENBAO_PKI_ROLE_NAME:-supermq}" \
|
||||
token_policies=pki-policy \
|
||||
token_ttl=1h \
|
||||
token_max_ttl=4h \
|
||||
bind_secret_id=true \
|
||||
secret_id_ttl=24h
|
||||
|
||||
if [ -n "$SMQ_OPENBAO_APP_ROLE" ]; then
|
||||
bao write auth/approle/role/"${SMQ_OPENBAO_PKI_ROLE_NAME:-supermq}"/role-id role_id="$SMQ_OPENBAO_APP_ROLE"
|
||||
fi
|
||||
|
||||
if [ -n "$SMQ_OPENBAO_APP_SECRET" ]; then
|
||||
bao write auth/approle/role/"${SMQ_OPENBAO_PKI_ROLE_NAME:-supermq}"/custom-secret-id secret_id="$SMQ_OPENBAO_APP_SECRET"
|
||||
fi
|
||||
|
||||
SERVICE_TOKEN=$(bao write -field=token auth/token/create \
|
||||
policies=pki-policy \
|
||||
ttl=24h \
|
||||
renewable=true \
|
||||
display_name="supermq-service")
|
||||
|
||||
echo "SERVICE_TOKEN=$SERVICE_TOKEN" > /opt/openbao/data/service_token
|
||||
touch /opt/openbao/data/configured
|
||||
echo "OpenBao configuration completed successfully!"
|
||||
else
|
||||
echo "OpenBao already configured, skipping setup..."
|
||||
if [ -f /opt/openbao/data/namespace ] && [ -n "$SMQ_OPENBAO_NAMESPACE" ]; then
|
||||
SAVED_NAMESPACE=$(cat /opt/openbao/data/namespace)
|
||||
if [ "$SAVED_NAMESPACE" = "$SMQ_OPENBAO_NAMESPACE" ]; then
|
||||
export BAO_NAMESPACE="$SMQ_OPENBAO_NAMESPACE"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
echo "================================"
|
||||
echo "OpenBao Production Setup Complete"
|
||||
echo "================================"
|
||||
echo "OpenBao Address: http://localhost:8200"
|
||||
echo "UI Available at: http://localhost:8200/ui"
|
||||
echo "================================"
|
||||
echo "IMPORTANT: Store the init.json file securely!"
|
||||
echo "It contains unseal keys and root token!"
|
||||
echo "================================"
|
||||
|
||||
echo "OpenBao is ready for SuperMQ on port 8200"
|
||||
wait $BAO_PID
|
||||
@@ -1,290 +0,0 @@
|
||||
# Vault
|
||||
|
||||
This is Vault service deployment to be used with SuperMQ.
|
||||
|
||||
When the Vault service is started, some initialization steps need to be done to set clients up.
|
||||
|
||||
## Configuration
|
||||
|
||||
| Variable | Description | Default |
|
||||
| :-------------------------------------- | ----------------------------------------------------------------------------- | ------------------------------------- |
|
||||
| SMQ_VAULT_ADDR | Vault Address | http://vault:8200 |
|
||||
| SMQ_VAULT_UNSEAL_KEY_1 | Vault unseal key | "" |
|
||||
| SMQ_VAULT_UNSEAL_KEY_2 | Vault unseal key | "" |
|
||||
| SMQ_VAULT_UNSEAL_KEY_3 | Vault unseal key | "" |
|
||||
| SMQ_VAULT_TOKEN | Vault cli access token | "" |
|
||||
| SMQ_VAULT_PKI_PATH | Vault secrets engine path for Root CA | pki |
|
||||
| SMQ_VAULT_PKI_ROLE_NAME | Vault Root CA role name to issue intermediate CA | supermq_int_ca |
|
||||
| SMQ_VAULT_PKI_FILE_NAME | Root CA Certificates name used by`vault_set_pki.sh` | mg_root |
|
||||
| SMQ_VAULT_PKI_CA_CN | Common name used for Root CA creation by`vault_set_pki.sh` | SuperMQ Root Certificate Authority |
|
||||
| SMQ_VAULT_PKI_CA_OU | Organization unit used for Root CA creation by`vault_set_pki.sh` | SuperMQ |
|
||||
| SMQ_VAULT_PKI_CA_O | Organization used for Root CA creation by`vault_set_pki.sh` | SuperMQ |
|
||||
| SMQ_VAULT_PKI_CA_C | Country used for Root CA creation by`vault_set_pki.sh` | FRANCE |
|
||||
| SMQ_VAULT_PKI_CA_L | Location used for Root CA creation by`vault_set_pki.sh` | PARIS |
|
||||
| SMQ_VAULT_PKI_CA_ST | State or Provisions used for Root CA creation by`vault_set_pki.sh` | PARIS |
|
||||
| SMQ_VAULT_PKI_CA_ADDR | Address used for Root CA creation by`vault_set_pki.sh` | 5 Av. Anatole |
|
||||
| SMQ_VAULT_PKI_CA_PO | Postal code used for Root CA creation by`vault_set_pki.sh` | 75007 |
|
||||
| SMQ_VAULT_PKI_CLUSTER_PATH | Vault Root CA Cluster Path | http://localhost |
|
||||
| SMQ_VAULT_PKI_CLUSTER_AIA_PATH | Vault Root CA Cluster AIA Path | http://localhost |
|
||||
| SMQ_VAULT_PKI_INT_PATH | Vault secrets engine path for Intermediate CA | pki_int |
|
||||
| SMQ_VAULT_PKI_INT_SERVER_CERTS_ROLE_NAME | Vault Intermediate CA role name to issue server certificate | supermq_server_certs |
|
||||
| SMQ_VAULT_PKI_INT_CLIENTS_CERTS_ROLE_NAME | Vault Intermediate CA role name to issue Clients certificates | supermq_clients_certs |
|
||||
| SMQ_VAULT_PKI_INT_FILE_NAME | Intermediate CA Certificates name used by`vault_set_pki.sh` | mg_root |
|
||||
| SMQ_VAULT_PKI_INT_CA_CN | Common name used for Intermediate CA creation by`vault_set_pki.sh` | SuperMQ Root Certificate Authority |
|
||||
| SMQ_VAULT_PKI_INT_CA_OU | Organization unit used for Root CA creation by`vault_set_pki.sh` | SuperMQ |
|
||||
| SMQ_VAULT_PKI_INT_CA_O | Organization used for Intermediate CA creation by`vault_set_pki.sh` | SuperMQ |
|
||||
| SMQ_VAULT_PKI_INT_CA_C | Country used for Intermediate CA creation by`vault_set_pki.sh` | FRANCE |
|
||||
| SMQ_VAULT_PKI_INT_CA_L | Location used for Intermediate CA creation by`vault_set_pki.sh` | PARIS |
|
||||
| SMQ_VAULT_PKI_INT_CA_ST | State or Provisions used for Intermediate CA creation by`vault_set_pki.sh` | PARIS |
|
||||
| SMQ_VAULT_PKI_INT_CA_ADDR | Address used for Intermediate CA creation by`vault_set_pki.sh` | 5 Av. Anatole |
|
||||
| SMQ_VAULT_PKI_INT_CA_PO | Postal code used for Intermediate CA creation by`vault_set_pki.sh` | 75007 |
|
||||
| SMQ_VAULT_PKI_INT_CLUSTER_PATH | Vault Intermediate CA Cluster Path | http://localhost |
|
||||
| SMQ_VAULT_PKI_INT_CLUSTER_AIA_PATH | Vault Intermediate CA Cluster AIA Path | http://localhost |
|
||||
| SMQ_VAULT_CLIENTS_CERTS_ISSUER_ROLEID | Vault Intermediate CA Clients Certificate issuer AppRole authentication RoleID | supermq |
|
||||
| SMQ_VAULT_CLIENTS_CERTS_ISSUER_SECRET | Vault Intermediate CA Clients Certificate issuer AppRole authentication Secret | supermq |
|
||||
|
||||
## Setup
|
||||
|
||||
The following scripts are provided, which work on the running Vault service from within the `docker/addons/vault/scripts` directory.
