direktil/local-server
4
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

add public key template functions

Browse Source
This commit is contained in:
Mikaël Cluseau
2025-07-06 10:18:54 +02:00
parent d77588274b
commit 6651ff0364
5 changed files with 58 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
cmd/dkl-dir2config/assemble.go
View File

@ -124,7 +124,7 @@ func eachFragment(path string, searchList []FS, walk func(io.Reader) error) (err
log.Print("#!gen ", cmdArgs)
}
cmd := "gen/" + cmdArgs[0]
cmd := *dir + "/gen/" + cmdArgs[0]
args := cmdArgs[1:]
genOutput, err := exec.Command(cmd, args...).Output()
if err != nil {

10
cmd/dkl-dir2config/render-context.go
View File

@ -203,7 +203,7 @@ func (ctx *renderContext) renderConfigTo(buf io.Writer, configTemplate *clusters
}
}
func (ctx *renderContext) templateFuncs(ctxMap map[string]any) map[string]interface{} {
func (ctx *renderContext) templateFuncs(ctxMap map[string]any) map[string]any {
cluster := ctx.Cluster.Name
getKeyCert := func(name, funcName string) (s string, err error) {
@ -229,14 +229,15 @@ func (ctx *renderContext) templateFuncs(ctxMap map[string]any) map[string]interf
key += "/" + ctx.Host.Name
}
if funcName == "tls_dir" {
switch funcName {
case "tls_dir":
// needs the dir name
dir := "/etc/tls/" + name
s = fmt.Sprintf("{{ %s %q %q %q %q %q %q %q }}", funcName,
dir, cluster, req.CA, key, req.Profile, req.Label, buf.String())
} else {
default:
s = fmt.Sprintf("{{ %s %q %q %q %q %q %q }}", funcName,
cluster, req.CA, key, req.Profile, req.Label, buf.String())
}
@ -266,6 +267,9 @@ func (ctx *renderContext) templateFuncs(ctxMap map[string]any) map[string]interf
"tls_key": func(name string) (string, error) {
return getKeyCert(name, "tls_key")
},
"tls_pubkey": func(name string) string {
return fmt.Sprintf("{{ tls_pubkey %q %q }}", ctx.Cluster.Name, name)
},
"tls_crt": func(name string) (s string, err error) {
return getKeyCert(name, "tls_crt")

28
cmd/dkl-local-server/cluster-render-context.go
View File

@ -1,8 +1,11 @@
package main
import (
"crypto"
"crypto/rand"
"crypto/x509"
"encoding/base32"
"encoding/base64"
"encoding/json"
"fmt"
"log"
@ -12,6 +15,7 @@ import (
cfsslconfig "github.com/cloudflare/cfssl/config"
"github.com/cloudflare/cfssl/csr"
"github.com/cloudflare/cfssl/helpers"
yaml "gopkg.in/yaml.v2"
"novit.tech/direktil/pkg/bootstrapconfig"
@ -19,6 +23,14 @@ import (
)
func templateFuncs(sslCfg *cfsslconfig.Config) map[string]any {
getKey := func(cluster, caName string) (key crypto.Signer, err error) {
ca, err := getUsableClusterCA(cluster, caName)
if err != nil {
return
}
key, err = helpers.ParsePrivateKeyPEM(ca.Key)
return
}
getKeyCert := func(cluster, caName, name, profile, label, reqJson string) (kc KeyCert, err error) {
certReq := &csr.CertificateRequest{
KeyRequest: csr.NewKeyRequest(),
@ -133,6 +145,22 @@ func templateFuncs(sslCfg *cfsslconfig.Config) map[string]any {
return
},
"tls_pubkey": func(cluster, caName string) (s string, err error) {
priv, err := getKey(cluster, caName)
if err != nil {
return
}
ba, err := x509.MarshalPKIXPublicKey(priv.Public())
if err != nil {
err = fmt.Errorf("marshal public key failed: %w", err)
return
}
s = base64.StdEncoding.EncodeToString(ba)
return
},
"tls_crt": func(cluster, caName, name, profile, label, reqJson string) (s string, err error) {
kc, err := getKeyCert(cluster, caName, name, profile, label, reqJson)
if err != nil {

11
cmd/dkl-local-server/tls-ca.go
View File

@ -72,13 +72,20 @@ func (_ CA) newReq() *csr.CertificateRequest {
}
}
func (ca CA) ParseKey() (key crypto.Signer, err error) {
return helpers.ParsePrivateKeyPEM(ca.Key)
}
func (ca CA) ParseCert() (cert *x509.Certificate, err error) {
return helpers.ParseCertificatePEM(ca.Cert)
}
func (ca CA) Signer(policy *config.Signing) (result *local.Signer, err error) {
caCert, err := helpers.ParseCertificatePEM(ca.Cert)
caCert, err := ca.ParseCert()
if err != nil {
return
}
caKey, err := helpers.ParsePrivateKeyPEM(ca.Key)
caKey, err := ca.ParseKey()
if err != nil {
return
}

25
cmd/dkl-local-server/ws-host.go
View File

@ -180,22 +180,10 @@ func renderHost(w http.ResponseWriter, r *http.Request, what string, host *local
case "kernel":
err = renderKernel(w, r, ctx)
// boot v2
case "bootstrap-config":
err = renderBootstrapConfig(w, r, ctx, false)
case "bootstrap-config.json":
err = renderBootstrapConfig(w, r, ctx, true)
case "initrd":
err = renderCtx(w, r, ctx, what, buildInitrd)
case "bootstrap.tar":
err = renderCtx(w, r, ctx, what, buildBootstrap)
case "boot.iso":
err = renderCtx(w, r, ctx, what, buildBootISO)
case "boot.tar":
err = renderCtx(w, r, ctx, what, buildBootTar)
case "boot-efi.tar":
err = renderCtx(w, r, ctx, what, buildBootEFITar)
case "boot.img":
err = renderCtx(w, r, ctx, what, buildBootImg)
@ -213,6 +201,19 @@ func renderHost(w http.ResponseWriter, r *http.Request, what string, host *local
err = renderCtx(w, r, ctx, what, qemuImgBootImg("vmdk"))
case "boot.vpc":
err = renderCtx(w, r, ctx, what, qemuImgBootImg("vpc"))
case "boot.iso":
err = renderCtx(w, r, ctx, what, buildBootISO)
case "boot.tar":
err = renderCtx(w, r, ctx, what, buildBootTar)
case "boot-efi.tar":
err = renderCtx(w, r, ctx, what, buildBootEFITar)
// boot v2
case "bootstrap-config":
err = renderBootstrapConfig(w, r, ctx, false)
case "bootstrap-config.json":
err = renderBootstrapConfig(w, r, ctx, true)
default:
http.NotFound(w, r)