Ajout de 'init-pki.sh'

init-pki.sh

@@ -0,0 +1,102 @@
+#!/bin/bash
+
+set -euo pipefail
+
+export EASYRSA_PKI=/openvpn/pki
+
+EASYRSA=/usr/share/easy-rsa/3/easyrsa
+
+mkdir -p /openvpn/state
+
+# --------------------------------------------------------
+# CA
+# --------------------------------------------------------
+
+if [ ! -f "${EASYRSA_PKI}/ca.crt" ]; then
+
+  echo "Initializing PKI..."
+
+  "${EASYRSA}" \
+    --batch \
+    init-pki
+
+  echo "Generating CA..."
+
+  EASYRSA_REQ_CN="OpenVPN Homelab CA" \
+    "${EASYRSA}" \
+    --batch \
+    build-ca \
+    nopass
+
+fi
+
+# --------------------------------------------------------
+# Certificat serveur
+# --------------------------------------------------------
+
+if [ ! -f "${EASYRSA_PKI}/issued/server.crt" ]; then
+
+  echo "Generating server certificate..."
+
+  "${EASYRSA}" \
+    --batch \
+    build-server-full \
+    server \
+    nopass
+
+fi
+
+# --------------------------------------------------------
+# tls-crypt
+# --------------------------------------------------------
+
+if [ ! -f "${EASYRSA_PKI}/tls-crypt.key" ]; then
+
+  echo "Generating tls-crypt key..."
+
+  openvpn \
+    --genkey secret \
+    "${EASYRSA_PKI}/tls-crypt.key"
+
+fi
+
+# --------------------------------------------------------
+# CRL
+# --------------------------------------------------------
+
+echo "Generating CRL..."
+
+EASYRSA_CRL_DAYS=3650 \
+  "${EASYRSA}" \
+  --batch \
+  gen-crl
+
+# --------------------------------------------------------
+# Permissions
+#
+# OpenVPN passe en nobody après l'initialisation.
+# --------------------------------------------------------
+
+chown -R 65534:65534 /openvpn/state
+
+chmod 755 "${EASYRSA_PKI}"
+chmod 755 "${EASYRSA_PKI}/issued"
+chmod 711 "${EASYRSA_PKI}/private"
+
+chmod 644 \
+  "${EASYRSA_PKI}/ca.crt" \
+  "${EASYRSA_PKI}/issued/server.crt" \
+  "${EASYRSA_PKI}/crl.pem"
+
+chmod 600 \
+  "${EASYRSA_PKI}/private/server.key" \
+  "${EASYRSA_PKI}/tls-crypt.key"
+
+chown 65534:65534 \
+  "${EASYRSA_PKI}/ca.crt" \
+  "${EASYRSA_PKI}/issued/server.crt" \
+  "${EASYRSA_PKI}/crl.pem" \
+  "${EASYRSA_PKI}/private/server.key" \
+  "${EASYRSA_PKI}/tls-crypt.key"
+
+echo "PKI ready."