Initial LisgloSIPS V2 implementation

2026-06-22 10:56:38 +08:00
commit 5fa1bd35e9
303 changed files with 35644 additions and 0 deletions
@@ -0,0 +1,72 @@
+#!/bin/sh
+set -eu
+
+PKI_ROOT=/etc/lisglosips/pki
+CA_DIR="$PKI_ROOT/ca"
+CERT_DIR="$PKI_ROOT/certs"
+PRIVATE_DIR="$PKI_ROOT/private"
+HOST_NAME=${HOST_NAME:-yanzi}
+TAILSCALE_IP=${TAILSCALE_IP:-100.90.90.91}
+
+umask 077
+install -d -m 0700 "$CA_DIR"
+install -d -m 0755 "$CERT_DIR"
+install -d -m 0700 "$PRIVATE_DIR"
+
+if [ ! -s "$CA_DIR/lisglosips-dev-ca.key" ] || [ ! -s "$CA_DIR/lisglosips-dev-ca.crt" ]; then
+  openssl req -x509 -newkey rsa:4096 -sha256 -days 3650 -nodes \
+    -subj '/CN=LisgloSIPS Development CA/O=LisgloSIPS' \
+    -keyout "$CA_DIR/lisglosips-dev-ca.key" \
+    -out "$CA_DIR/lisglosips-dev-ca.crt"
+fi
+
+cat >"$PKI_ROOT/server-cert.cnf" <<EOF
+[req]
+prompt = no
+distinguished_name = dn
+req_extensions = req_ext
+
+[dn]
+CN = lisglosips.local
+O = LisgloSIPS
+
+[req_ext]
+subjectAltName = @alt_names
+
+[alt_names]
+DNS.1 = lisglosips.local
+DNS.2 = $HOST_NAME
+DNS.3 = grafana.lisglosips.local
+DNS.4 = homer.lisglosips.local
+IP.1 = $TAILSCALE_IP
+IP.2 = 127.0.0.1
+
+[server_ext]
+basicConstraints = critical,CA:FALSE
+keyUsage = critical,digitalSignature,keyEncipherment
+extendedKeyUsage = serverAuth
+subjectAltName = @alt_names
+EOF
+
+openssl req -new -newkey rsa:3072 -nodes -sha256 \
+  -config "$PKI_ROOT/server-cert.cnf" \
+  -keyout "$PRIVATE_DIR/server.key" \
+  -out "$PKI_ROOT/server.csr"
+
+openssl x509 -req -sha256 -days 397 \
+  -in "$PKI_ROOT/server.csr" \
+  -CA "$CA_DIR/lisglosips-dev-ca.crt" \
+  -CAkey "$CA_DIR/lisglosips-dev-ca.key" \
+  -CAcreateserial \
+  -extfile "$PKI_ROOT/server-cert.cnf" \
+  -extensions server_ext \
+  -out "$CERT_DIR/server.crt"
+
+chown root:root "$CA_DIR/lisglosips-dev-ca.key" "$PKI_ROOT/server.csr" "$PKI_ROOT/server-cert.cnf"
+chown root:www-data "$PRIVATE_DIR/server.key"
+chown root:root "$CA_DIR/lisglosips-dev-ca.crt" "$CERT_DIR/server.crt"
+chmod 0600 "$CA_DIR/lisglosips-dev-ca.key" "$PKI_ROOT/server.csr" "$PKI_ROOT/server-cert.cnf"
+chmod 0640 "$PRIVATE_DIR/server.key"
+chmod 0644 "$CA_DIR/lisglosips-dev-ca.crt" "$CERT_DIR/server.crt"
+
+openssl verify -CAfile "$CA_DIR/lisglosips-dev-ca.crt" "$CERT_DIR/server.crt"