CanbiZ (MickLesk)
GitHub
commit
73cc1c2399
6
ct/headers/step-ca
Normal file
6
ct/headers/step-ca
Normal file
@ -0,0 +1,6 @@
|
|||||||
|
__
|
||||||
|
_____/ /____ ____ _________ _
|
||||||
|
/ ___/ __/ _ \/ __ \______/ ___/ __ `/
|
||||||
|
(__ ) /_/ __/ /_/ /_____/ /__/ /_/ /
|
||||||
|
/____/\__/\___/ .___/ \___/\__,_/
|
||||||
|
/_/
|
||||||
51
ct/step-ca.sh
Normal file
51
ct/step-ca.sh
Normal file
@ -0,0 +1,51 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVED/main/misc/build.func)
|
||||||
|
# Copyright (c) 2021-2026 community-scripts ORG
|
||||||
|
# Author: Joerg Heinemann (heinemannj)
|
||||||
|
# License: MIT | https://github.com/community-scripts/ProxmoxVED/raw/main/LICENSE
|
||||||
|
# Source: https://github.com/smallstep/certificates
|
||||||
|
|
||||||
|
APP="step-ca"
|
||||||
|
var_tags="${var_tags:-certificate-authority;pki;acme-server}"
|
||||||
|
var_cpu="${var_cpu:-1}"
|
||||||
|
var_ram="${var_ram:-512}"
|
||||||
|
var_disk="${var_disk:-2}"
|
||||||
|
var_os="${var_os:-debian}"
|
||||||
|
var_version="${var_version:-13}"
|
||||||
|
var_unprivileged="${var_unprivileged:-1}"
|
||||||
|
|
||||||
|
header_info "$APP"
|
||||||
|
variables
|
||||||
|
color
|
||||||
|
catch_errors
|
||||||
|
|
||||||
|
function update_script() {
|
||||||
|
header_info
|
||||||
|
check_container_storage
|
||||||
|
check_container_resources
|
||||||
|
if [[ ! -f /etc/apt/sources.list.d/smallstep.sources ]]; then
|
||||||
|
msg_error "No ${APP} Installation Found!"
|
||||||
|
exit
|
||||||
|
fi
|
||||||
|
msg_info "Updating step-ca and step-cli"
|
||||||
|
$STD apt update
|
||||||
|
$STD apt upgrade -y step-ca step-cli
|
||||||
|
$STD systemctl restart step-ca
|
||||||
|
msg_ok "Updated step-ca and step-cli"
|
||||||
|
|
||||||
|
if check_for_gh_release "step-badger" "lukasz-lobocki/step-badger"; then
|
||||||
|
fetch_and_deploy_gh_release "step-badger" "lukasz-lobocki/step-badger" "prebuild" "latest" "/opt/step-badger" "step-badger_Linux_x86_64.tar.gz"
|
||||||
|
msg_ok "Updated successfully!"
|
||||||
|
fi
|
||||||
|
msg_ok "Updated successfully!"
|
||||||
|
exit
|
||||||
|
}
|
||||||
|
|
||||||
|
start
|
||||||
|
build_container
|
||||||
|
description
|
||||||
|
|
||||||
|
msg_ok "Completed successfully!\n"
|
||||||
|
echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
|
||||||
|
echo -e "${INFO}${YW} Access it using the following URL:${CL}"
|
||||||
|
echo -e "${TAB}${GATEWAY}${BGN}https://${IP}/provisioners${CL}"
|
||||||
40
frontend/public/json/step-ca.json
Normal file
40
frontend/public/json/step-ca.json
Normal file
@ -0,0 +1,40 @@
|
|||||||
|
{
|
||||||
|
"name": "step-ca",
|
||||||
|
"slug": "step-ca",
|
||||||
|
"categories": [
|
||||||
|
6
|
||||||
|
],
|
||||||
|
"date_created": "2026-02-03",
|
||||||
|
"type": "ct",
|
||||||
|
"updateable": true,
|
||||||
|
"privileged": false,
|
||||||
|
"interface_port": 443,
|
||||||
|
"documentation": "https://smallstep.com/docs/step-ca/",
|
||||||
|
"website": "https://github.com/smallstep/certificates",
|
||||||
|
"logo": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/step-ca.webp",
|
||||||
|
"config_path": "/etc/step-ca",
|
||||||
|
"description": "A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management, so you can use TLS everywhere & SSO for SSH.",
|
||||||
|
"install_methods": [
|
||||||
|
{
|
||||||
|
"type": "default",
|
||||||
|