|
||||
|
||||
### 1. `vault_init.sh`
|
||||
|
||||
Calls `vault operator init` to perform the initial vault initialization and generates a `docker/addons/vault/scripts/data/secrets` file which contains the Vault unseal keys and root tokens.
|
||||
|
||||
### 2. `vault_copy_env.sh`
|
||||
|
||||
After the initial setup, the Vault-related environment variables (`SMQ_VAULT_TOKEN`, `SMQ_VAULT_UNSEAL_KEY_1`, `SMQ_VAULT_UNSEAL_KEY_2`, `SMQ_VAULT_UNSEAL_KEY_3`) need to be updated in the `.env` file.
|
||||
|
||||
The `vault_copy_env.sh` script automatically retrieves these values from the `docker/addons/vault/scripts/data/secrets` file and updates the corresponding environment variables in your `.env` file.
|
||||
|
||||
Example:
|
||||
|
||||
```sh
|
||||
Vault environment variables have been successfully set in ~/supermq/docker/.env
|
||||
```
|
||||
|
||||
### 3. `vault_unseal.sh`
|
||||
|
||||
This can be run after the initialization to unseal Vault, which is necessary for it to be used to store and/or get secrets.
|
||||
|
||||
This can be used if you don't want to restart the service.
|
||||
|
||||
The unseal environment variables need to be set in `.env` for the script to work (`SMQ_VAULT_TOKEN`,`SMQ_VAULT_UNSEAL_KEY_1`, `SMQ_VAULT_UNSEAL_KEY_2`, `SMQ_VAULT_UNSEAL_KEY_3`).
|
||||
|
||||
This script should not be necessary to run after the initial setup, since the Vault service unseals itself when starting the container.
|
||||
|
||||
Example output:
|
||||
|
||||
```bash
|
||||
Key Value
|
||||
--- -----
|
||||
Seal Type shamir
|
||||
Initialized true
|
||||
Sealed true
|
||||
Total Shares 5
|
||||
Threshold 3
|
||||
Unseal Progress 1/3
|
||||
Unseal Nonce 4c248cc8-e9f5-055e-319b-00ee06f998a0
|
||||
Version 1.15.4
|
||||
Build Date 2023-12-04T17:45:28Z
|
||||
Storage Type file
|
||||
HA Enabled false
|
||||
Key Value
|
||||
--- -----
|
||||
Seal Type shamir
|
||||
Initialized true
|
||||
Sealed true
|
||||
Total Shares 5
|
||||
Threshold 3
|
||||
Unseal Progress 2/3
|
||||
Unseal Nonce 4c248cc8-e9f5-055e-319b-00ee06f998a0
|
||||
Version 1.15.4
|
||||
Build Date 2023-12-04T17:45:28Z
|
||||
Storage Type file
|
||||
HA Enabled false
|
||||
Key Value
|
||||
--- -----
|
||||
Seal Type shamir
|
||||
Initialized true
|
||||
Sealed false
|
||||
Total Shares 5
|
||||
Threshold 3
|
||||
Unseal Progress 3/3
|
||||
Unseal Nonce 4c248cc8-e9f5-055e-319b-00ee06f998a0
|
||||
Version 1.15.4
|
||||
Build Date 2023-12-04T17:45:28Z
|
||||
Storage Type file
|
||||
HA Enabled false
|
||||
```
|
||||
|
||||
### 4. vault_set_pki.sh
|
||||
|
||||
The `vault_set_pki.sh` script is responsible for generating the root certificate, intermediate certificate, and HTTPS server certificate. All generated certificates, keys, and CSR files are stored in the `docker/addons/vault/scripts/data` directory.
|
||||
|
||||
The script pulls necessary parameters for certificate generation from environment variables, which are, by default, loaded from `docker/.env`.
|
||||
|
||||
- Environment variables prefixed with `SMQ_VAULT_PKI` in the `docker/.env` file are used for generating the root CA.
|
||||
- Environment variables prefixed with `SMQ_VAULT_PKI_INT` are used for generating the intermediate CA.
|
||||
|
||||
To skip generating the server certificate and key, you can pass the `--skip-server-cert` option to the script:
|
||||
|
||||
```sh
|
||||
./vault_set_pki.sh --skip-server-cert
|
||||
```
|
||||
|
||||
#### Troubleshooting:
|
||||
|
||||
If you encounter the following error:
|
||||
|
||||
```sh
|
||||
jq command could not be found, please install it and try again.
|
||||
```
|
||||
|
||||
Install `jq` using:
|
||||
|
||||
```sh
|
||||
sudo apt-get update && sudo apt-get install -y jq
|
||||
```
|
||||
|
||||
After installing `jq`, rerun the script.
|
||||
|
||||
### 5. `vault_create_approle.sh`
|
||||
|
||||
This script enables AppRole authorization in Vault. The certs service uses these AppRole credentials to issue and revoke certificates from the Vault intermediate CA.
|
||||
|
||||
Example output:
|
||||
|
||||
```sh
|
||||
Success! You are now authenticated. The token information displayed below
|
||||
is already stored in the token helper. You do NOT need to run "vault login"
|
||||
again. Future Vault requests will automatically use this token.
|
||||
|
||||
Key Value
|
||||
--- -----
|
||||
token <token_value>
|
||||
token_accessor i6YVeKh4wQ4e0Aj0ONiyGw1Z
|
||||
token_duration ∞
|
||||
token_renewable false
|
||||
token_policies ["root"]
|
||||
identity_policies []
|
||||
policies ["root"]
|
||||
Creating new policy for AppRole
|
||||
Successfully copied 2.56kB to supermq-vault:/vault/supermq_clients_certs_issue.hcl
|
||||
Success! Uploaded policy: supermq_clients_certs_issue
|
||||
Enabling AppRole
|
||||
Success! Enabled approle auth method at: approle/
|
||||
Deleting old AppRole
|
||||
Success! Data deleted (if it existed) at: auth/approle/role/supermq_clients_certs_issuer
|
||||
Creating new AppRole
|
||||
Success! Data written to: auth/approle/role/supermq_clients_certs_issuer
|
||||
Writing custom role ID
|
||||
Key Value
|
||||
--- -----
|
||||
role_id f23942b3-62b9-7456-784f-220ca3f703b9
|
||||
Success! Data written to: auth/approle/role/supermq_clients_certs_issuer/role-id
|
||||
Writing custom secret
|
||||
Key Value
|
||||
--- -----
|
||||
secret_id 61d5a30f-634c-6027-f5b6-4934e6fc49b2
|
||||
secret_id_accessor 1d744f6e-e0c2-5431-a87a-2b23fde584a7
|
||||
secret_id_num_uses 0
|
||||
secret_id_ttl 0s
|
||||
Testing custom role ID and secret by logging in
|
||||
Key Value
|
||||
--- -----
|
||||
token <token_value>
|
||||
token_accessor 9cuwS4mrLHKhJQMv0pl9Bbg9
|
||||
token_duration 1h
|
||||
token_renewable true
|
||||
token_policies ["default" "supermq_clients_certs_issue"]
|
||||
identity_policies []
|
||||
policies ["default" "supermq_clients_certs_issue"]
|
||||
token_meta_role_name supermq_clients_certs_issuer
|
||||
```
|
||||
|
||||
By default, the `vault_create_approle.sh` script tries to enable the AppRole authentication method. Certs service uses the approle credentials to issue and revoke clients certificate from vault intermedate CA. If AppRole is already enabled, you can skip this step by passing the `--skip-enable-approle` argument:
|
||||
|
||||
```sh
|
||||
./vault_create_approle.sh --skip-enable-approle
|
||||
```
|
||||
|
||||
### 6. `vault_copy_certs.sh`
|
||||
|
||||
This script copies the required certificates and keys from `docker/addons/vault/scripts/data` to the `docker/ssl/certs` folder.
