-
Notifications
You must be signed in to change notification settings - Fork 202
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
chore: Common secret store init script for rhel & deb
- Loading branch information
1 parent
551e9ba
commit 6dd31c4
Showing
10 changed files
with
178 additions
and
252 deletions.
There are no files selected for viewing
36 changes: 36 additions & 0 deletions
36
...xroad-secret-store-local/usr/share/xroad/scripts/secret-store-generate-tls-certificate.sh
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| #!/bin/bash | ||
|
|
||
| set -e | ||
|
|
||
| echo "Generating OpenBao TLS certificates for X-Road..." | ||
| # Generate in temporary location first | ||
| TEMP_DIR=$(mktemp -d) | ||
| cd "$TEMP_DIR" | ||
|
|
||
| # Generate certificates with proper permissions | ||
| if ! openssl req \ | ||
| -out tls.crt \ | ||
| -new \ | ||
| -keyout tls.key \ | ||
| -newkey rsa:4096 \ | ||
| -nodes \ | ||
| -sha256 \ | ||
| -x509 \ | ||
| -subj "/O=OpenBao/CN=OpenBao" \ | ||
| -days 7300 \ | ||
| -addext "subjectAltName = IP:127.0.0.1" \ | ||
| -addext "keyUsage = digitalSignature,keyEncipherment" \ | ||
| -addext "extendedKeyUsage = serverAuth"; then | ||
| echo "Failed to generate certificates" | ||
| exit 1 | ||
| fi | ||
|
|
||
| # Set proper permissions and ownership | ||
| chmod 640 tls.key tls.crt | ||
| chown openbao:openbao tls.key tls.crt | ||
|
|
||
| # Move files to final location | ||
| mv -f tls.key tls.crt /opt/openbao/tls/ | ||
|
|
||
| # Cleanup temp directory | ||
| rm -rf "$TEMP_DIR" |
106 changes: 106 additions & 0 deletions
106
...es/src/xroad/common/xroad-secret-store-local/usr/share/xroad/scripts/secret-store-init.sh
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,106 @@ | ||
| #!/bin/bash | ||
|
|
||
| STATUS=$(bao status -format=json) # exits with non-zero status if not initialized or sealed | ||
|
|
||
| set -e | ||
|
|
||
| INITIALIZED=$(jq -r '.initialized' <<< $STATUS) | ||
| SEALED=$(jq -r '.sealed' <<< $STATUS) | ||
| KEYS_FILE="/etc/openbao/secret-store-keys.json" | ||
|
|
||
| if [ "$INITIALIZED" = "true" ]; then | ||
| echo "OpenBao already initialized" | ||
| else | ||
| echo "Initializing OpenBao..." | ||
| bao operator init -key-shares=3 -key-threshold=2 -format=json > $KEYS_FILE | ||
| chmod 600 $KEYS_FILE | ||
| fi | ||
|
|
||
|
|
||
| if [ ! -f "$KEYS_FILE" ]; then | ||
| echo "Keys file not found" | ||
| exit 1 | ||
| fi | ||
|
|
||
|
|
||
| if [ "$SEALED" = "false" ]; then | ||
| echo "OpenBao already unsealed" | ||
| else | ||
| echo "Unsealing OpenBao..." | ||
| # Read first two keys for unsealing | ||
| KEY1=$(jq -r '.unseal_keys_b64[0]' "$KEYS_FILE") | ||
| KEY2=$(jq -r '.unseal_keys_b64[1]' "$KEYS_FILE") | ||
|
|
||
| # Unseal with two keys | ||
| bao operator unseal "$KEY1" | ||
| bao operator unseal "$KEY2" | ||
| fi | ||
|
|
||
|
|
||
| export BAO_TOKEN=$(cat $KEYS_FILE | jq -r '.root_token') | ||
|
|
||
| XRD_PKI_CONFIGURED=$(bao secrets list -format=json | jq 'has("xrd-pki/")') | ||
| if [ "$XRD_PKI_CONFIGURED" = "true" ]; then | ||
| echo "X-Road secrets engine already initialized" | ||
| else | ||
| echo "Initializing X-Road secrets engine ..." | ||
|
|
||
| # Enable secrets engines | ||
| bao secrets enable -path=xrd-pki pki || exit 1 | ||
| bao secrets enable -path=xrd-secret kv || exit 1 | ||
