Visitor sign in kiosk: multi-site, badge printing, WWCC expiry warnings, admin accounts with 2FA

scripts/gen-cert.sh

@@ -1,40 +1,32 @@
 #!/usr/bin/env bash
-# Creates a self-signed certificate so the kiosk can use the camera over https.
-# Give it the address staff will actually type, e.g.  ./gen-cert.sh visitors.local 192.168.1.50
+# Creates the kiosk certificates: a long lived local authority, and a server
+# certificate signed by it. Install the authority on each kiosk device once.
+#
+#   ./scripts/gen-cert.sh                          use HTTPS_HOSTNAMES from .env
+#   ./scripts/gen-cert.sh visitors.local 10.0.0.5  override the names
+#   ./scripts/gen-cert.sh --force                  replace the authority too
+#
+# The server normally does this by itself on start, so you only need this to
+# change the address list or to inspect the result before going live.
 set -euo pipefail
+cd "$(dirname "$0")/.."
 
-OUT_DIR="${OUT_DIR:-./data/certs}"
-PRIMARY="${1:-visitors.local}"
-shift || true
-
-mkdir -p "$OUT_DIR"
-
-ALT="DNS:${PRIMARY}"
-INDEX=1
-for extra in "$@"; do
-  if [[ "$extra" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-    ALT="${ALT},IP:${extra}"
-  else
-    ALT="${ALT},DNS:${extra}"
-  fi
-  INDEX=$((INDEX + 1))
+FORCE=""
+NAMES=()
+for arg in "$@"; do
+  if [ "$arg" = "--force" ]; then FORCE="--force"; else NAMES+=("$arg"); fi
 done
-ALT="${ALT},DNS:localhost,IP:127.0.0.1"
 
-openssl req -x509 -nodes -newkey rsa:2048 -days 1095 \
-  -keyout "${OUT_DIR}/server.key" \
-  -out "${OUT_DIR}/server.crt" \
-  -subj "/C=AU/ST=Victoria/L=Melbourne/O=Visitor Sign In/CN=${PRIMARY}" \
-  -addext "subjectAltName=${ALT}" \
-  -addext "basicConstraints=CA:FALSE" \
-  -addext "keyUsage=digitalSignature,keyEncipherment" \
-  -addext "extendedKeyUsage=serverAuth"
+if [ ${#NAMES[@]} -gt 0 ]; then
+  HTTPS_HOSTNAMES="$(IFS=,; echo "${NAMES[*]}")"
+  export HTTPS_HOSTNAMES
+  echo "Using names: ${HTTPS_HOSTNAMES}"
+fi
 
-chmod 600 "${OUT_DIR}/server.key"
-
-echo
-echo "Certificate written to ${OUT_DIR}"
-echo "Names covered: ${ALT}"
-echo
-echo "Next: set HTTPS_ENABLED=true in .env, then restart the container."
-echo "Install ${OUT_DIR}/server.crt as a trusted root on each kiosk device to stop the warning."
+if docker compose ps --status running 2>/dev/null | grep -q visitor-signin; then
+  docker compose exec -T visitor-signin node scripts/make-cert.mjs $FORCE
+  echo "Restarting so the new certificate is served..."
+  docker compose restart visitor-signin
+else
+  node scripts/make-cert.mjs $FORCE
+fi