4

.gitignore

@@ -18,4 +18,12 @@ yarn-error.log*
 requests.rest
 .prettierrc
 CSV_FILES/
-log/
+log/
+
+
+bin/output/cert.csr
+bin/output/cert.pem
+bin/output/priv.key
+bin/tmp/csrconfig.txt
+traefik/cert.pem
+traefik/key.pem

Makefile

@@ -0,0 +1,20 @@
+all:
+	echo OK
+
+deploy-traefik:
+	ansible-playbook -i local-inventory --connection=local \
+		--extra-vars config_dir=/etc/app-traefik \
+		--extra-vars traefik_dashboard_hostname=traefik.ip.ngtech.home \
+		deploy-traefik.yml
+
+gen-cert:
+	cd bin && bash gen-cert.sh
+
+use-cert:
+	cp -vf bin/output/cert.pem traefik/cert.pem
+	cp -vf bin/output/priv.key traefik/key.pem
+
+install-dependencies:
+
+deploy-docker:
+	ansible-playbook --connection=local -i local-inventory deploy-docker-ce.yml

bin/gen-cert.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+
+STATE=$(head -1 vars/state)
+COUNTRY=$(head -1 vars/country)
+LOCALITY=$(head -1 vars/locality)
+ORGANIZATION=$(head -1 vars/organization)
+LOCALITRY=$(head -1 vars/locality)
+CN=$(head -1 vars/cn)
+DAYS=$(head -1 vars/days)
+
+SUBJECT_ALTERNATIVES=$( python3 gen-subject-alternatives.py )
+
+jinja2 templates/csrconfig.txt.j2 -D cn="${CN}" -D country="${COUNTRY}" -D state="${STATE}" -D locality="${LOCALITY}" \
+	-D org="${ORGANIZATION}" -D subj_alternative="${SUBJECT_ALTERNATIVES}" > tmp/csrconfig.txt
+
+
+#generate the RSA private key
+openssl genpkey -outform PEM -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out output/priv.key
+
+#Create the CSR
+openssl req -new -nodes -key output/priv.key -config tmp/csrconfig.txt -out output/cert.csr
+
+# Generate the self-signed certificate
+openssl x509 -req -days ${DAYS} -in output/cert.csr -signkey output/priv.key -out output/cert.pem

bin/gen-subject-alternatives.py

@@ -0,0 +1,42 @@
+#!/usr/bin/env python3
+
+def read_file(file_name):
+    with open(file_name, 'r') as file:
+        data = file.readlines()
+    return [line.strip() for line in data if line.strip()]
+
+def generate_san_config(ips, domains, emails):
+    san_config = ""
+    entries = []
+
+    for i, ip in enumerate(ips):
+        entries.append(f"IP.{i} = {ip}")
+
+    for i, domain in enumerate(domains):
+        entries.append(f"DNS.{i} = {domain}")
+
+    for i, email in enumerate(emails):
+        entries.append(f"email.{i} = {email}")
+
+    san_config += "\n".join(entries)
+    return san_config
+
+def main():
+    ip_file = "vars/ips"
+    domain_file = "vars/domains"
+    email_file = "vars/emails"
+
+    ips = read_file(ip_file)
+    domains = read_file(domain_file)
+    emails = read_file(email_file)
+
+    if not ips and not domains and not emails:
+        return
+
+    san_config = generate_san_config(ips, domains, emails)
+
+    print(san_config)
+
+if __name__ == "__main__":
+    main()
+

bin/gen-subject-alternatives.rb

@@ -0,0 +1,44 @@
+#!/usr/bin/env ruby
+
+def read_file(file_name)
+  File.readlines(file_name).map(&:strip).reject(&:empty?)
+end
+
+def generate_san_config(ips, domains, emails)
+  entries = []
+
+  ips.each_with_index do |ip, i|
+    entries << "IP.#{i} = #{ip}"
+  end
+
+  domains.each_with_index do |domain, i|
+    entries << "DNS.#{i} = #{domain}"
+  end
+
+  emails.each_with_index do |email, i|
+    entries << "email.#{i} = #{email}"
+  end
+
+  entries.join("\n")
+end
+
+def main
+  ip_file = "vars/ips"
+  domain_file = "vars/domains"
+  email_file = "vars/emails"
+
+  ips = read_file(ip_file)
+  domains = read_file(domain_file)
+  emails = read_file(email_file)
+
+  return if ips.empty? && domains.empty? && emails.empty?
+
+  san_config = generate_san_config(ips, domains, emails)
+
+  puts san_config
+end
+
+if __FILE__ == $PROGRAM_NAME
+  main
+end
+

bin/templates/csrconfig.txt.in

@@ -0,0 +1,20 @@
+[ req ]
+default_md = sha256
+prompt = no
+req_extensions = req_ext
+distinguished_name = req_distinguished_name
+
+[ req_distinguished_name ]
+commonName = ###CN##
+countryName = ###COUNTRY###
+stateOrProvinceName = ###STATE###
+localityName = ###LOCALITY###
+organizationName = ###ORGANIZATION###
+
+[ req_ext ]
+keyUsage=critical,digitalSignature,keyEncipherment
+extendedKeyUsage=critical,serverAuth,clientAuth
+subjectAltName = @alt_names
+
+[ alt_names ]
+###ALTERNATIVE_NAMES###

bin/templates/csrconfig.txt.j2

@@ -0,0 +1,20 @@
+[ req ]
+default_md = sha256
+prompt = no
+req_extensions = req_ext
+distinguished_name = req_distinguished_name
+
+[ req_distinguished_name ]
+commonName = {{ cn }}
+countryName = {{ country }}
+stateOrProvinceName = {{ state }}
+localityName = {{ locality }}
+organizationName = {{ org }}
+
+[ req_ext ]
+keyUsage=critical,digitalSignature,keyEncipherment
+extendedKeyUsage=critical,serverAuth,clientAuth
+subjectAltName = @alt_names
+
+[ alt_names ]
+{{ subj_alternative }}

bin/vars/cn

@@ -0,0 +1 @@
+example.org

bin/vars/country

@@ -0,0 +1 @@
+IL

bin/vars/days

@@ -0,0 +1 @@
+3650

bin/vars/domains

@@ -0,0 +1,2 @@
+example.org
+*.example.org

bin/vars/ips

@@ -0,0 +1,3 @@
+10.0.0.138
+192.168.0.1
+192.168.1.1

bin/vars/locality

@@ -0,0 +1 @@
+Karney Shomron

bin/vars/organization

@@ -0,0 +1 @@
+NgTech LTD

bin/vars/state

@@ -0,0 +1 @@
+Center

deploy-local.sh

@@ -0,0 +1,4 @@
+ansible-playbook -i local-inventory --connection=local \
+	--extra-vars config_dir=/etc/app-traefik \
+	--extra-vars traefik_dashboard_hostname=traefik.ip.ngtech.home \
+	deploy-traefik.yml

local-inventory

@@ -0,0 +1,2 @@
+[local]
+127.0.0.1