Public Access
41 lines
1.2 KiB
Bash
41 lines
1.2 KiB
Bash
#!/usr/bin/env bash
|
|
# Creates a self-signed certificate so the kiosk can use the camera over https.
|
|
# Give it the address staff will actually type, e.g. ./gen-cert.sh visitors.local 192.168.1.50
|
|
set -euo pipefail
|
|
|
|
OUT_DIR="${OUT_DIR:-./data/certs}"
|
|
PRIMARY="${1:-visitors.local}"
|
|
shift || true
|
|
|
|
mkdir -p "$OUT_DIR"
|
|
|
|
ALT="DNS:${PRIMARY}"
|
|
INDEX=1
|
|
for extra in "$@"; do
|
|
if [[ "$extra" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
|
|
ALT="${ALT},IP:${extra}"
|
|
else
|
|
ALT="${ALT},DNS:${extra}"
|
|
fi
|
|
INDEX=$((INDEX + 1))
|
|
done
|
|
ALT="${ALT},DNS:localhost,IP:127.0.0.1"
|
|
|
|
openssl req -x509 -nodes -newkey rsa:2048 -days 1095 \
|
|
-keyout "${OUT_DIR}/server.key" \
|
|
-out "${OUT_DIR}/server.crt" \
|
|
-subj "/C=AU/ST=Victoria/L=Melbourne/O=Visitor Sign In/CN=${PRIMARY}" \
|
|
-addext "subjectAltName=${ALT}" \
|
|
-addext "basicConstraints=CA:FALSE" \
|
|
-addext "keyUsage=digitalSignature,keyEncipherment" \
|
|
-addext "extendedKeyUsage=serverAuth"
|
|
|
|
chmod 600 "${OUT_DIR}/server.key"
|
|
|
|
echo
|
|
echo "Certificate written to ${OUT_DIR}"
|
|
echo "Names covered: ${ALT}"
|
|
echo
|
|
echo "Next: set HTTPS_ENABLED=true in .env, then restart the container."
|
|
echo "Install ${OUT_DIR}/server.crt as a trusted root on each kiosk device to stop the warning."
|