59 lines
2.5 KiB
Bash
Executable File
59 lines
2.5 KiB
Bash
Executable File
#!/bin/sh
|
|
# SPDX-FileCopyrightText: 2026 Bart Broere
|
|
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
# Starts boltage. With BOLTAGE_TLS_SELF_SIGNED=true, it first generates a self-signed
|
|
# TLS certificate, or reuses the one from an earlier start, and points boltage at it.
|
|
set -eu
|
|
|
|
if [ "${BOLTAGE_TLS_SELF_SIGNED:-false}" = "true" ]; then
|
|
if [ -n "${BOLTAGE_TLS_CERT:-}${BOLTAGE_TLS_KEY:-}" ]; then
|
|
echo "boltage: BOLTAGE_TLS_CERT or BOLTAGE_TLS_KEY is set, not using a self-signed certificate" >&2
|
|
else
|
|
dir="${BOLTAGE_TLS_DIR:-/var/lib/boltage/tls}"
|
|
cert="$dir/self-signed.crt"
|
|
key="$dir/self-signed.key"
|
|
|
|
# Host names and addresses the certificate is valid for.
|
|
names="localhost,127.0.0.1,::1"
|
|
[ -n "${BOLTAGE_ADVERTISED_HOST:-}" ] && names="$names,$BOLTAGE_ADVERTISED_HOST"
|
|
[ -n "${BOLTAGE_TLS_HOSTNAMES:-}" ] && names="$names,$BOLTAGE_TLS_HOSTNAMES"
|
|
is_ip() {
|
|
case "$1" in
|
|
*[!0-9.]*) ;; # not IPv4
|
|
*) return 0 ;;
|
|
esac
|
|
case "$1" in
|
|
*:*) case "$1" in *[!0-9a-fA-F:.]*) return 1 ;; *) return 0 ;; esac ;; # IPv6
|
|
esac
|
|
return 1
|
|
}
|
|
san=""
|
|
for name in $(echo "$names" | tr ', ' '\n\n' | awk 'NF && !seen[$0]++'); do
|
|
if is_ip "$name"; then
|
|
san="${san:+$san,}IP:$name"
|
|
else
|
|
san="${san:+$san,}DNS:$name"
|
|
fi
|
|
done
|
|
|
|
# Generate a new certificate on first start, when the names changed, or when the
|
|
# stored one expires within 30 days.
|
|
if [ ! -s "$key" ] || [ "$(cat "$dir/self-signed.names" 2>/dev/null)" != "$san" ] \
|
|
|| ! openssl x509 -in "$cert" -noout -checkend 2592000 >/dev/null 2>&1; then
|
|
(umask 077 && mkdir -p "$dir")
|
|
(umask 077 && openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -nodes \
|
|
-days 825 -subj "/CN=boltage" -addext "subjectAltName=$san" \
|
|
-addext "extendedKeyUsage=serverAuth" \
|
|
-keyout "$key.new" -out "$cert.new" 2>/dev/null)
|
|
mv "$key.new" "$key"
|
|
mv "$cert.new" "$cert"
|
|
echo "$san" > "$dir/self-signed.names"
|
|
echo "boltage: generated a self-signed TLS certificate for $san in $dir"
|
|
fi
|
|
echo "boltage: self-signed TLS certificate, $(openssl x509 -in "$cert" -noout -fingerprint -sha256)"
|
|
export BOLTAGE_TLS_CERT="$cert" BOLTAGE_TLS_KEY="$key"
|
|
fi
|
|
fi
|
|
|
|
exec /opt/boltage/venv/bin/boltage "$@"
|