"script": "ct/step-ca.sh",
|
||||||
|
"resources": {
|
||||||
|
"cpu": 1,
|
||||||
|
"ram": 512,
|
||||||
|
"hdd": 2,
|
||||||
|
"os": "debian",
|
||||||
|
"version": "13"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"default_credentials": {
|
||||||
|
"username": "root",
|
||||||
|
"password": null
|
||||||
|
},
|
||||||
|
"notes": [
|
||||||
|
{
|
||||||
|
"text": "For required post installation actions, checkout: `https://github.com/community-scripts/ProxmoxVE/discussions/11504`",
|
||||||
|
"type": "info"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
287
install/step-ca-install.sh
Normal file
287
install/step-ca-install.sh
Normal file
@ -0,0 +1,287 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
# Copyright (c) 2021-2026 community-scripts ORG
|
||||||
|
# Author: Joerg Heinemann (heinemannj)
|
||||||
|
# License: MIT | https://github.com/community-scripts/ProxmoxVED/raw/main/LICENSE
|
||||||
|
# Source: https://github.com/smallstep/certificates
|
||||||
|
|
||||||
|
source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
|
||||||
|
color
|
||||||
|
verb_ip6
|
||||||
|
catch_errors
|
||||||
|
setting_up_container
|
||||||
|
network_check
|
||||||
|
update_os
|
||||||
|
|
||||||
|
setup_deb822_repo \
|
||||||
|
"smallstep" \
|
||||||
|
"https://packages.smallstep.com/keys/apt/repo-signing-key.gpg" \
|
||||||
|
"https://packages.smallstep.com/stable/debian" \
|
||||||
|
"debs" \
|
||||||
|
"main"
|
||||||
|
|
||||||
|
msg_info "Installing step-ca and step-cli"
|
||||||
|
$STD apt install -y step-ca step-cli
|
||||||
|
msg_ok "Installed step-ca and step-cli"
|
||||||
|
|
||||||
|
msg_info "Define smallstep environment variables"
|
||||||
|
STEPHOME="/root/.step"
|
||||||
|
$STD export STEPPATH=/etc/step-ca
|
||||||
|
$STD export STEPHOME=$STEPHOME
|
||||||
|
msg_ok "Defined smallstep environment variables"
|
||||||
|
|
||||||
|
msg_info "Add smallstep environment variables to /etc/profile"
|
||||||
|
$STD sed -i '1i export STEPPATH=/etc/step-ca' /etc/profile
|
||||||
|
$STD sed -i '1i export STEPHOME=/root/.step' /etc/profile
|
||||||
|
msg_ok "Added smallstep environment variables to /etc/profile"
|
||||||
|
|
||||||
|
msg_info "Authorize step-ca binary with low port-binding capabilities"
|
||||||
|
$STD setcap CAP_NET_BIND_SERVICE=+eip $(which step-ca)
|
||||||
|
msg_ok "Authorized low port-binding capabilities"
|
||||||
|
|
||||||
|
msg_info "Add a smallstep CA service user - Will only be used by systemd to manage the CA"
|
||||||
|
$STD useradd --user-group --system --home $(step path) --shell /bin/false step
|
||||||
|
msg_ok "Created smallstep CA service user"
|
||||||
|
|
||||||
|
DeploymentType="standalone"
|
||||||
|
FQDN=$(hostname -f)
|
||||||
|
DomainName=$(hostname -d)
|
||||||
|
IP=${LOCAL_IP}
|
||||||
|
LISTENER=":443"
|
||||||
|
PKIName="MyHomePKI"
|
||||||
|
PKIProvisioner="pki@$DomainName"
|
||||||
|
AcmeProvisioner="acme@$DomainName"
|
||||||
|
X509MinDur="48h"
|
||||||
|
X509MaxDur="87600h"
|
||||||
|
X509DefaultDur="168h"
|
||||||
|
|
||||||
|
while true;
|
||||||
|
do
|
||||||
|
|
||||||
|
if whiptail_yesno=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "step ca init options" --yesno "Continue with below?\n
|
||||||
|
PKIName: $PKIName
|
||||||
|
PKIProvisioner: $PKIProvisioner
|
||||||
|
AcmeProvisioner: $AcmeProvisioner
|
||||||
|
X509MinDur: $X509MinDur
|
||||||
|