|
||||
|
||||
Example output:
|
||||
|
||||
```bash
|
||||
Copying certificate files
|
||||
'data/localhost.crt' -> '~/Documents/supermq/docker/ssl/certs/supermq-server.crt'
|
||||
'data/localhost.key' -> '~/Documents/supermq/docker/ssl/certs/supermq-server.key'
|
||||
'data/mg_int.key' -> '~/Documents/supermq/docker/ssl/certs/ca.key'
|
||||
'data/mg_int_bundle.crt' -> '~/Documents/supermq/docker/ssl/certs/ca.crt'
|
||||
```
|
||||
|
||||
## Custom `.env` Path Support
|
||||
|
||||
Vault scripts support specifying a custom `.env` file path using the `--env-file` argument. If this argument is not provided, the scripts will use the default `.env` file located at `docker/.env`.
|
||||
|
||||
To use a different `.env` file, include the `--env-file` argument followed by the path to your `.env` file when running the Vault scripts. Below are examples of how to execute each script with a custom `.env` file path:
|
||||
|
||||
```bash
|
||||
./vault_init.sh --env-file /custom/path/.env
|
||||
./vault_copy_env.sh --env-file /custom/path/.env
|
||||
./vault_unseal.sh --env-file /custom/path/.env
|
||||
./vault_set_pki.sh --env-file /custom/path/.env
|
||||
./vault_create_approle.sh --env-file /custom/path/.env
|
||||
./vault_copy_certs.sh --env-file /custom/path/.env
|
||||
```
|
||||
|
||||
## Hashicorp Cloud Platform (HCP) Vault
|
||||
|
||||
To have the same PKI setup can done in Hashicorp Cloud Platform (HCP) Vault follow the below steps:
|
||||
Requirement: [VAULT CLI](https://developer.hashicorp.com/vault/tutorials/getting-started/getting-started-install)
|
||||
|
||||
- Replace the environmental variable `SMQ_VAULT_ADDR` in `docker/.env` with HCP Vault address.
|
||||
- Replace the environmental variable `SMQ_VAULT_TOKEN` in `docker/.env` with HCP Vault Admin token.
|
||||
- Run script `vault_set_pki.sh` and `vault_create_approle.sh`.
|
||||
- Optional step, run script `vault_copy_certs.sh` to copy certificates to supermq default path.
|
||||
|
||||
## Vault CLI
|
||||
|
||||
It can also be useful to run the Vault CLI for inspection and administration work.
|
||||
|
||||
```bash
|
||||
Usage: vault <command> [args]
|
||||
|
||||
Common commands:
|
||||
read Read data and retrieves secrets
|
||||
write Write data, configuration, and secrets
|
||||
delete Delete secrets and configuration
|
||||
list List data or secrets
|
||||
login Authenticate locally
|
||||
agent Start a Vault agent
|
||||
server Start a Vault server
|
||||
status Print seal and HA status
|
||||
unwrap Unwrap a wrapped secret
|
||||
|
||||
Other commands:
|
||||
audit Interact with audit devices
|
||||
auth Interact with auth methods
|
||||
debug Runs the debug command
|
||||
kv Interact with Vault's Key-Value storage
|
||||
lease Interact with leases
|
||||
monitor Stream log messages from a Vault server
|
||||
namespace Interact with namespaces
|
||||
operator Perform operator-specific tasks
|
||||
path-help Retrieve API help for paths
|
||||
plugin Interact with Vault plugins and catalog
|
||||
policy Interact with policies
|
||||
print Prints runtime configurations
|
||||
secrets Interact with secrets engines
|
||||
ssh Initiate an SSH session
|
||||
token Interact with tokens
|
||||
```
|
||||
|
||||
If the Vault is setup through `docker/addons/vault`, then Vault CLI can be run directly using the Vault image in Docker: `docker run -it supermq/vault:latest vault`
|
||||
|
||||
## Vault Web UI
|
||||
|
||||
If the Vault is setup through `docker/addons/vault`, Then Vault Web UI is accessible by default on `http://localhost:8200/ui`.
|
||||
@@ -1,10 +0,0 @@
|
||||
storage "file" {
|
||||
path = "/vault/file"
|
||||
}
|
||||
|
||||
listener "tcp" {
|
||||
address = "0.0.0.0:8200"
|
||||
tls_disable = 1
|
||||
}
|
||||
|
||||
ui = true
|
||||
@@ -1,42 +0,0 @@
|
||||
# Copyright (c) Abstract Machines
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
# This docker-compose file contains optional Vault service for SuperMQ platform.
|
||||
# Since this is optional, this file is dependent of docker-compose file
|
||||
# from <project_root>/docker. In order to run these services, execute command:
|
||||
# docker compose -f docker/docker-compose.yaml -f docker/addons/vault/docker-compose.yaml up
|
||||
# from project root. Vault default port (8200) is exposed, so you can use Vault CLI tool for
|
||||
# vault inspection and administration, as well as access the UI.
|
||||
|
||||
networks:
|
||||
supermq-base-net:
|
||||
name: supermq-base-net
|
||||
external: true
|
||||
|
||||
volumes:
|
||||
supermq-vault-volume:
|
||||
|
||||
|
||||
services:
|
||||
vault:
|
||||
image: hashicorp/vault:1.15.4
|
||||
container_name: supermq-vault
|
||||
ports:
|
||||
- ${SMQ_VAULT_PORT}:8200
|
||||
networks:
|
||||
- supermq-base-net
|
||||
volumes:
|
||||
- supermq-vault-volume:/vault/file
|
||||
- supermq-vault-volume:/vault/logs
|
||||
- ./config.hcl:/vault/config/config.hcl
|
||||
- ./entrypoint.sh:/entrypoint.sh
|
||||
environment:
|
||||
VAULT_ADDR: http://127.0.0.1:${SMQ_VAULT_PORT}
|
||||
SMQ_VAULT_PORT: ${SMQ_VAULT_PORT}
|
||||
SMQ_VAULT_UNSEAL_KEY_1: ${SMQ_VAULT_UNSEAL_KEY_1}
|
||||
SMQ_VAULT_UNSEAL_KEY_2: ${SMQ_VAULT_UNSEAL_KEY_2}
|
||||
SMQ_VAULT_UNSEAL_KEY_3: ${SMQ_VAULT_UNSEAL_KEY_3}
|
||||
entrypoint: /bin/sh
|
||||
command: /entrypoint.sh
|
||||
cap_add:
|
||||
- IPC_LOCK
|
||||
@@ -1,25 +0,0 @@
|
||||
#!/usr/bin/dumb-init /bin/sh
|
||||
# Copyright (c) Abstract Machines
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
VAULT_CONFIG_DIR=/vault/config
|
||||
|
||||
docker-entrypoint.sh server &
|
||||
VAULT_PID=$!
