cloud-init mtls bootstrap poc

gistfile1.txt

#!/bin/bash

# Generate certificate and random material
openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048
mkdir -p /etc/ssl/private

PUBLIC_IP=$(jq -r .publicIp < /tmp/${instance_id}_publicip.json)
PUBLIC_IP_MOD=$(echo ${PUBLIC_IP} | tr . -)
DNS_NAME="${PUBLIC_IP_MOD}.nip.io"

# Give ourselves a wildcard self-signed certificate
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -sha256 -keyout /etc/ssl/private/nginx-selfsigned.key -out /etc/ssl/certs/nginx-selfsigned.crt -batch \
    -subj /CN=${DNS_NAME} \
    -reqexts SAN \
    -extensions SAN \
    -config <(cat /etc/pki/tls/openssl.cnf \
        <(printf "[SAN]\nsubjectAltName=DNS:\*.${DNS_NAME}"))

CERT=/etc/ssl/certs/nginx-selfsigned.crt

mkdir -p client
CLIENT_NAME=client
openssl genrsa -out client/${CLIENT_NAME}.key 2048
openssl req -new -key client/${CLIENT_NAME}.key -out client/${CLIENT_NAME}.csr -batch
openssl x509 -req -days 365 -sha256 -in client/${CLIENT_NAME}.csr -CA /etc/ssl/certs/nginx-selfsigned.crt -CAkey /etc/ssl/private/nginx-selfsigned.key -set_serial 2 -out client/${CLIENT_NAME}.crt

# when browser access is needed
#openssl pkcs12 -export -clcerts -in client/${CLIENT_NAME}.crt -inkey client/${CLIENT_NAME}.key -out client/${CLIENT_NAME}.p12

# Open up firewall
yum install -y firewalld
systemctl enable --now firewalld
# http
for SERVICE in https; do
    firewall-cmd --zone=public --add-service=${SERVICE}
    firewall-cmd --zone=public --permanent --add-service=${SERVICE}
done

# Enable software collections (https://www.softwarecollections.org/en/scls/rhscl/rh-nginx114/)
yum install -y centos-release-scl
yum-config-manager --enable rhel-server-rhscl-7-rpms

# Install nginx (old version 1.12 is in base centos7)
yum install -y rh-nginx116-nginx rh-nginx116-nginx-mod-stream
#scl enable rh-nginx116 bash
#nginx -v
#nginx version: nginx/1.16.1
#config is at /etc/opt/rh/rh-nginx116/nginx/nginx.conf

# Configure nginx for SSL serving
NGINX_CONF_DIR=/etc/opt/rh/rh-nginx116/nginx
mkdir -p ${NGINX_CONF_DIR}/snippets

cat > ${NGINX_CONF_DIR}/snippets/self-signed.conf <<EOF
ssl_certificate /etc/ssl/certs/nginx-selfsigned.crt;
ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;
ssl_client_certificate /etc/ssl/certs/nginx-selfsigned.crt;
ssl_verify_client on;
EOF

cat > ${NGINX_CONF_DIR}/snippets/ssl-params.conf <<EOF
# from https://cipherli.st/
# and https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html

# We can disable 1.0 and 1.1 -- 1.2 only for the win
ssl_protocols TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
ssl_ecdh_curve secp384r1;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;
#ssl_stapling on;
#ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;
# Disable preloading HSTS for now.  You can use the commented out header line that includes
# the "preload" directive if you understand the implications.
#add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
add_header Strict-Transport-Security "max-age=63072000; includeSubdomains";
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;

ssl_dhparam /etc/ssl/certs/dhparam.pem;
EOF

cat > ${NGINX_CONF_DIR}/nginx.conf <<EOF
# For more information on configuration, see:
#   * Official English Documentation: http://nginx.org/en/docs/
#   * Official Russian Documentation: http://nginx.org/ru/docs/

user nginx;
worker_processes auto;
error_log /var/opt/rh/rh-nginx116/log/nginx/error.log;
pid /var/opt/rh/rh-nginx116/run/nginx/nginx.pid;

# Load dynamic modules. See /opt/rh/rh-nginx116/root/usr/share/doc/README.dynamic.
include /opt/rh/rh-nginx116/root/usr/share/nginx/modules/*.conf;

events {
    worker_connections  1024;
}

http {
    log_format  main  '\$remote_addr - \$remote_user [\$time_local] "\$request" '
                      '\$status \$body_bytes_sent "\$http_referer" '
                      '"\$http_user_agent" "\$http_x_forwarded_for"';

    access_log  /var/opt/rh/rh-nginx116/log/nginx/access.log  main;

    sendfile        on;
    tcp_nopush      on;
    tcp_nodelay     on;
    keepalive_timeout  65;
    types_hash_max_size 2048;

    include       /etc/opt/rh/rh-nginx116/nginx/mime.types;
    default_type  application/octet-stream;

    # Load modular configuration files from the /etc/nginx/conf.d directory.
    # See http://nginx.org/en/docs/ngx_core_module.html#include
    # for more information.
    include /etc/opt/rh/rh-nginx116/nginx/conf.d/*.conf;

    server {

        # SSL Configuration
        listen 443 ssl http2 default_server;
        listen [::]:443 ssl http2 default_server;
        include snippets/self-signed.conf;
        include snippets/ssl-params.conf;

        server_name  _;
        root         /opt/rh/rh-nginx116/root/usr/share/nginx/html;

        # Load configuration files for the default server block.
        include      /etc/opt/rh/rh-nginx116/nginx/default.d/*.conf;

        location / {
        }

        error_page 404 /404.html;
        location = /40x.html {
        }

        error_page 500 502 503 504  /50x.html;
        location = /50x.html {
        }
    }

}
EOF

systemctl enable --now rh-nginx116-nginx