X509MaxDur: $X509MaxDur
|
||||||
|
X509DefaultDur: $X509DefaultDur" --no-button "Change" --yes-button "Continue" 15 70 3>&1 1>&2 2>&3); then
|
||||||
|
break
|
||||||
|
fi
|
||||||
|
|
||||||
|
PKIName=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "step ca init options" --inputbox 'PKIName (e.g. MyHomePKI)' 10 50 "$PKIName" 3>&1 1>&2 2>&3)
|
||||||
|
PKIProvisioner=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "step ca init options" --inputbox 'PKIProvisioner (e.g. pki@$YourDomainName)' 10 50 "$PKIProvisioner" 3>&1 1>&2 2>&3)
|
||||||
|
AcmeProvisioner=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "step ca init options" --inputbox 'AcmeProvisioner (e.g. acme@YourDomainName)' 10 50 "$AcmeProvisioner" 3>&1 1>&2 2>&3)
|
||||||
|
X509MinDur=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "step ca init options" --inputbox 'X509MinDur (e.g. 48h)' 10 50 "$X509MinDur" 3>&1 1>&2 2>&3)
|
||||||
|
X509MaxDur=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "step ca init options" --inputbox 'X509MaxDur (e.g. 87600h)' 10 50 "$X509MaxDur" 3>&1 1>&2 2>&3)
|
||||||
|
X509DefaultDur=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "step ca init options" --inputbox 'X509DefaultDur (e.g. 168h)' 10 50 "$X509DefaultDur" 3>&1 1>&2 2>&3)
|
||||||
|
|
||||||
|
done
|
||||||
|
|
||||||
|
msg_info "Initializing step-ca"
|
||||||
|
EncryptionPwdDir="$(step path)/encryption"
|
||||||
|
PwdFile="$EncryptionPwdDir/ca.pwd"
|
||||||
|
ProvisionerPwdFile="$EncryptionPwdDir/provisioner.pwd"
|
||||||
|
|
||||||
|
mkdir -p "$EncryptionPwdDir"
|
||||||
|
$STD gpg --gen-random --armor 2 32 >"$PwdFile"
|
||||||
|
$STD gpg --gen-random --armor 2 32 >"$ProvisionerPwdFile"
|
||||||
|
|
||||||
|
$STD step ca init \
|
||||||
|
--deployment-type=$DeploymentType \
|
||||||
|
--ssh \
|
||||||
|
--name=$PKIName \
|
||||||
|
--dns="$FQDN" \
|
||||||
|
--dns="$IP" \
|
||||||
|
--address=$LISTENER \
|
||||||
|
--provisioner="$PKIProvisioner" \
|
||||||
|
--password-file="$PwdFile" \
|
||||||
|
--provisioner-password-file="$ProvisionerPwdFile"
|
||||||
|
|
||||||
|
ln -s "$PwdFile" "$(step path)/password.txt"
|
||||||
|
chown -R step:step $(step path)
|
||||||
|
chmod -R 700 $(step path)
|
||||||
|
msg_ok "Initialized step-ca"
|
||||||
|
|
||||||
|
msg_info "Add ACME provisioner"
|
||||||
|
$STD step ca provisioner add "$AcmeProvisioner" --type ACME --admin-name "$AcmeProvisioner"
|
||||||
|
msg_ok "Added ACME provisioner"
|
||||||
|
|
||||||
|
msg_info "Update provisioner configurations"
|
||||||
|
$STD step ca provisioner update "$PKIProvisioner" \
|
||||||
|
--x509-min-dur=$X509MinDur \
|
||||||
|
--x509-max-dur=$X509MaxDur \
|
||||||
|
--x509-default-dur=$X509DefaultDur \
|
||||||
|
--allow-renewal-after-expiry
|
||||||
|
|
||||||
|
$STD step ca provisioner update "$AcmeProvisioner" \
|
||||||
|
--x509-min-dur=$X509MinDur \
|
||||||
|
--x509-max-dur=$X509MaxDur \
|
||||||
|
--x509-default-dur=$X509DefaultDur \
|
||||||
|
--allow-renewal-after-expiry
|
||||||
|
msg_ok "Updated provisioner configurations"
|
||||||
|
|
||||||
|
msg_info "Start step-ca as a Daemon"
|
||||||
|
cat <<'EOF' >/etc/systemd/system/step-ca.service
|
||||||
|
[Unit]
|
||||||
|
Description=step-ca service
|
||||||
|
Documentation=https://smallstep.com/docs/step-ca
|
||||||
|
Documentation=https://smallstep.com/docs/step-ca/certificate-authority-server-production
|