|
||||
|
||||
sleep 2
|
||||
|
||||
echo $SMQ_VAULT_UNSEAL_KEY_1
|
||||
echo $SMQ_VAULT_UNSEAL_KEY_2
|
||||
echo $SMQ_VAULT_UNSEAL_KEY_3
|
||||
|
||||
if [[ ! -z "${SMQ_VAULT_UNSEAL_KEY_1}" ]] &&
|
||||
[[ ! -z "${SMQ_VAULT_UNSEAL_KEY_2}" ]] &&
|
||||
[[ ! -z "${SMQ_VAULT_UNSEAL_KEY_3}" ]]; then
|
||||
echo "Unsealing Vault"
|
||||
vault operator unseal ${SMQ_VAULT_UNSEAL_KEY_1}
|
||||
vault operator unseal ${SMQ_VAULT_UNSEAL_KEY_2}
|
||||
vault operator unseal ${SMQ_VAULT_UNSEAL_KEY_3}
|
||||
fi
|
||||
|
||||
wait $VAULT_PID
|
||||
@@ -1,5 +0,0 @@
|
||||
# Copyright (c) Abstract Machines
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
data
|
||||
supermq_clients_certs_issue.hcl
|
||||
@@ -1,32 +0,0 @@
|
||||
|
||||
# Allow issue certificate with role with default issuer from Intermediate PKI
|
||||
path "${SMQ_VAULT_PKI_INT_PATH}/issue/${SMQ_VAULT_PKI_INT_CLIENTS_CERTS_ROLE_NAME}" {
|
||||
capabilities = ["create", "update"]
|
||||
}
|
||||
|
||||
## Revole certificate from Intermediate PKI
|
||||
path "${SMQ_VAULT_PKI_INT_PATH}/revoke" {
|
||||
capabilities = ["create", "update"]
|
||||
}
|
||||
|
||||
## List Revoked Certificates from Intermediate PKI
|
||||
path "${SMQ_VAULT_PKI_INT_PATH}/certs/revoked" {
|
||||
capabilities = ["list"]
|
||||
}
|
||||
|
||||
|
||||
## List Certificates from Intermediate PKI
|
||||
path "${SMQ_VAULT_PKI_INT_PATH}/certs" {
|
||||
capabilities = ["list"]
|
||||
}
|
||||
|
||||
## Read Certificate from Intermediate PKI
|
||||
path "${SMQ_VAULT_PKI_INT_PATH}/cert/+" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
path "${SMQ_VAULT_PKI_INT_PATH}/cert/+/raw" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
path "${SMQ_VAULT_PKI_INT_PATH}/cert/+/raw/pem" {
|
||||
capabilities = ["read"]
|
||||
}
|
||||
@@ -1,24 +0,0 @@
|
||||
#!/usr/bin/bash
|
||||
# Copyright (c) Abstract Machines
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
vault() {
|
||||
if is_container_running "supermq-vault"; then
|
||||
docker exec -it supermq-vault vault "$@"
|
||||
else
|
||||
if which vault &> /dev/null; then
|
||||
$(which vault) "$@"
|
||||
else
|
||||
echo "supermq-vault container or vault command not found. Please refer to the documentation: https://github.com/absmach/supermq/blob/main/docker/addons/vault/README.md"
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
is_container_running() {
|
||||
local container_name="$1"
|
||||
if [ "$(docker inspect --format '{{.State.Running}}' "$container_name" 2>/dev/null)" = "true" ]; then
|
||||
return 0
|
||||
else
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
@@ -1,86 +0,0 @@
|
||||
#!/usr/bin/bash
|
||||
# Copyright (c) Abstract Machines
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
scriptdir="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
|
||||
|
||||
# default env file path
|
||||
env_file="docker/.env"
|
||||
|
||||
# default certs copy path
|
||||
certs_copy_path="docker/ssl/certs/"
|
||||
|
||||
while [[ "$#" -gt 0 ]]; do
|
||||
case $1 in
|
||||
--env-file)
|
||||
if [[ -z "${2:-}" ]]; then
|
||||
echo "Error: --env-file requires a non-empty option argument."
|
||||
exit 1
|
||||
fi
|
||||
env_file="$2"
|
||||
if [[ ! -f "$env_file" ]]; then
|
||||
echo "Error: .env file not found at $env_file"
|
||||
exit 1
|
||||
fi
|
||||
shift
|
||||
;;
|
||||
--certs-copy-path)
|
||||
if [[ -z "${2:-}" ]]; then
|
||||
echo "Error: --certs-copy-path requires a non-empty option argument."
|
||||
exit 1
|
||||
fi
|
||||
certs_copy_path="$2"
|
||||
shift
|
||||
;;
|
||||
*)
|
||||
echo "Error: Unknown parameter passed: $1"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
shift
|
||||
done
|
||||
|
||||
readDotEnv() {
|
||||
set -o allexport
|
||||
source "$env_file"
|
||||
set +o allexport
|
||||
}
|
||||
|
||||
readDotEnv
|
||||
|
||||
server_name="localhost"
|
||||
|
||||
# Check if SMQ_NGINX_SERVER_NAME is set or not empty
|
||||
if [ -n "${SMQ_NGINX_SERVER_NAME:-}" ]; then
|
||||
server_name="$SMQ_NGINX_SERVER_NAME"
|
||||
fi
|
||||
|
||||
echo "Copying certificate files to ${certs_copy_path}"
|
||||
|
||||
if [ -e "$scriptdir/data/${server_name}.crt" ]; then
|
||||
cp -v "$scriptdir/data/${server_name}.crt" "${certs_copy_path}supermq-server.crt"
|
||||
else
|
||||
echo "${server_name}.crt file not available"
|
||||
fi
|
||||
|
||||
if [ -e "$scriptdir/data/${server_name}.key" ]; then
|
||||
cp -v "$scriptdir/data/${server_name}.key" "${certs_copy_path}supermq-server.key"
|
||||
else
|
||||
echo "${server_name}.key file not available"
|
||||
fi
|
||||
|
||||
if [ -e "$scriptdir/data/${SMQ_VAULT_PKI_INT_FILE_NAME}.key" ]; then
|
||||
cp -v "$scriptdir/data/${SMQ_VAULT_PKI_INT_FILE_NAME}.key" "${certs_copy_path}ca.key"
|
||||
else
|
||||
echo "$scriptdir/data/${SMQ_VAULT_PKI_INT_FILE_NAME}.key file not available"
|
||||
fi
|
||||
|
||||
if [ -e "$scriptdir/data/${SMQ_VAULT_PKI_INT_FILE_NAME}_bundle.crt" ]; then
|
||||
cp -v "$scriptdir/data/${SMQ_VAULT_PKI_INT_FILE_NAME}_bundle.crt" "${certs_copy_path}ca.crt"
|
||||
else
|
||||
echo "$scriptdir/data/${SMQ_VAULT_PKI_INT_FILE_NAME}_bundle.crt file not available"
|
||||
fi
|
||||
|
||||
exit 0
|
||||
@@ -1,52 +0,0 @@
|
||||
#!/usr/bin/bash
|
||||
# Copyright (c) Abstract Machines
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
scriptdir="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
|
||||
|
||||
# default env file path
|
||||
env_file="docker/.env"
|
||||
|
||||
while [[ "$#" -gt 0 ]]; do
|
||||
case $1 in
|
||||
--env-file)
|
||||
if [[ -z "${2:-}" ]]; then
|
||||
echo "Error: --env-file requires a non-empty option argument."
