Visitor sign in kiosk: multi-site, badge printing, WWCC expiry warnings, admin accounts with 2FA

2026-08-31 14:33:30 +10:00
parent ed77493817
commit b23ad422d0
13 changed files with 843 additions and 119 deletions
@@ -1,40 +1,32 @@
 #!/usr/bin/env bash
-# Creates a self-signed certificate so the kiosk can use the camera over https.
-# Give it the address staff will actually type, e.g.  ./gen-cert.sh visitors.local 192.168.1.50
+# Creates the kiosk certificates: a long lived local authority, and a server
+# certificate signed by it. Install the authority on each kiosk device once.
+#
+#   ./scripts/gen-cert.sh                          use HTTPS_HOSTNAMES from .env
+#   ./scripts/gen-cert.sh visitors.local 10.0.0.5  override the names
+#   ./scripts/gen-cert.sh --force                  replace the authority too
+#
+# The server normally does this by itself on start, so you only need this to
+# change the address list or to inspect the result before going live.
 set -euo pipefail
+cd "$(dirname "$0")/.."

-OUT_DIR="${OUT_DIR:-./data/certs}"
-PRIMARY="${1:-visitors.local}"
-shift || true
-
-mkdir -p "$OUT_DIR"
-
-ALT="DNS:${PRIMARY}"
-INDEX=1
-for extra in "$@"; do
-  if [[ "$extra" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-    ALT="${ALT},IP:${extra}"
-  else
-    ALT="${ALT},DNS:${extra}"
-  fi
-  INDEX=$((INDEX + 1))
+FORCE=""
+NAMES=()
+for arg in "$@"; do
+  if [ "$arg" = "--force" ]; then FORCE="--force"; else NAMES+=("$arg"); fi
 done
-ALT="${ALT},DNS:localhost,IP:127.0.0.1"

-openssl req -x509 -nodes -newkey rsa:2048 -days 1095 \
-  -keyout "${OUT_DIR}/server.key" \
-  -out "${OUT_DIR}/server.crt" \
-  -subj "/C=AU/ST=Victoria/L=Melbourne/O=Visitor Sign In/CN=${PRIMARY}" \
-  -addext "subjectAltName=${ALT}" \
-  -addext "basicConstraints=CA:FALSE" \
-  -addext "keyUsage=digitalSignature,keyEncipherment" \
-  -addext "extendedKeyUsage=serverAuth"
+if [ ${#NAMES[@]} -gt 0 ]; then
+  HTTPS_HOSTNAMES="$(IFS=,; echo "${NAMES[*]}")"
+  export HTTPS_HOSTNAMES
+  echo "Using names: ${HTTPS_HOSTNAMES}"
+fi

-chmod 600 "${OUT_DIR}/server.key"
-
-echo
-echo "Certificate written to ${OUT_DIR}"
-echo "Names covered: ${ALT}"
-echo
-echo "Next: set HTTPS_ENABLED=true in .env, then restart the container."
-echo "Install ${OUT_DIR}/server.crt as a trusted root on each kiosk device to stop the warning."
+if docker compose ps --status running 2>/dev/null | grep -q visitor-signin; then
+  docker compose exec -T visitor-signin node scripts/make-cert.mjs $FORCE
+  echo "Restarting so the new certificate is served..."
+  docker compose restart visitor-signin
+else
+  node scripts/make-cert.mjs $FORCE
+fi
@@ -0,0 +1,22 @@
+// Creates or renews the kiosk certificates without starting the server.
+//   node scripts/make-cert.mjs           renew the server certificate if needed
+//   node scripts/make-cert.mjs --force   new certificate authority as well
+import { ensureCertificates, describe } from '../src/tls.js';
+
+const force = process.argv.includes('--force');
+
+try {
+  ensureCertificates({ force });
+  const info = describe();
+  console.log('');
+  console.log('Certificate authority :', info.caPath);
+  console.log('  fingerprint         :', info.ca?.fingerprint);
+  console.log('  expires             :', info.ca?.validTo, `(${info.ca?.daysLeft} days)`);
+  console.log('Server certificate    :', info.server?.validTo, `(${info.server?.daysLeft} days)`);
+  console.log('  valid for           :', (info.server?.names || []).join(', '));
+  console.log('');
+  console.log('Install the authority certificate on each kiosk device, then restart the container.');
+} catch (err) {
+  console.error('Could not create certificates:', err.message);
+  process.exit(1);
+}