| 1 | #!/usr/bin/env bash |
| 2 | set -euo pipefail |
| 3 | umask 077 |
| 4 | |
| 5 | test "$(findmnt -n -o UUID --target /srv/tiny)" = 98f49cba-bd8c-432d-a91a-41db66920e90 |
| 6 | install -d -m 700 /srv/tiny/certs /srv/tiny/tailscale/certs |
| 7 | docker exec tiny-tailscale tailscale cert --min-validity=336h \ |
| 8 | --cert-file=/var/lib/tailscale/certs/tailnet.crt \ |
| 9 | --key-file=/var/lib/tailscale/certs/tailnet.key tiny.tailbe516a.ts.net |
| 10 | install -m 644 /srv/tiny/tailscale/certs/tailnet.crt /srv/tiny/certs/tailnet.crt |
| 11 | install -m 600 /srv/tiny/tailscale/certs/tailnet.key /srv/tiny/certs/tailnet.key |
| 12 | |
| 13 | if ! openssl x509 -checkend 1209600 -noout -in /srv/tiny/certs/tiny.crt >/dev/null 2>&1; then |
| 14 | openssl req -new -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes \ |
| 15 | -keyout /srv/tiny/certs/tiny.key -out /srv/tiny/certs/tiny.csr \ |
| 16 | -subj /CN=tiny -addext subjectAltName=DNS:tiny |
| 17 | openssl x509 -req -in /srv/tiny/certs/tiny.csr \ |
| 18 | -CA /var/lib/sandboxd/certs/ca.crt -CAkey /var/lib/sandboxd/certs/ca.key \ |
| 19 | -set_serial "0x$(openssl rand -hex 16)" -days 90 -sha256 \ |
| 20 | -copy_extensions copy -out /srv/tiny/certs/tiny.crt |
| 21 | chmod 644 /srv/tiny/certs/tiny.crt |
| 22 | fi |
| 23 | |
| 24 | if [ "$(docker inspect -f '{{.State.Running}}' tiny-https 2>/dev/null || true)" = true ]; then |
| 25 | docker exec tiny-https caddy reload --config /etc/caddy/Caddyfile --force |
| 26 | fi |