|
||||
exit 1
|
||||
fi
|
||||
env_file="$2"
|
||||
if [[ ! -f "$env_file" ]]; then
|
||||
echo "Error: .env file not found at $env_file"
|
||||
exit 1
|
||||
fi
|
||||
shift
|
||||
;;
|
||||
*)
|
||||
echo "Unknown parameter passed: $1"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
shift
|
||||
done
|
||||
|
||||
write_env() {
|
||||
if [ -e "$scriptdir/data/secrets" ]; then
|
||||
if [[ "$(uname)" == "Darwin" ]]; then
|
||||
SED_OPT=(-i '')
|
||||
else
|
||||
SED_OPT=(-i)
|
||||
fi
|
||||
|
||||
sed "${SED_OPT[@]}" "s,SMQ_VAULT_UNSEAL_KEY_1=.*,SMQ_VAULT_UNSEAL_KEY_1=$(awk -F ': ' '$1 == "Unseal Key 1" {print $2}' "$scriptdir/data/secrets")," "$env_file"
|
||||
sed "${SED_OPT[@]}" "s,SMQ_VAULT_UNSEAL_KEY_2=.*,SMQ_VAULT_UNSEAL_KEY_2=$(awk -F ': ' '$1 == "Unseal Key 2" {print $2}' "$scriptdir/data/secrets")," "$env_file"
|
||||
sed "${SED_OPT[@]}" "s,SMQ_VAULT_UNSEAL_KEY_3=.*,SMQ_VAULT_UNSEAL_KEY_3=$(awk -F ': ' '$1 == "Unseal Key 3" {print $2}' "$scriptdir/data/secrets")," "$env_file"
|
||||
sed "${SED_OPT[@]}" "s,SMQ_VAULT_TOKEN=.*,SMQ_VAULT_TOKEN=$(awk -F ': ' '$1 == "Initial Root Token" {print $2}' "$scriptdir/data/secrets")," "$env_file"
|
||||
echo "Vault environment variables are set successfully in $env_file"
|
||||
else
|
||||
echo "Error: Source file '$scriptdir/data/secrets' not found."
|
||||
fi
|
||||
}
|
||||
|
||||
write_env
|
||||
@@ -1,122 +0,0 @@
|
||||
#!/usr/bin/bash
|
||||
# Copyright (c) Abstract Machines
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
scriptdir="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
|
||||
|
||||
# default env file path
|
||||
env_file="docker/.env"
|
||||
|
||||
SKIP_ENABLE_APP_ROLE=""
|
||||
|
||||
while [[ "$#" -gt 0 ]]; do
|
||||
case $1 in
|
||||
--env-file)
|
||||
if [[ -z "${2:-}" ]]; then
|
||||
echo "Error: --env-file requires a non-empty option argument."
|
||||
exit 1
|
||||
fi
|
||||
env_file="$2"
|
||||
if [[ ! -f "$env_file" ]]; then
|
||||
echo "Error: .env file not found at $env_file"
|
||||
exit 1
|
||||
fi
|
||||
shift
|
||||
;;
|
||||
--skip-enable-approle)
|
||||
SKIP_ENABLE_APP_ROLE="true"
|
||||
;;
|
||||
*)
|
||||
echo "Unknown parameter passed: $1"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
shift
|
||||
done
|
||||
|
||||
readDotEnv() {
|
||||
set -o allexport
|
||||
source "$env_file"
|
||||
set +o allexport
|
||||
}
|
||||
|
||||
source "$scriptdir/vault_cmd.sh"
|
||||
|
||||
vaultCreatePolicyFile() {
|
||||
envsubst '
|
||||
${SMQ_VAULT_PKI_INT_PATH}
|
||||
${SMQ_VAULT_PKI_INT_CLIENTS_CERTS_ROLE_NAME}
|
||||
' < "$scriptdir/supermq_clients_certs_issue.template.hcl" > "$scriptdir/supermq_clients_certs_issue.hcl"
|
||||
}
|
||||
|
||||
vaultCreatePolicy() {
|
||||
echo "Creating new policy for AppRole"
|
||||
if is_container_running "supermq-vault"; then
|
||||
docker cp "$scriptdir/supermq_clients_certs_issue.hcl" supermq-vault:/vault/supermq_clients_certs_issue.hcl
|
||||
vault policy write -namespace=${SMQ_VAULT_NAMESPACE} -address=${SMQ_VAULT_ADDR} supermq_clients_certs_issue /vault/supermq_clients_certs_issue.hcl
|
||||
else
|
||||
vault policy write -namespace=${SMQ_VAULT_NAMESPACE} -address=${SMQ_VAULT_ADDR} supermq_clients_certs_issue "$scriptdir/supermq_clients_certs_issue.hcl"
|
||||
fi
|
||||
}
|
||||
|
||||
vaultEnableAppRole() {
|
||||
if [[ "$SKIP_ENABLE_APP_ROLE" == "true" ]]; then
|
||||
echo "Skipping Enable AppRole"
|
||||
else
|
||||
echo "Enabling AppRole"
|
||||
vault auth enable -namespace=${SMQ_VAULT_NAMESPACE} -address=${SMQ_VAULT_ADDR} approle
|
||||
fi
|
||||
}
|
||||
|
||||
vaultDeleteRole() {
|
||||
echo "Deleting old AppRole"
|
||||
vault delete -namespace=${SMQ_VAULT_NAMESPACE} -address=${SMQ_VAULT_ADDR} auth/approle/role/supermq_clients_certs_issuer
|
||||
}
|
||||
|
||||
vaultCreateRole() {
|
||||
echo "Creating new AppRole"
|
||||
vault write -namespace=${SMQ_VAULT_NAMESPACE} -address=${SMQ_VAULT_ADDR} auth/approle/role/supermq_clients_certs_issuer \
|
||||
token_policies=supermq_clients_certs_issue secret_id_num_uses=0 \
|
||||
secret_id_ttl=0 token_ttl=1h token_max_ttl=3h token_num_uses=0
|
||||
}
|
||||
|
||||
vaultWriteCustomRoleID() {
|
||||
echo "Writing custom role id"
|
||||
vault read -namespace=${SMQ_VAULT_NAMESPACE} -address=${SMQ_VAULT_ADDR} auth/approle/role/supermq_clients_certs_issuer/role-id
|
||||
vault write -namespace=${SMQ_VAULT_NAMESPACE} -address=${SMQ_VAULT_ADDR} auth/approle/role/supermq_clients_certs_issuer/role-id role_id=${SMQ_VAULT_CLIENTS_CERTS_ISSUER_ROLEID}
|
||||
}
|
||||
|
||||
vaultWriteCustomSecret() {
|
||||
echo "Writing custom secret"
|
||||
vault write -namespace=${SMQ_VAULT_NAMESPACE} -address=${SMQ_VAULT_ADDR} -f auth/approle/role/supermq_clients_certs_issuer/secret-id
|
||||
vault write -namespace=${SMQ_VAULT_NAMESPACE} -address=${SMQ_VAULT_ADDR} auth/approle/role/supermq_clients_certs_issuer/custom-secret-id secret_id=${SMQ_VAULT_CLIENTS_CERTS_ISSUER_SECRET} num_uses=0 ttl=0
|
||||
}
|
||||
|
||||
vaultTestRoleLogin() {
|
||||
echo "Testing custom roleid secret by logging in"
|
||||
vault write -namespace=${SMQ_VAULT_NAMESPACE} -address=${SMQ_VAULT_ADDR} auth/approle/login \
|
||||
role_id=${SMQ_VAULT_CLIENTS_CERTS_ISSUER_ROLEID} \
|
||||
secret_id=${SMQ_VAULT_CLIENTS_CERTS_ISSUER_SECRET}
|
||||
}
|
||||
|
||||
if ! command -v jq &> /dev/null; then
|
||||
echo "jq command could not be found, please install it and try again."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
readDotEnv
|
||||
|
||||
vault login -namespace=${SMQ_VAULT_NAMESPACE} -address=${SMQ_VAULT_ADDR} ${SMQ_VAULT_TOKEN}
|
||||
|
||||
vaultCreatePolicyFile
|
||||
vaultCreatePolicy
|
||||
vaultEnableAppRole
|
||||
vaultDeleteRole
|
||||
vaultCreateRole
|
||||
vaultWriteCustomRoleID
|
||||
vaultWriteCustomSecret
|
||||
vaultTestRoleLogin
|
||||
|
||||
exit 0
|
||||
@@ -1,46 +0,0 @@
|
||||
#!/usr/bin/bash
|
||||
# Copyright (c) Abstract Machines
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
scriptdir="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
|
||||
|
||||
# default env file path
|
||||
env_file="docker/.env"
|
||||
|
||||
while [[ "$#" -gt 0 ]]; do
|
||||
case $1 in
|
||||
--env-file)
|
||||
if [[ -z "${2:-}" ]]; then
|
||||
echo "Error: --env-file requires a non-empty option argument."
