Visitor sign in kiosk: multi-site, badge printing, WWCC expiry warnings, admin accounts with 2FA

2026-08-31 09:47:36 +10:00
commit ed77493817
32 changed files with 5799 additions and 0 deletions
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# Creates a self-signed certificate so the kiosk can use the camera over https.
+# Give it the address staff will actually type, e.g.  ./gen-cert.sh visitors.local 192.168.1.50
+set -euo pipefail
+
+OUT_DIR="${OUT_DIR:-./data/certs}"
+PRIMARY="${1:-visitors.local}"
+shift || true
+
+mkdir -p "$OUT_DIR"
+
+ALT="DNS:${PRIMARY}"
+INDEX=1
+for extra in "$@"; do
+  if [[ "$extra" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+    ALT="${ALT},IP:${extra}"
+  else
+    ALT="${ALT},DNS:${extra}"
+  fi
+  INDEX=$((INDEX + 1))
+done
+ALT="${ALT},DNS:localhost,IP:127.0.0.1"
+
+openssl req -x509 -nodes -newkey rsa:2048 -days 1095 \
+  -keyout "${OUT_DIR}/server.key" \
+  -out "${OUT_DIR}/server.crt" \
+  -subj "/C=AU/ST=Victoria/L=Melbourne/O=Visitor Sign In/CN=${PRIMARY}" \
+  -addext "subjectAltName=${ALT}" \
+  -addext "basicConstraints=CA:FALSE" \
+  -addext "keyUsage=digitalSignature,keyEncipherment" \
+  -addext "extendedKeyUsage=serverAuth"
+
+chmod 600 "${OUT_DIR}/server.key"
+
+echo
+echo "Certificate written to ${OUT_DIR}"
+echo "Names covered: ${ALT}"
+echo
+echo "Next: set HTTPS_ENABLED=true in .env, then restart the container."
+echo "Install ${OUT_DIR}/server.crt as a trusted root on each kiosk device to stop the warning."