| bao secrets enable -path=xrd-ds-secret -version=2 kv || exit 1 | ||
|
|
||
| # Configure PKI | ||
| bao secrets tune -max-lease-ttl=87600h xrd-pki || exit 1 | ||
| bao write xrd-pki/root/generate/internal common_name="localhost" ttl=8760h || exit 1 | ||
| bao write xrd-pki/config/urls \ | ||
| issuing_certificates="https://127.0.0.1:8200/v1/xrd-pki/ca" \ | ||
| crl_distribution_points="https://127.0.0.1:8200/v1/xrd-pki/crl" || exit 1 | ||
|
|
||
| # Configure PKI tidy settings | ||
| bao write xrd-pki/config/auto-tidy \ | ||
| tidy_cert_store=true \ | ||
| tidy_revoked_certs=true \ | ||
| safety_buffer="72h" \ | ||
| interval_duration="24h" || exit 1 | ||
|
|
||
| # Configure roles | ||
| bao write xrd-pki/roles/xrd-rpc-internal \ | ||
| allow_any_name=true \ | ||
| allow_subdomains=true \ | ||
| allow_localhost=true \ | ||
| allow_ip_sans=true \ | ||
| max_ttl="300h" || exit 1 | ||
|
|
||
| # Create policy for PKI and secret access | ||
| bao policy write xroad-policy - <<EOF | ||
| path "xrd-pki/*" { | ||
| capabilities = ["create", "read", "update", "delete", "list"] | ||
| } | ||
| path "xrd-secret/*" { | ||
| capabilities = ["read", "list"] | ||
| } | ||
| path "xrd-secret" { | ||
| capabilities = ["list"] | ||
| } | ||
| path "xrd-ds-secret/*" { | ||
| capabilities = ["create", "read", "update", "delete", "list"] | ||
| } | ||
| path "sys/internal/ui/mounts/*" { | ||
| capabilities = ["read", "list"] | ||
| } | ||
| EOF | ||
| fi | ||
|
|
||
| CLIENT_TOKEN_FILE="/etc/xroad/secret-store-client-token" | ||
| if [ -f $CLIENT_TOKEN_FILE ]; then | ||
| echo "X-Road client token already exists" | ||
| else | ||
| echo "Generating X-Road client token.." | ||
| CLIENT_TOKEN=$(bao token create -policy=xroad-policy -format=json | jq -r '.auth.client_token') | ||
| echo "$CLIENT_TOKEN" > $CLIENT_TOKEN_FILE | ||
| chmod 640 $CLIENT_TOKEN_FILE | ||
| chown xroad:xroad $CLIENT_TOKEN_FILE | ||
| fi | ||
|
|
||
| unset BAO_TOKEN |
58 changes: 0 additions & 58 deletions
58
...s/src/xroad/common/xroad-secret-store-local/usr/share/xroad/scripts/secret-store-setup.sh
This file was deleted.
Oops, something went wrong.
16 changes: 0 additions & 16 deletions
16
.../src/xroad/common/xroad-secret-store-local/usr/share/xroad/scripts/secret-store-unseal.sh
This file was deleted.
Oops, something went wrong.
8 changes: 4 additions & 4 deletions
8
src/packages/src/xroad/redhat/SOURCES/secret-store-local/xroad-secret-store-local.service
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
4 changes: 2 additions & 2 deletions
4
src/packages/src/xroad/ubuntu/generic/xroad-secret-store-local.install
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,3 +1,3 @@ | ||
| ../../../../src/xroad/common/xroad-secret-store-local/usr/share/xroad/scripts/secret-store-unseal.sh usr/share/xroad/scripts | ||
| ../../../../src/xroad/common/xroad-secret-store-local/usr/share/xroad/scripts/secret-store-setup.sh usr/share/xroad/scripts | ||
| ../../../../src/xroad/common/xroad-secret-store-local/usr/share/xroad/scripts/secret-store-generate-tls-certificate.sh usr/share/xroad/scripts | ||
| ../../../../src/xroad/common/xroad-secret-store-local/usr/share/xroad/scripts/secret-store-init.sh usr/share/xroad/scripts | ||
| ../../../../src/xroad/common/xroad-secret-store-local/etc/xroad/services/secret-store-local.conf etc/xroad/services |
Oops, something went wrong.