|
||||
exit 1
|
||||
fi
|
||||
env_file="$2"
|
||||
if [[ ! -f "$env_file" ]]; then
|
||||
echo "Error: .env file not found at $env_file"
|
||||
exit 1
|
||||
fi
|
||||
shift
|
||||
;;
|
||||
*)
|
||||
echo "Unknown parameter passed: $1"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
shift
|
||||
done
|
||||
|
||||
readDotEnv() {
|
||||
set -o allexport
|
||||
source "$env_file"
|
||||
set +o allexport
|
||||
}
|
||||
|
||||
source "$scriptdir/vault_cmd.sh"
|
||||
|
||||
readDotEnv
|
||||
|
||||
mkdir -p "$scriptdir/data"
|
||||
|
||||
vault operator init -address="$SMQ_VAULT_ADDR" 2>&1 | tee >(sed -r 's/\x1b\[[0-9;]*m//g' > "$scriptdir/data/secrets")
|
||||
@@ -1,252 +0,0 @@
|
||||
#!/usr/bin/bash
|
||||
# Copyright (c) Abstract Machines
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
scriptdir="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
|
||||
|
||||
# edfault env file path
|
||||
env_file="docker/.env"
|
||||
|
||||
SKIP_SERVER_CERT=""
|
||||
|
||||
while [[ "$#" -gt 0 ]]; do
|
||||
case $1 in
|
||||
--env-file)
|
||||
if [[ -z "${2:-}" ]]; then
|
||||
echo "Error: --env-file requires a non-empty option argument."
|
||||
exit 1
|
||||
fi
|
||||
env_file="$2"
|
||||
if [[ ! -f "$env_file" ]]; then
|
||||
echo "Error: .env file not found at $env_file"
|
||||
exit 1
|
||||
fi
|
||||
shift
|
||||
;;
|
||||
--skip-server-cert)
|
||||
SKIP_SERVER_CERT="--skip-server-cert"
|
||||
;;
|
||||
*)
|
||||
echo "Unknown parameter passed: $1"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
shift
|
||||
done
|
||||
|
||||
readDotEnv() {
|
||||
set -o allexport
|
||||
source "$env_file"
|
||||
set +o allexport
|
||||
}
|
||||
|
||||
readDotEnv
|
||||
|
||||
server_name="localhost"
|
||||
|
||||
# Check if SMQ_NGINX_SERVER_NAME is set or not empty
|
||||
if [ -n "${SMQ_NGINX_SERVER_NAME:-}" ]; then
|
||||
server_name="$SMQ_NGINX_SERVER_NAME"
|
||||
fi
|
||||
|
||||
source "$scriptdir/vault_cmd.sh"
|
||||
|
||||
vaultEnablePKI() {
|
||||
vault secrets enable -namespace=${SMQ_VAULT_NAMESPACE} -address=${SMQ_VAULT_ADDR} -path ${SMQ_VAULT_PKI_PATH} pki
|
||||
vault secrets tune -namespace=${SMQ_VAULT_NAMESPACE} -address=${SMQ_VAULT_ADDR} -max-lease-ttl=87600h ${SMQ_VAULT_PKI_PATH}
|
||||
}
|
||||
|
||||
vaultConfigPKIClusterPath() {
|
||||
vault write -namespace=${SMQ_VAULT_NAMESPACE} -address=${SMQ_VAULT_ADDR} ${SMQ_VAULT_PKI_PATH}/config/cluster aia_path=${SMQ_VAULT_PKI_CLUSTER_AIA_PATH} path=${SMQ_VAULT_PKI_CLUSTER_PATH}
|
||||
}
|
||||
|
||||
vaultConfigPKICrl() {
|
||||
vault write -namespace=${SMQ_VAULT_NAMESPACE} -address=${SMQ_VAULT_ADDR} ${SMQ_VAULT_PKI_PATH}/config/crl expiry="5m" ocsp_disable=false ocsp_expiry=0 auto_rebuild=true auto_rebuild_grace_period="2m" enable_delta=true delta_rebuild_interval="1m"
|
||||
}
|
||||
|
||||
vaultAddRoleToSecret() {
|
||||
vault write -namespace=${SMQ_VAULT_NAMESPACE} -address=${SMQ_VAULT_ADDR} ${SMQ_VAULT_PKI_PATH}/roles/${SMQ_VAULT_PKI_ROLE_NAME} \
|
||||
allow_any_name=true \
|
||||
max_ttl="8760h" \
|
||||
default_ttl="8760h" \
|
||||
generate_lease=true
|
||||
}
|
||||
|
||||
vaultGenerateRootCACertificate() {
|
||||
echo "Generate root CA certificate"
|
||||
vault write -namespace=${SMQ_VAULT_NAMESPACE} -address=${SMQ_VAULT_ADDR} -format=json ${SMQ_VAULT_PKI_PATH}/root/generate/exported \
|
||||
common_name="\"$SMQ_VAULT_PKI_CA_CN\"" \
|
||||
ou="\"$SMQ_VAULT_PKI_CA_OU\"" \
|
||||
organization="\"$SMQ_VAULT_PKI_CA_O\"" \
|
||||
country="\"$SMQ_VAULT_PKI_CA_C\"" \
|
||||
locality="\"$SMQ_VAULT_PKI_CA_L\"" \
|
||||
province="\"$SMQ_VAULT_PKI_CA_ST\"" \
|
||||
street_address="\"$SMQ_VAULT_PKI_CA_ADDR\"" \
|
||||
postal_code="\"$SMQ_VAULT_PKI_CA_PO\"" \
|
||||
ttl=87600h | tee >(jq -r .data.certificate >"$scriptdir/data/${SMQ_VAULT_PKI_FILE_NAME}_ca.crt") \
|
||||
>(jq -r .data.issuing_ca >"$scriptdir/data/${SMQ_VAULT_PKI_FILE_NAME}_issuing_ca.crt") \
|
||||
>(jq -r .data.private_key >"$scriptdir/data/${SMQ_VAULT_PKI_FILE_NAME}_ca.key")
|
||||
}
|
||||
|
||||
vaultSetupRootCAIssuingURLs() {
|
||||
echo "Setup URLs for CRL and issuing"
|
||||
vault write -namespace=${SMQ_VAULT_NAMESPACE} -address=${SMQ_VAULT_ADDR} ${SMQ_VAULT_PKI_PATH}/config/urls \
|
||||
issuing_certificates="{{cluster_aia_path}}/v1/${SMQ_VAULT_PKI_PATH}/ca" \
|
||||
crl_distribution_points="{{cluster_aia_path}}/v1/${SMQ_VAULT_PKI_PATH}/crl" \
|
||||
ocsp_servers="{{cluster_aia_path}}/v1/${SMQ_VAULT_PKI_PATH}/ocsp" \
|
||||
enable_templating=true
|
||||
}