||||||
|
After=network-online.target
|
||||||
|
Wants=network-online.target
|
||||||
|
StartLimitIntervalSec=30
|
||||||
|
StartLimitBurst=3
|
||||||
|
ConditionFileNotEmpty=/etc/step-ca/config/ca.json
|
||||||
|
ConditionFileNotEmpty=/etc/step-ca/password.txt
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=simple
|
||||||
|
User=step
|
||||||
|
Group=step
|
||||||
|
Environment=STEPPATH=/etc/step-ca
|
||||||
|
WorkingDirectory=/etc/step-ca
|
||||||
|
ExecStart=/usr/bin/step-ca config/ca.json --password-file password.txt
|
||||||
|
ExecReload=/bin/kill -USR1 $MAINPID
|
||||||
|
Restart=on-failure
|
||||||
|
RestartSec=5
|
||||||
|
TimeoutStopSec=30
|
||||||
|
StartLimitAction=reboot
|
||||||
|
|
||||||
|
; Process capabilities & privileges
|
||||||
|
AmbientCapabilities=CAP_NET_BIND_SERVICE
|
||||||
|
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
|
||||||
|
SecureBits=keep-caps
|
||||||
|
NoNewPrivileges=yes
|
||||||
|
|
||||||
|
; Sandboxing
|
||||||
|
SystemCallArchitectures=native
|
||||||
|
SystemCallFilter=@system-service
|
||||||
|
SystemCallFilter=~@resources @privileged
|
||||||
|
RestrictNamespaces=yes
|
||||||
|
LockPersonality=yes
|
||||||
|
MemoryDenyWriteExecute=yes
|
||||||
|
RestrictRealtime=yes
|
||||||
|
RestrictSUIDSGID=yes
|
||||||
|
PrivateMounts=yes
|
||||||
|
ProtectControlGroups=yes
|
||||||
|
ProtectKernelModules=yes
|
||||||
|
ProtectKernelTunables=yes
|
||||||
|
ProtectSystem=strict
|
||||||
|
ProtectHome=yes
|
||||||
|
ReadWritePaths=/etc/step-ca/db
|
||||||
|
|
||||||
|
; Read only paths
|
||||||
|
ReadOnlyPaths=/etc/step-ca
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
EOF
|
||||||
|
$STD systemctl enable -q --now step-ca
|
||||||
|
msg_ok "Started step-ca as a Daemon"
|
||||||
|
|
||||||
|
msg_info "Install root CA certificate into system's default trust store"
|
||||||
|
$STD step certificate install --all $(step path)/certs/root_ca.crt
|
||||||
|
$STD update-ca-certificates
|
||||||
|
msg_ok "Installed root CA certificate into system's default trust store"
|
||||||
|
|
||||||
|
msg_info "Install step-batcher to export step-ca badger database"
|
||||||
|
StepBadgerX509Certs="$STEPHOME/step-badger-x509Certs.sh"
|
||||||
|
StepBadgerSshCerts="$STEPHOME/step-badger-sshCerts.sh"
|
||||||
|
|
||||||
|
fetch_and_deploy_gh_release "step-badger" "lukasz-lobocki/step-badger" "prebuild" "latest" "/opt/step-badger" "step-badger_Linux_x86_64.tar.gz"
|
||||||
|
ln -s /opt/step-badger/step-badger /usr/local/bin/step-badger
|
||||||
|
|
||||||
|
mkdir --parents "$STEPHOME/db-copy/"
|
||||||
|
mkdir --parents "$STEPHOME/certs/ca/"
|
||||||
|
mkdir --parents "$STEPHOME/certs/ssh/"
|
||||||
|
mkdir --parents "$STEPHOME/certs/x509/"
|
||||||
|
|
||||||
|
$STD cat <<'EOF' >$StepBadgerX509Certs
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
#
|
||||||
|
# See: https://github.com/lukasz-lobocki/step-badger
|
||||||
|
#
|
||||||
|
|
||||||
|
cp --recursive --force "$(step path)/db/"* "$STEPHOME/db-copy/"
|
||||||
|
cp --recursive --force "$(step path)/certs/"* "$STEPHOME/certs/ca/"
|
||||||
|
|
||||||
|
step-badger x509Certs "$STEPHOME/db-copy" \
|
||||||
|
--dnsnames \
|
||||||
|
--emailaddresses \
|
||||||
|
--ipaddresses \
|
||||||
|
--uris \
|
||||||
|
--issuer \
|
||||||
|
--crl \
|
||||||
|
--provisioner \
|
||||||
|
--algorithm
|
||||||
|
EOF
|
||||||
|
$STD cat <<'EOF' >$StepBadgerSshCerts
