Resolve "Fix certificates local deployment with different hostname"

Jorge Moratinosrequested to merge
OCF110-fix-certificates-local-deployment-with-different-hostname into staging

Closes #110 (closed)

Merge request reports

services/register/Dockerfile

+0 −2
Changes for services/register/Dockerfile: 0 added lines, 2 removed lines.
Original line number Diff line number Diff line
@@ -17,8 +17,6 @@ RUN apt-get update && apt-get install -y --no-install-recommends \ 
RUN pip3 install --no-cache-dir -r requirements.txt

RUN apt-get update && apt-get install -y --no-install-recommends openssl curl redis



#ENV CAPIF_PRIV_KEY = $CAPIF_PRIV_KEY



COPY . /usr/src/app



EXPOSE 8080

services/vault/vault_prepare_certs.sh

+20 −42
Changes for services/vault/vault_prepare_certs.sh: 20 added lines, 42 removed lines.
Original line number Diff line number Diff line 
#!/bin/sh



# Establecer las variables de entorno de Vault

# Setup environment variables for Vault

export VAULT_ADDR="http://$VAULT_DEV_LISTEN_ADDRESS"

export VAULT_TOKEN=$VAULT_DEV_ROOT_TOKEN_ID

HOSTNAME="$CAPIF_HOSTNAME"



export VAULT_ADDR='http://0.0.0.0:8200'

export VAULT_TOKEN="dev-only-token"

echo "CAPIF_HOSTNAME: $HOSTNAME"

echo "VAULT_ADDR: $VAULT_ADDR"

echo "VAULT_TOKEN: $VAULT_TOKEN"



vault secrets enable pki



# Generar una CA en Vault

# Generate a root CA

vault secrets tune -max-lease-ttl=87600h pki



vault write -field=certificate pki/root/generate/internal \
@@ -19,7 +23,7 @@ vault write pki/config/urls \ 
     issuing_certificates="$VAULT_ADDR/v1/pki/ca" \

     crl_distribution_points="$VAULT_ADDR/v1/pki/crl"



# # Generar una CA intermedia en Vault

# Generate an intermediate CA

vault secrets enable -path=pki_int pki



vault secrets tune -max-lease-ttl=43800h pki_int
@@ -29,34 +33,20 @@ vault write -format=json pki_int/intermediate/generate/internal \ 
     issuer_name="capif-intermediate" \

    | jq -r '.data.csr' > pki_intermediate.csr



# Firmar la CA intermedia con la CA raíz

# Sign the intermediate CA

vault write -format=json pki/root/sign-intermediate \

     issuer_ref="root-2023" \

     csr=@pki_intermediate.csr \

     format=pem_bundle ttl="43800h" \

     | jq -r '.data.certificate' > capif_intermediate.cert.pem



# Configurar la CA intermedia en Vault

# Configure the intermediate CA

vault write pki_int/intermediate/set-signed certificate=@capif_intermediate.cert.pem



#Crear rol en Vault

vault write pki_int/roles/my-ca use_csr_common_name=false require_cn=true use_csr_sans=false allowed_domains=capifcore allow_any_name=true allow_bare_domains=true allow_glob_domains=true allow_subdomains=true max_ttl=4300h ttl=4300h

# Configure the role for the intermediate CA

vault write pki_int/roles/my-ca use_csr_common_name=false require_cn=true use_csr_sans=false allowed_domains=$HOSTNAME allow_any_name=true allow_bare_domains=true allow_glob_domains=true allow_subdomains=true max_ttl=4300h ttl=4300h



# Emitir un certificado firmado por la CA intermedia

# vault write -format=json pki_int/issue/my-ca \

#   common_name="capifcore" \

#   format=pem_bundle ttl="438h" \

#   | jq -r '.data.certificate' > ccf_cert.crt.pem \

#   && jq -r '.data.issuing_ca' > root_ca.crt.pem \

#   && jq -r '.data.private_key' > private_key.pem



#   vault write -format=json pki_int/issue/my-ca \

#   common_name="capifcore" \

#   format=pem_bundle ttl="438h" \

#   | jq -r '.data.private_key as $private_key | .data.issuing_ca as $issuing_ca | .data.certificate as $certificate | [$private_key, $issuing_ca, $certificate]' > cert_data.json





#Create CSR

# Generate a certificate

openssl genrsa -out ./server.key 2048
@@ -65,7 +55,7 @@ STATE="Madrid" # state or province name 
LOCALITY="Madrid"        # Locality Name (e.g. city)

ORGNAME="Telefonica I+D" # Organization Name (eg, company)

ORGUNIT="Innovation"                  # Organizational Unit Name (eg. section)

COMMONNAME="capifcore"

COMMONNAME="$HOSTNAME"

EMAIL="inno@tid.es"    # certificate's email address

# optional extra details

CHALLENGE=""                # challenge password
@@ -74,7 +64,6 @@ COMPANY="" # company name 
# DAYS="-days 365"



