89 lines
3.9 KiB
Bash
89 lines
3.9 KiB
Bash
|
#!/usr/bin/env bash
|
||
|
|
# =============================================================================
|
||
|
|
# eBdesk SiCABE — Generate keystore TLS Trino (+ ekspor sertifikat untuk klien)
|
||
|
|
# =============================================================================
|
||
|
|
# Mengapa perlu SAN (Subject Alternative Name)?
|
||
|
|
# Keystore lama hanya berisi CN=localhost TANPA SAN. Klien yang memverifikasi
|
||
|
|
# TLS (bukan mematikannya) tidak dapat memakai sertifikat itu untuk hostname
|
||
|
|
# `trino` (nama service di jaringan compose) → verifikasi gagal. Sertifikat di
|
||
|
|
# sini menerbitkan SAN: trino, localhost, sicabe-trino, 127.0.0.1 sehingga
|
||
|
|
# verifikasi BERJALAN (bukan dimatikan).
|
||
|
|
#
|
||
|
|
# Diperlukan oleh:
|
||
|
|
# - Trino: /etc/trino/keystore.p12 (password di config.properties)
|
||
|
|
# - Klien yang memverifikasi (mis. ingestion OpenMetadata): sertifikat PEM hasil
|
||
|
|
# ekspor di config/trino/certs/trino.crt
|
||
|
|
#
|
||
|
|
# ⚠️ Ini keystore DEVELOPMENT (di-commit). Untuk produksi: generate ulang, jangan
|
||
|
|
# commit private key-nya, dan ganti `http-server.https.keystore.key`.
|
||
|
|
#
|
||
|
|
# Usage:
|
||
|
|
# ./scripts/generate-trino-keystore.sh
|
||
|
|
# TRINO_KEYSTORE_PASSWORD=rahasia ./scripts/generate-trino-keystore.sh
|
||
|
|
# =============================================================================
|
||
|
|
set -uo pipefail
|
||
|
|
|
||
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||
|
|
# shellcheck source=../lib/common.sh
|
||
|
|
source "${SCRIPT_DIR}/lib/common.sh"
|
||
|
|
|
||
|
|
# Opsi:
|
||
|
|
# --out <dir> tulis <dir>/keystore.p12 + <dir>/certs/trino.crt (default config/trino)
|
||
|
|
# --san-extra <csv> tambahkan entri SAN, mis. "IP:10.0.0.11,IP:10.0.0.12" — dipakai
|
||
|
|
# multi-host supaya klien yang terhubung via ALAMAT HOST tetap
|
||
|
|
# memverifikasi TLS (cert tak hanya valid utk nama container).
|
||
|
|
OUT_DIR="${SCRIPT_DIR}/config/trino"
|
||
|
|
SAN_EXTRA=""
|
||
|
|
while [[ $# -gt 0 ]]; do
|
||
|
|
case "$1" in
|
||
|
|
--out) OUT_DIR="${2:-}"; shift 2 ;;
|
||
|
|
--san-extra) SAN_EXTRA="${2:-}"; shift 2 ;;
|
||
|
|
-h|--help) sed -n '20,23p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'; exit 0 ;;
|
||
|
|
*) echo -e "${ERR} Argumen tidak dikenal: $1"; exit 2 ;;
|
||
|
|
esac
|
||
|
|
done
|
||
|
|
|
||
|
|
KEYSTORE="${OUT_DIR}/keystore.p12"
|
||
|
|
CERT_DIR="${OUT_DIR}/certs"
|
||
|
|
CERT="${CERT_DIR}/trino.crt"
|
||
|
|
PROPS="${SCRIPT_DIR}/config/trino/config-coordinator.properties"
|
||
|
|
|
||
|
|
# Password keystore: env menang, kalau tidak ambil dari config.properties
|
||
|
|
# (Trino memakai SATU password untuk keystore & key).
|
||
|
|
KS_PASSWORD="${TRINO_KEYSTORE_PASSWORD:-}"
|
||
|
|
if [[ -z "${KS_PASSWORD}" ]]; then
|
||
|
|
KS_PASSWORD="$(sed -n 's/^http-server.https.keystore.key=//p' "${PROPS}" 2>/dev/null | head -1)"
|
||
|
|
fi
|
||
|
|
if [[ -z "${KS_PASSWORD}" ]]; then
|
||
|
|
echo -e "${ERR} Password keystore tidak diketahui (isi TRINO_KEYSTORE_PASSWORD)."
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
SAN="DNS:trino,DNS:localhost,DNS:sicabe-trino,DNS:trino-coordinator,DNS:trino-worker,IP:127.0.0.1"
|
||
|
|
[[ -n "${SAN_EXTRA}" ]] && SAN="${SAN},${SAN_EXTRA}"
|
||
|
|
mkdir -p "${CERT_DIR}"
|
||
|
|
TMP_KEY="$(mktemp)"
|
||
|
|
trap 'rm -f "${TMP_KEY}"' EXIT
|
||
|
|
|
||
|
|
echo -e "${INFO} Menerbitkan sertifikat self-signed (SAN: ${SAN})..."
|
||
|
|
if ! openssl req -x509 -newkey rsa:2048 -nodes -days 825 \
|
||
|
|
-keyout "${TMP_KEY}" -out "${CERT}" \
|
||
|
|
-subj "/CN=trino" -addext "subjectAltName=${SAN}" >/dev/null 2>&1; then
|
||
|
|
echo -e "${ERR} Gagal membuat sertifikat (openssl tidak tersedia?)."
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
echo -e "${INFO} Membungkus ke PKCS12 (${KEYSTORE##*/})..."
|
||
|
|
if ! openssl pkcs12 -export -in "${CERT}" -inkey "${TMP_KEY}" \
|
||
|
|
-name trino -out "${KEYSTORE}" -passout "pass:${KS_PASSWORD}" >/dev/null 2>&1; then
|
||
|
|
echo -e "${ERR} Gagal membuat keystore PKCS12."
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
chmod 644 "${KEYSTORE}" "${CERT}"
|
||
|
|
|
||
|
|
echo -e "${OK} Keystore dibuat: ${KEYSTORE}"
|
||
|
|
echo -e "${OK} Sertifikat diekspor: ${CERT}"
|
||
|
|
openssl x509 -in "${CERT}" -noout -subject -dates 2>/dev/null | sed 's/^/ /'
|
||
|
|
openssl x509 -in "${CERT}" -noout -ext subjectAltName 2>/dev/null | sed 's/^/ /'
|
||
|
|
echo -e "${INFO} Restart Trino coordinator agar sertifikat baru dipakai: ./install.sh --restart trino-coordinator"
|