|
||||
|
||||
vaultGenerateIntermediateCAPKI() {
|
||||
echo "Generate Intermediate CA PKI"
|
||||
vault secrets enable -namespace=${SMQ_VAULT_NAMESPACE} -address=${SMQ_VAULT_ADDR} -path=${SMQ_VAULT_PKI_INT_PATH} pki
|
||||
vault secrets tune -namespace=${SMQ_VAULT_NAMESPACE} -address=${SMQ_VAULT_ADDR} -max-lease-ttl=43800h ${SMQ_VAULT_PKI_INT_PATH}
|
||||
}
|
||||
|
||||
vaultConfigIntermediatePKIClusterPath() {
|
||||
vault write -namespace=${SMQ_VAULT_NAMESPACE} -address=${SMQ_VAULT_ADDR} ${SMQ_VAULT_PKI_INT_PATH}/config/cluster aia_path=${SMQ_VAULT_PKI_INT_CLUSTER_AIA_PATH} path=${SMQ_VAULT_PKI_INT_CLUSTER_PATH}
|
||||
}
|
||||
|
||||
vaultConfigIntermediatePKICrl() {
|
||||
vault write -namespace=${SMQ_VAULT_NAMESPACE} -address=${SMQ_VAULT_ADDR} ${SMQ_VAULT_PKI_INT_PATH}/config/crl expiry="5m" ocsp_disable=false ocsp_expiry=0 auto_rebuild=true auto_rebuild_grace_period="2m" enable_delta=true delta_rebuild_interval="1m"
|
||||
}
|
||||
|
||||
vaultGenerateIntermediateCSR() {
|
||||
echo "Generate intermediate CSR"
|
||||
vault write -namespace=${SMQ_VAULT_NAMESPACE} -address=${SMQ_VAULT_ADDR} -format=json ${SMQ_VAULT_PKI_INT_PATH}/intermediate/generate/exported \
|
||||
common_name="\"$SMQ_VAULT_PKI_INT_CA_CN\"" \
|
||||
ou="\"$SMQ_VAULT_PKI_INT_CA_OU\""\
|
||||
organization="\"$SMQ_VAULT_PKI_INT_CA_O\"" \
|
||||
country="\"$SMQ_VAULT_PKI_INT_CA_C\"" \
|
||||
locality="\"$SMQ_VAULT_PKI_INT_CA_L\"" \
|
||||
province="\"$SMQ_VAULT_PKI_INT_CA_ST\"" \
|
||||
street_address="\"$SMQ_VAULT_PKI_INT_CA_ADDR\"" \
|
||||
postal_code="\"$SMQ_VAULT_PKI_INT_CA_PO\"" \
|
||||
| tee >(jq -r .data.csr >"$scriptdir/data/${SMQ_VAULT_PKI_INT_FILE_NAME}.csr") \
|
||||
>(jq -r .data.private_key >"$scriptdir/data/${SMQ_VAULT_PKI_INT_FILE_NAME}.key")
|
||||
}
|
||||
|
||||
vaultSignIntermediateCSR() {
|
||||
echo "Sign intermediate CSR"
|
||||
if is_container_running "supermq-vault"; then
|
||||
docker cp "$scriptdir/data/${SMQ_VAULT_PKI_INT_FILE_NAME}.csr" supermq-vault:/vault/${SMQ_VAULT_PKI_INT_FILE_NAME}.csr
|
||||
vault write -namespace=${SMQ_VAULT_NAMESPACE} -address=${SMQ_VAULT_ADDR} -format=json ${SMQ_VAULT_PKI_PATH}/root/sign-intermediate \
|
||||
csr=@/vault/${SMQ_VAULT_PKI_INT_FILE_NAME}.csr ttl="8760h" \
|
||||
ou="\"$SMQ_VAULT_PKI_INT_CA_OU\""\
|
||||
organization="\"$SMQ_VAULT_PKI_INT_CA_O\"" \
|
||||
country="\"$SMQ_VAULT_PKI_INT_CA_C\"" \
|
||||
locality="\"$SMQ_VAULT_PKI_INT_CA_L\"" \
|
||||
province="\"$SMQ_VAULT_PKI_INT_CA_ST\"" \
|
||||
street_address="\"$SMQ_VAULT_PKI_INT_CA_ADDR\"" \
|
||||
postal_code="\"$SMQ_VAULT_PKI_INT_CA_PO\"" \
|
||||
| tee >(jq -r .data.certificate >"$scriptdir/data/${SMQ_VAULT_PKI_INT_FILE_NAME}.crt") \
|
||||
>(jq -r .data.issuing_ca >"$scriptdir/data/${SMQ_VAULT_PKI_INT_FILE_NAME}_issuing_ca.crt")
|
||||
else
|
||||
vault write -namespace=${SMQ_VAULT_NAMESPACE} -address=${SMQ_VAULT_ADDR} -format=json ${SMQ_VAULT_PKI_PATH}/root/sign-intermediate \
|
||||
csr=@"$scriptdir/data/${SMQ_VAULT_PKI_INT_FILE_NAME}.csr" ttl="8760h" \
|
||||
ou="\"$SMQ_VAULT_PKI_INT_CA_OU\""\
|
||||
organization="\"$SMQ_VAULT_PKI_INT_CA_O\"" \
|
||||
country="\"$SMQ_VAULT_PKI_INT_CA_C\"" \
|
||||
locality="\"$SMQ_VAULT_PKI_INT_CA_L\"" \
|
||||
province="\"$SMQ_VAULT_PKI_INT_CA_ST\"" \
|
||||
street_address="\"$SMQ_VAULT_PKI_INT_CA_ADDR\"" \
|
||||
postal_code="\"$SMQ_VAULT_PKI_INT_CA_PO\"" \
|
||||
| tee >(jq -r .data.certificate >"$scriptdir/data/${SMQ_VAULT_PKI_INT_FILE_NAME}.crt") \
|
||||
>(jq -r .data.issuing_ca >"$scriptdir/data/${SMQ_VAULT_PKI_INT_FILE_NAME}_issuing_ca.crt")
|
||||
fi
|
||||
}
|
||||
|
||||
vaultInjectIntermediateCertificate() {
|
||||
echo "Inject Intermediate Certificate"
|
||||
if is_container_running "supermq-vault"; then
|
||||
docker cp "$scriptdir/data/${SMQ_VAULT_PKI_INT_FILE_NAME}.crt" supermq-vault:/vault/${SMQ_VAULT_PKI_INT_FILE_NAME}.crt
|
||||
vault write -namespace=${SMQ_VAULT_NAMESPACE} -address=${SMQ_VAULT_ADDR} ${SMQ_VAULT_PKI_INT_PATH}/intermediate/set-signed certificate=@/vault/${SMQ_VAULT_PKI_INT_FILE_NAME}.crt
|
||||
else
|
||||
vault write -namespace=${SMQ_VAULT_NAMESPACE} -address=${SMQ_VAULT_ADDR} ${SMQ_VAULT_PKI_INT_PATH}/intermediate/set-signed certificate=@"$scriptdir/data/${SMQ_VAULT_PKI_INT_FILE_NAME}.crt"
|
||||
fi
|
||||
}
|
||||
|
||||
vaultGenerateIntermediateCertificateBundle() {
|
||||
echo "Generate intermediate certificate bundle"
|
||||
cat "$scriptdir/data/${SMQ_VAULT_PKI_INT_FILE_NAME}.crt" "$scriptdir/data/${SMQ_VAULT_PKI_FILE_NAME}_ca.crt" \
