60 lines
2.1 KiB
Bash
60 lines
2.1 KiB
Bash
#!/usr/bin/env bash
|
|
# Regenerate Nomad TLS material for the single-node agent.
|
|
#
|
|
# Usage (on the services VPS, from the repo root):
|
|
# sudo deploy/nomad/gen-tls.sh <VPS_PUBLIC_IP>
|
|
#
|
|
# Produces /etc/nomad.d/tls/{nomad-ca.crt, server.crt, server.key} and leaves
|
|
# the new CA in a temp dir for copying to the Forgejo runner (NOMAD_CACERT).
|
|
# Requirements: SAN must contain server.global.vps.nomad (region.global,
|
|
# datacenter vps — matches deploy/nomad/nomad.hcl) + the addresses clients
|
|
# use to reach the API.
|
|
|
|
set -euo pipefail
|
|
|
|
ip="${1:?usage: gen-tls.sh <VPS_PUBLIC_IP>}"
|
|
|
|
tls_dir=/etc/nomad.d/tls
|
|
work=$(mktemp -d)
|
|
trap 'rm -rf "$work"' EXIT
|
|
cd "$work"
|
|
|
|
# 1. mini CA
|
|
openssl req -x509 -newkey rsa:2048 -nodes -days 3650 \
|
|
-keyout nomad-ca.key -out nomad-ca.crt \
|
|
-subj "/CN=Contract-Check Nomad CA"
|
|
|
|
# 2. server cert (serverAuth+clientAuth: the agent uses it for both roles).
|
|
# With verify_server_hostname=true the RPC name is server.<REGION>.nomad
|
|
# (NOT server.<region>.<dc>.nomad) — region here is "global" (nomad.hcl).
|
|
openssl req -newkey rsa:2048 -nodes \
|
|
-keyout server.key -out server.csr \
|
|
-subj "/CN=server.global.nomad"
|
|
|
|
cat > server.ext <<EOF
|
|
subjectAltName = DNS:server.global.nomad, DNS:server.global.vps.nomad, DNS:localhost, IP:127.0.0.1, IP:${ip}
|
|
extendedKeyUsage = serverAuth, clientAuth
|
|
EOF
|
|
|
|
openssl x509 -req -in server.csr \
|
|
-CA nomad-ca.crt -CAkey nomad-ca.key -CAcreateserial \
|
|
-out server.crt -days 825 -extfile server.ext
|
|
|
|
# 3. self-check before installing
|
|
openssl verify -CAfile nomad-ca.crt server.crt
|
|
openssl x509 -in server.crt -noout -ext subjectAltName
|
|
|
|
# 4. install
|
|
install -d -m 755 "$tls_dir"
|
|
install -m 644 nomad-ca.crt server.crt "$tls_dir/"
|
|
install -m 600 server.key "$tls_dir/"
|
|
|
|
cat <<EOF
|
|
|
|
OK. Now:
|
|
1. systemctl restart nomad && journalctl -u nomad -f (handshake errors should stop)
|
|
2. export NOMAD_ADDR=https://127.0.0.1:4646 NOMAD_CACERT=$tls_dir/nomad-ca.crt
|
|
3. nomad server members && nomad node status
|
|
4. copy $tls_dir/nomad-ca.crt to the Forgejo repo secret NOMAD_CACERT
|
|
(runner verifies the server with it; the CA key never leaves this host)
|
|
EOF
|