# create the certificate request

#cat <<__EOF__ | openssl req -new $DAYS -nodes -keyout client.key -out client.csr

cat <<__EOF__ | openssl req -new $DAYS -key ./server.key -out ./server.csr

$COUNTRY

$STATE
@@ -87,31 +76,20 @@ $CHALLENGE 
$COMPANY

__EOF__



# vault write -format=json pki_int/issue/my-ca \

#   csr=@server.csr \

#   format=pem_bundle ttl="438h" \

#   | jq -r '.data.private_key as $private_key | .data.issuing_ca as $issuing_ca | .data.certificate as $certificate | [$private_key, $issuing_ca, $certificate]' > cert_data.json



vault write -format=json pki_int/sign/my-ca  format=pem_bundle ttl="43000h" csr=@server.csr common_name="capifcore" | jq -r '.data.issuing_ca as $issuing_ca | .data.certificate as $certificate | [$issuing_ca, $certificate]' > cert_data.json

vault write -format=json pki_int/sign/my-ca  format=pem_bundle ttl="43000h" csr=@server.csr common_name="$HOSTNAME" | jq -r '.data.issuing_ca as $issuing_ca | .data.certificate as $certificate | [$issuing_ca, $certificate]' > cert_data.json



jq -r '.[0]' cert_data.json > root_ca.crt.pem

jq -r '.[1]' cert_data.json > server_certificate.crt.pem



openssl x509 -pubkey -noout -in server_certificate.crt.pem  > server_certificate_pub.pem



# Guardar la clave privada en Vault



#vault kv put secret/ca ca=@root_ca.crt.pem root_2023_ca.crt



#cat root_2023_ca.crt root_2023_ca.crt > ca.crt



# Concatenate the root and intermediate CA certificates

cat > certificados_concatenados.crt << EOF

$(cat "root_2023_ca.crt")

$(cat "root_ca.crt.pem")

EOF





# vault kv put secret/ca ca=@root_2023_ca.crt

vault kv put secret/ca ca=@certificados_concatenados.crt



vault kv put secret/server_cert cert=@server_certificate.crt.pem
@@ -124,15 +102,15 @@ POLICY_NAME="my-policy" 
POLICY_FILE="my-policy.hcl"

TOKEN_ID="read-ca-token"



# Crear la política en Vault

# Create a policy to read the CA

echo "path \"secret/data/ca\" {

  capabilities = [\"read\"]

}" > "$POLICY_FILE"



vault policy write "$POLICY_NAME" "$POLICY_FILE"



# Generar un nuevo token y asignar la política

# Create a token with the policy

TOKEN=$(vault token create -id="$TOKEN_ID" -policy="$POLICY_NAME" -format=json | jq -r '.auth.client_token')



echo "Token generado:"

echo "Generated Token:"

echo "$TOKEN"
 
 No newline at end of file

services/clean_capif_docker_services.sh

+11 −0
Changes for services/clean_capif_docker_services.sh: 11 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -3,6 +3,8 @@ 
# Directories variables setup (no modification needed)

export SERVICES_DIR=$(dirname "$(readlink -f "$0")")

export CAPIF_BASE_DIR=$(dirname "$SERVICES_DIR")

# Path to the register config.yaml file

REGISTER_CONFIG_FILE="$SERVICES_DIR/register/config.yaml"



help() {

  echo "Usage: $1 <options>"
@@ -81,6 +83,15 @@ for FILE in "${FILES[@]}"; do 
    fi

done



# Check if the backup config.yaml file exists before restoring

if [ -f "$REGISTER_CONFIG_FILE.bak" ]; then

  git update-index --no-assume-unchanged "$REGISTER_CONFIG_FILE.bak"

  mv "$REGISTER_CONFIG_FILE.bak" "$REGISTER_CONFIG_FILE"

  git update-index --no-assume-unchanged "$REGISTER_CONFIG_FILE"

else

  echo "Backup config file not found, skipping restore."

fi



docker network rm capif-network



docker volume prune --all --force

services/docker-compose-register.yml

+1 −0
Changes for services/docker-compose-register.yml: 1 added line, 0 removed lines.
Original line number Diff line number Diff line
@@ -13,6 +13,7 @@ services: 
      - VAULT_PORT=8200

      - LOG_LEVEL=${LOG_LEVEL}

      - TIMEOUT=10

      - CAPIF_HOSTNAME=${CAPIF_HOSTNAME}

    extra_hosts:

      - host.docker.internal:host-gateway

      - vault:host-gateway

services/docker-compose-vault.yml

+1 −0
Changes for services/docker-compose-vault.yml: 1 added line, 0 removed lines.
Original line number Diff line number Diff line
@@ -10,6 +10,7 @@ services: 
    environment:

      - VAULT_DEV_ROOT_TOKEN_ID=dev-only-token

      - VAULT_DEV_LISTEN_ADDRESS=0.0.0.0:8200

      - CAPIF_HOSTNAME=${CAPIF_HOSTNAME}

    volumes:

      - ./vault/data:/vault/data

      - ./vault/config:/vault/config