|
||||
> "$scriptdir/data/${SMQ_VAULT_PKI_INT_FILE_NAME}_bundle.crt"
|
||||
}
|
||||
|
||||
vaultSetupIntermediateIssuingURLs() {
|
||||
echo "Setup URLs for CRL and issuing"
|
||||
vault write -namespace=${SMQ_VAULT_NAMESPACE} -address=${SMQ_VAULT_ADDR} ${SMQ_VAULT_PKI_INT_PATH}/config/urls \
|
||||
issuing_certificates="{{cluster_aia_path}}/v1/${SMQ_VAULT_PKI_INT_PATH}/ca" \
|
||||
crl_distribution_points="{{cluster_aia_path}}/v1/${SMQ_VAULT_PKI_INT_PATH}/crl" \
|
||||
ocsp_servers="{{cluster_aia_path}}/v1/${SMQ_VAULT_PKI_INT_PATH}/ocsp" \
|
||||
enable_templating=true
|
||||
}
|
||||
|
||||
vaultSetupServerCertsRole() {
|
||||
if [ "$SKIP_SERVER_CERT" == "--skip-server-cert" ]; then
|
||||
echo "Skipping server certificate role"
|
||||
else
|
||||
echo "Setup Server certificate role"
|
||||
vault write -namespace=${SMQ_VAULT_NAMESPACE} -address=${SMQ_VAULT_ADDR} ${SMQ_VAULT_PKI_INT_PATH}/roles/${SMQ_VAULT_PKI_INT_SERVER_CERTS_ROLE_NAME} \
|
||||
allow_subdomains=true \
|
||||
allow_any_name=true \
|
||||
max_ttl="4320h"
|
||||
fi
|
||||
}
|
||||
|
||||
vaultGenerateServerCertificate() {
|
||||
if [ "$SKIP_SERVER_CERT" == "--skip-server-cert" ]; then
|
||||
echo "Skipping generate server certificate"
|
||||
else
|
||||
echo "Generate server certificate"
|
||||
vault write -namespace=${SMQ_VAULT_NAMESPACE} -address=${SMQ_VAULT_ADDR} -format=json ${SMQ_VAULT_PKI_INT_PATH}/issue/${SMQ_VAULT_PKI_INT_SERVER_CERTS_ROLE_NAME} \
|
||||
common_name="$server_name" ttl="4320h" \
|
||||
| tee >(jq -r .data.certificate >"$scriptdir/data/${server_name}.crt") \
|
||||
>(jq -r .data.private_key >"$scriptdir/data/${server_name}.key")
|
||||
fi
|
||||
}
|
||||
|
||||
vaultSetupClientCertsRole() {
|
||||
echo "Setup Client Certs role"
|
||||
vault write -namespace=${SMQ_VAULT_NAMESPACE} -address=${SMQ_VAULT_ADDR} ${SMQ_VAULT_PKI_INT_PATH}/roles/${SMQ_VAULT_PKI_INT_CLIENTS_CERTS_ROLE_NAME} \
|
||||
allow_subdomains=true \
|
||||
allow_any_name=true \
|
||||
max_ttl="2160h"
|
||||
}
|
||||
|
||||
vaultCleanupFiles() {
|
||||
if is_container_running "supermq-vault"; then
|
||||
docker exec supermq-vault sh -c 'rm -rf /vault/*.{crt,csr}'
|
||||
fi
|
||||
}
|
||||
|
||||
if ! command -v jq &> /dev/null; then
|
||||
echo "jq command could not be found, please install it and try again."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
mkdir -p "$scriptdir/data"
|
||||
|
||||
vault login -namespace=${SMQ_VAULT_NAMESPACE} -address=${SMQ_VAULT_ADDR} ${SMQ_VAULT_TOKEN}
|
||||
|
||||
vaultEnablePKI
|
||||
vaultConfigPKIClusterPath
|
||||
vaultConfigPKICrl
|
||||
vaultAddRoleToSecret
|
||||
vaultGenerateRootCACertificate
|
||||
vaultSetupRootCAIssuingURLs
|
||||
vaultGenerateIntermediateCAPKI
|
||||
vaultConfigIntermediatePKIClusterPath
|
||||
vaultConfigIntermediatePKICrl
|
||||
vaultGenerateIntermediateCSR
|
||||
vaultSignIntermediateCSR
|
||||
vaultInjectIntermediateCertificate
|
||||
vaultGenerateIntermediateCertificateBundle
|
||||
vaultSetupIntermediateIssuingURLs
|
||||
vaultSetupServerCertsRole
|
||||
vaultGenerateServerCertificate
|
||||
vaultSetupClientCertsRole
|
||||
vaultCleanupFiles
|
||||
|
||||
exit 0
|
||||
@@ -1,46 +0,0 @@
|
||||
#!/usr/bin/bash
|
||||
# Copyright (c) Abstract Machines
|
||||
# SPDX-License-Identifier: Apache-2.0
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
scriptdir="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
|
||||
|
||||
# default env file path
|
||||
env_file="docker/.env"
|
||||
|
||||
while [[ "$#" -gt 0 ]]; do
|
||||
case $1 in
|
||||
--env-file)
|
||||
if [[ -z "${2:-}" ]]; then
|
||||
echo "Error: --env-file requires a non-empty option argument."
|
||||
exit 1
|
||||
fi
|
||||
env_file="$2"
|
||||
if [[ ! -f "$env_file" ]]; then
|
||||
echo "Error: .env file not found at $env_file"
|
||||
exit 1
|
||||
fi
|
||||
shift
|
||||
;;
|
||||
*)
|
||||
echo "Unknown parameter passed: $1"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
shift
|
||||
done
|
||||
|
||||
readDotEnv() {
|
||||
set -o allexport
|
||||
source "$env_file"
|
||||
set +o allexport
|
||||
}
|
||||
|
||||
source "$scriptdir/vault_cmd.sh"
|
||||
|
||||
readDotEnv
|
||||
|
||||
vault operator unseal -address=${SMQ_VAULT_ADDR} ${SMQ_VAULT_UNSEAL_KEY_1}
|
||||
vault operator unseal -address=${SMQ_VAULT_ADDR} ${SMQ_VAULT_UNSEAL_KEY_2}
|
||||
vault operator unseal -address=${SMQ_VAULT_ADDR} ${SMQ_VAULT_UNSEAL_KEY_3}
|
||||
Reference in New Issue
Block a user