initial-commit

2026-05-12 17:06:43 +02:00
commit 051a080dfa
110 changed files with 26377 additions and 0 deletions
@@ -0,0 +1,134 @@
+#!/bin/bash
+set -e
+
+# Charybdis Development Certificate Generation Script
+# This script generates self-signed certificates for local development and testing
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+CERT_DIR="${SCRIPT_DIR}/../certs"
+DAYS_VALID=365
+
+echo "🔐 Charybdis Certificate Generation"
+echo "===================================="
+echo ""
+
+# Create certs directory
+mkdir -p "${CERT_DIR}"
+cd "${CERT_DIR}"
+
+# Function to generate certificate
+generate_cert() {
+    local name=$1
+    local cn=$2
+    local ou=$3
+    local cert_type=$4  # "server" or "client"
+
+    echo "📝 Generating ${name}..."
+
+    # Generate private key
+    openssl genrsa -out "${name}-key.pem" 2048 2>/dev/null
+
+    # Generate CSR
+    openssl req -new \
+        -key "${name}-key.pem" \
+        -out "${name}.csr" \
+        -subj "/CN=${cn}/OU=${ou}/O=Charybdis-Dev/C=US" \
+        2>/dev/null
+
+    # Generate certificate
+    if [ "${cert_type}" = "server" ]; then
+        openssl x509 -req \
+            -days ${DAYS_VALID} \
+            -in "${name}.csr" \
+            -CA ca.pem \
+            -CAkey ca-key.pem \
+            -CAcreateserial \
+            -out "${name}-cert.pem" \
+            -extfile <(echo "extendedKeyUsage=serverAuth
+subjectAltName=DNS:localhost,DNS:charybdis,DNS:charybdis.local,IP:127.0.0.1") \
+            2>/dev/null
+    else
+        openssl x509 -req \
+            -days ${DAYS_VALID} \
+            -in "${name}.csr" \
+            -CA ca.pem \
+            -CAkey ca-key.pem \
+            -CAcreateserial \
+            -out "${name}-cert.pem" \
+            -extfile <(echo "extendedKeyUsage=clientAuth") \
+            2>/dev/null
+    fi
+
+    # Clean up CSR
+    rm "${name}.csr"
+
+    echo "   ✅ Generated ${name}-cert.pem and ${name}-key.pem"
+}
+
+# 1. Generate Root CA
+echo "🏛️  Generating Root CA..."
+if [ ! -f ca.pem ]; then
+    openssl genrsa -out ca-key.pem 4096 2>/dev/null
+    openssl req -new -x509 \
+        -days 3650 \
+        -key ca-key.pem \
+        -out ca.pem \
+        -subj "/CN=Charybdis Dev Root CA/O=Charybdis-Dev/C=US" \
+        2>/dev/null
+    echo "   ✅ Generated ca.pem (Root CA)"
+else
+    echo "   ℹ️  Root CA already exists, skipping"
+fi
+echo ""
+
+# 2. Generate Server Certificate
+echo "🖥️  Generating Server Certificate..."
+generate_cert "server" "localhost" "platform" "server"
+echo ""
+
+# 3. Generate Client Certificates
+echo "👥 Generating Client Certificates..."
+echo ""
+
+# Admin client
+generate_cert "admin" "admin-user" "platform-team" "client"
+
+# CI/CD Pipeline client
+generate_cert "ci-pipeline" "ci-pipeline" "automation" "client"
+
+# Backstage client
+generate_cert "backstage" "backstage" "platform" "client"
+
+# DefectDojo plugin client
+generate_cert "defectdojo-plugin" "defectdojo-plugin" "plugins" "client"
+
+# DependencyTrack plugin client
+generate_cert "dependencytrack-plugin" "dependencytrack-plugin" "plugins" "client"
+
+echo ""
+echo "✅ Certificate Generation Complete!"
+echo ""
+echo "📂 Certificates generated in: ${CERT_DIR}"
+echo ""
+echo "📋 Summary:"
+echo "   - Root CA: ca.pem, ca-key.pem"
+echo "   - Server: server-cert.pem, server-key.pem"
+echo "   - Clients:"
+echo "     • admin-cert.pem, admin-key.pem (role: admin)"
+echo "     • ci-pipeline-cert.pem, ci-pipeline-key.pem (role: service-writer)"
+echo "     • backstage-cert.pem, backstage-key.pem (role: catalog-reader)"
+echo "     • defectdojo-plugin-cert.pem, defectdojo-plugin-key.pem (role: plugin)"
+echo "     • dependencytrack-plugin-cert.pem, dependencytrack-plugin-key.pem (role: plugin)"
+echo ""
+echo "🔍 Verify certificates:"
+echo "   openssl x509 -in ${CERT_DIR}/server-cert.pem -text -noout"
+echo ""
+echo "🚀 Use with Charybdis:"
+echo "   export SECURITY_MTLS_ENABLED=true"
+echo "   export SECURITY_MTLS_SERVER_CERT=${CERT_DIR}/server-cert.pem"
+echo "   export SECURITY_MTLS_SERVER_KEY=${CERT_DIR}/server-key.pem"
+echo "   export SECURITY_MTLS_CLIENT_CA=${CERT_DIR}/ca.pem"
+echo ""
+echo "⚠️  These are DEVELOPMENT certificates only!"
+echo "   Do NOT use in production. Generate proper certificates from a trusted CA."
+echo ""