1
0
mirror of https://github.com/billz/raspap-webgui.git synced 2023-10-10 13:37:24 +02:00
raspap-webgui/installers/mkcert.sh

150 lines
5.0 KiB
Bash
Raw Normal View History

2019-11-07 09:39:54 +01:00
#!/bin/bash
#
# RaspAP SSL certificate installation functions
# author: @billz
# license: GNU General Public License v3.0
certname=$HOSTNAME."local"
lighttpd_ssl="/etc/lighttpd/ssl"
2019-11-07 13:33:17 +01:00
lighttpd_conf="/etc/lighttpd/lighttpd.conf"
2019-11-07 11:41:05 +01:00
webroot_dir="/var/www/html"
2019-11-07 09:39:54 +01:00
### NOTE: all the below functions are overloadable for system-specific installs
function config_installation() {
install_log "Configure a new SSL certificate"
2019-11-07 17:45:21 +01:00
echo "Current system hostname is $HOSTNAME"
2019-11-07 09:39:54 +01:00
echo -n "Create an SSL certificate for ${certname}? (Recommended) [y/N]"
if [ $assume_yes == 0 ]; then
read answer < /dev/tty
2019-11-07 09:39:54 +01:00
if [[ $answer != "y" ]]; then
read -e -p < /dev/tty "Enter an alternate certificate name: " -i "${certname}" certname
2019-11-07 09:39:54 +01:00
fi
else
echo -e
fi
2019-11-07 21:12:23 +01:00
echo -n "Install to lighttpd SSL directory: ${lighttpd_ssl}? [y/N]: "
2019-11-07 09:39:54 +01:00
if [ $assume_yes == 0 ]; then
read answer < /dev/tty
2019-11-07 09:39:54 +01:00
if [[ $answer != "y" ]]; then
read -e -p < /dev/tty "Enter alternate lighttpd SSL directory: " -i "${lighttpd_ssl}" lighttpd_ssl
2019-11-07 09:39:54 +01:00
fi
else
echo -e
fi
2019-11-07 11:41:05 +01:00
install_divider
2019-11-07 09:39:54 +01:00
echo "A new SSL certificate for: ${certname}"
2019-11-07 11:41:05 +01:00
echo "will be installed to lighttpd SSL directory: ${lighttpd_ssl}"
install_divider
2019-11-07 09:39:54 +01:00
echo -n "Complete installation with these values? [y/N]: "
if [ $assume_yes == 0 ]; then
read answer < /dev/tty
2019-11-07 09:39:54 +01:00
if [[ $answer != "y" ]]; then
echo "Installation aborted."
exit 0
fi
else
echo -e
fi
}
# Installs pre-built mkcert binary for Arch Linux ARM
function install_mkcert() {
install_log "Fetching mkcert binary"
2019-11-07 11:41:05 +01:00
sudo wget -q https://github.com/FiloSottile/mkcert/releases/download/v1.3.0/mkcert-v1.3.0-linux-arm -O /usr/local/bin/mkcert || install_error "Unable to download mkcert"
2019-11-07 09:39:54 +01:00
sudo chmod +x /usr/local/bin/mkcert
install_log "Installing mkcert"
mkcert -install || install_error "Failed to install mkcert"
}
# Generate a certificate for host
function generate_certificate() {
install_log "Generating a new certificate for $certname"
cd $HOME
2019-11-07 09:39:54 +01:00
mkcert $certname "*.${certname}.local" $certname || install_error "Failed to generate certificate for $certname"
install_log "Combining private key and certificate"
2019-11-07 19:04:41 +01:00
cat $certname+2-key.pem $certname+2.pem > $certname.pem || install_error "Failed to combine key and certificate"
2019-11-07 11:41:05 +01:00
echo "OK"
2019-11-07 09:39:54 +01:00
}
# Create a directory for the combined .pem file in lighttpd
function create_lighttpd_dir() {
2019-11-07 19:04:41 +01:00
install_log "Creating SLL directory for lighttpd"
2019-11-07 13:33:17 +01:00
if [ ! -d "$lighttpd_ssl" ]; then
sudo mkdir -p "$lighttpd_ssl" || install_error "Failed to create lighttpd directory"
fi
2019-11-07 11:41:05 +01:00
echo "OK"
2019-11-07 09:39:54 +01:00
2019-11-07 11:41:05 +01:00
install_log "Setting permissions and moving .pem file"
chmod 400 "$HOME/$certname".pem || install_error "Unable to set permissions for .pem file"
sudo mv "$HOME/$certname".pem /etc/lighttpd/ssl || install_error "Unable to move .pem file"
2019-11-07 11:41:05 +01:00
echo "OK"
2019-11-07 09:39:54 +01:00
}
2019-11-07 19:04:41 +01:00
# Generate config to enable SSL in lighttpd
2019-11-07 09:39:54 +01:00
function configure_lighttpd() {
install_log "Configuring lighttpd for SSL"
2019-11-07 13:33:17 +01:00
lines=(
'server.modules += ("mod_openssl")'
'$SERVER["socket"] == ":443" {'
'ssl.engine = "enable"'
'ssl.pemfile = "'$lighttpd_ssl/$certname'.pem"'
'ssl.ca-file = "'$HOME'/.local/share/mkcert/rootCA.pem"'
2019-11-07 13:33:17 +01:00
'server.name = "'$certname'"'
'server.document-root = "'${webroot_dir}'"}'
)
for line in "${lines[@]}"; do
if grep -Fxq "${line}" "${lighttpd_conf}" > /dev/null; then
echo "$line: Line already added"
else
sudo sed -i "$ a $line" $lighttpd_conf
echo "Adding line $line"
fi
done
2019-11-07 11:41:05 +01:00
echo "OK"
2019-11-07 09:39:54 +01:00
}
# Copy rootCA.pem to RaspAP web root
function copy_rootca() {
2019-11-07 19:04:41 +01:00
install_log "Copying rootCA.pem to RaspAP web root"
sudo cp ${HOME}/.local/share/mkcert/rootCA.pem ${webroot_dir} || install_error "Unable to copy rootCA.pem to ${webroot_dir}"
2019-11-07 11:41:05 +01:00
echo "OK"
2019-11-07 09:39:54 +01:00
}
2019-11-07 11:41:05 +01:00
# Restart lighttpd service
function restart_lighttpd() {
install_log "Restarting lighttpd service"
sudo systemctl restart lighttpd.service || install_error "Unable to restart lighttpd service"
sudo systemctl status lighttpd.service
}
2019-11-07 09:39:54 +01:00
2019-11-07 11:41:05 +01:00
function install_complete() {
install_log "SSL certificate install completed!"
install_divider
printf '%s\n' \
"Open a browser and enter the address: http://$certname/rootCA.pem" \
"Download the root certificate to your client and add it to your system keychain." \
"Note: Be sure to set this certificate to 'Always trust' to avoid browser warnings." \
"Finally, enter the address https://$certname in your browser." \
"Enjoy an encrypted SSL connection to RaspAP 🔒" \
"For advanced options, run mkcert -help"
2019-11-07 11:41:05 +01:00
install_divider
2019-11-07 09:39:54 +01:00
}
function install_certificate() {
display_welcome
config_installation
install_mkcert
generate_certificate
create_lighttpd_dir
configure_lighttpd
copy_rootca
restart_lighttpd
install_complete
}