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
#
|
||||||
|
# See: https://github.com/lukasz-lobocki/step-badger
|
||||||
|
#
|
||||||
|
|
||||||
|
cp --recursive --force "$(step path)/db/"* "$STEPHOME/db-copy/"
|
||||||
|
cp --recursive --force "$(step path)/certs/"* "$STEPHOME/certs/ca/"
|
||||||
|
|
||||||
|
step-badger sshCerts "$STEPHOME/db-copy" \
|
||||||
|
--algorithm
|
||||||
|
EOF
|
||||||
|
chmod 700 $StepBadgerX509Certs
|
||||||
|
chmod 700 $StepBadgerSshCerts
|
||||||
|
msg_ok "Installed step-batcher to export step-ca badger database"
|
||||||
|
|
||||||
|
msg_info "Install step-ca helper scripts"
|
||||||
|
StepRequest="$STEPHOME/step-ca-request.sh"
|
||||||
|
$STD cat <<'EOF' >$StepRequest
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
#
|
||||||
|
StepCertDir="$STEPHOME/certs/x509"
|
||||||
|
PROVISIONER_PASSWORD=$(step path)/encryption/provisioner.pwd
|
||||||
|
|
||||||
|
while true;
|
||||||
|
do
|
||||||
|
|
||||||
|
FQDN=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "Certificate Signing Request (CSR)" --inputbox 'FQDN (e.g. MyLXC.example.com)' 10 50 "$FQDN" 3>&1 1>&2 2>&3)
|
||||||
|
IP=$(dig +short $FQDN)
|
||||||
|
if [[ -z "$IP" ]]; then
|
||||||
|
echo "Resolution failed for $FQDN"
|
||||||
|
exit
|
||||||
|
fi
|
||||||
|
HOST=$(echo $FQDN | awk -F'.' '{print $1}')
|
||||||
|
IP=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "Certificate Signing Request (CSR)" --inputbox 'IP Address (e.g. x.x.x.x)' 10 50 "$IP" 3>&1 1>&2 2>&3)
|
||||||
|
HOST=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "Certificate Signing Request (CSR)" --inputbox 'Hostname (e.g. MyHostName)' 10 50 "$HOST" 3>&1 1>&2 2>&3)
|
||||||
|
SAN=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "Certificate Signing Request (CSR)" --inputbox 'Subject Alternative Name(s) (SAN) (e.g. myapp-1.example.com, myapp-2.example.com)' 10 50 "$SAN" 3>&1 1>&2 2>&3)
|
||||||
|
VALID_TO=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "Certificate Signing Request (CSR)" --inputbox 'Validity (e.g. 2034-01-31T00:00:00Z)' 10 50 "2034-01-31T00:00:00Z" 3>&1 1>&2 2>&3)
|
||||||
|
|
||||||
|
if whiptail_yesno=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "Certificate Signing Request (CSR)" --yesno "Continue with below?\n
|
||||||
|
FQDN: $FQDN
|
||||||
|
Hostname: $HOST
|
||||||
|
IP Address: $IP
|
||||||
|
Subject Alternative Name(s) (SAN): $SAN
|
||||||
|
Validity: $VALID_TO" --no-button "Change" --yes-button "Continue" 15 70 3>&1 1>&2 2>&3); then
|
||||||
|
break
|
||||||
|
fi
|
||||||
|
|
||||||
|
done
|
||||||
|
|
||||||
|
SAN="$FQDN, $HOST, $IP, $SAN"
|
||||||
|
|
||||||
|
IFS=', ' read -r -a array <<< "$SAN"
|
||||||
|
for element in "${array[@]}"
|
||||||
|
do
|
||||||
|
SAN_ARRAY+=(--san "$element")
|
||||||
|
done
|
||||||
|
|
||||||
|
step ca certificate $FQDN $StepCertDir/$FQDN.crt $StepCertDir/$FQDN.key \
|
||||||
|
--provisioner-password-file=$PROVISIONER_PASSWORD \
|
||||||
|
--not-after=$VALID_TO \
|
||||||
|
"${SAN_ARRAY[@]}" \
|
||||||
|
&& step certificate inspect $StepCertDir/$FQDN.crt \
|
||||||
|
|| echo "Failed to request certificate"; exit
|
||||||
|
EOF
|
||||||
|
chmod 700 $StepRequest
|
||||||
|
msg_ok "Installed step-ca helper scripts"
|
||||||
|
|
||||||
|
motd_ssh
|
||||||
|
customize
|
||||||
|
cleanup_lxc
|
||||||
Loading…
x
Reference in New Issue
Block a user