aboutsummaryrefslogtreecommitdiff
path: root/deploy_pki
blob: 471ff6341a12cd63fa79c620d3f980b6c07dd3c7 (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
#!/usr/bin/env ./sshtool

PKI=deuxfleurs/cluster/$CLUSTER
YEAR=$(date +%Y)

cmd mkdir -p /var/lib/nomad/pki /var/lib/consul/pki

for file in consul-ca.crt consul$YEAR.crt consul$YEAR.key \
	consul$YEAR-client.crt consul$YEAR-client.key
do
	if pass $PKI/$file >/dev/null; then
		write_pass $PKI/$file /var/lib/consul/pki/$file
		cmd chown consul:root /var/lib/consul/pki/$file
	fi
done

cmd ln -sf /var/lib/consul/pki/consul$YEAR.crt /var/lib/consul/pki/consul.crt
cmd ln -sf /var/lib/consul/pki/consul$YEAR.key /var/lib/consul/pki/consul.key
cmd ln -sf /var/lib/consul/pki/consul$YEAR-client.crt /var/lib/consul/pki/consul-client.crt
cmd ln -sf /var/lib/consul/pki/consul$YEAR-client.key /var/lib/consul/pki/consul-client.key

if [ ! "$CLUSTER" = "prod" ]; then
	cmd systemctl restart consul
	cmd sleep 10
fi

for file in nomad-ca.crt nomad$YEAR.crt nomad$YEAR.key \
	nomad$YEAR-client.crt nomad$YEAR-client.key \
	consul$YEAR.crt consul$YEAR-client.crt consul$YEAR-client.key
do
	if pass $PKI/$file >/dev/null; then
		write_pass $PKI/$file /var/lib/nomad/pki/$file
		cmd "chown \$(stat -c %u /var/lib/nomad/client/client-id) /var/lib/nomad/pki/$file"
	fi
done

cmd ln -sf /var/lib/nomad/pki/nomad$YEAR.crt /var/lib/nomad/pki/nomad.crt
cmd ln -sf /var/lib/nomad/pki/nomad$YEAR.key /var/lib/nomad/pki/nomad.key
cmd ln -sf /var/lib/nomad/pki/nomad$YEAR-client.crt /var/lib/nomad/pki/nomad-client.crt
cmd ln -sf /var/lib/nomad/pki/nomad$YEAR-client.key /var/lib/nomad/pki/nomad-client.key
cmd ln -sf /var/lib/nomad/pki/consul$YEAR.crt /var/lib/nomad/pki/consul.crt
cmd ln -sf /var/lib/nomad/pki/consul$YEAR-client.crt /var/lib/nomad/pki/consul-client.crt
cmd ln -sf /var/lib/nomad/pki/consul$YEAR-client.key /var/lib/nomad/pki/consul-client.key

if [ ! "$CLUSTER" = "prod" ]; then
	cmd systemctl restart nomad
fi

set_env CONSUL_HTTP_ADDR=https://localhost:8501
set_env CONSUL_CACERT=/var/lib/consul/pki/consul-ca.crt
set_env CONSUL_CLIENT_CERT=/var/lib/consul/pki/consul-client.crt
set_env CONSUL_CLIENT_KEY=/var/lib/consul/pki/consul-client.key

cmd "consul kv put secrets/consul/consul-ca.crt - < /var/lib/consul/pki/consul-ca.crt"
cmd "consul kv put secrets/consul/consul.crt - < /var/lib/consul/pki/consul.crt"
cmd "consul kv put secrets/consul/consul-client.crt - < /var/lib/consul/pki/consul-client.crt"
cmd "consul kv put secrets/consul/consul-client.key - < /var/lib/consul/pki/consul-client.key"

cmd "consul kv put secrets/nomad/nomad-ca.crt - < /var/lib/nomad/pki/nomad-ca.crt"
cmd "consul kv put secrets/nomad/nomad.crt - < /var/lib/nomad/pki/nomad.crt"
cmd "consul kv put secrets/nomad/nomad-client.crt - < /var/lib/nomad/pki/nomad-client.crt"
cmd "consul kv put secrets/nomad/nomad-client.key - < /var/lib/nomad/pki/nomad-client.key"