38 lines
1.4 KiB
Bash
38 lines
1.4 KiB
Bash
#!/bin/bash
|
|
set -e
|
|
|
|
CERT_DIR=/etc/voice/certs
|
|
WEB_PORT=${WEB_PORT:-9178}
|
|
mkdir -p "$CERT_DIR"
|
|
|
|
# The container uses host networking, so select a free host port at runtime.
|
|
sed -i -E "s/listen [0-9]+ ssl;/listen ${WEB_PORT} ssl;/" /etc/nginx/sites-available/voice
|
|
|
|
LAN_IP=$(ip -4 route get 1.1.1.1 2>/dev/null | awk '{for(i=1;i<=NF;i++) if ($i=="src") print $(i+1)}')
|
|
[ -z "$LAN_IP" ] && LAN_IP=$(hostname -I 2>/dev/null | awk '{print $1}')
|
|
[ -z "$LAN_IP" ] && LAN_IP=127.0.0.1
|
|
|
|
# Only regenerate if cert is missing or was issued for a different IP
|
|
if [ ! -f "$CERT_DIR/cert.pem" ]; then
|
|
openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
|
|
-keyout "$CERT_DIR/key.pem" \
|
|
-out "$CERT_DIR/cert.pem" \
|
|
-subj "/CN=$LAN_IP" \
|
|
-addext "subjectAltName=DNS:localhost,IP:127.0.0.1,IP:$LAN_IP" 2>/dev/null
|
|
echo "voice cert generated for CN=$LAN_IP"
|
|
else
|
|
existing_cn=$(openssl x509 -in "$CERT_DIR/cert.pem" -noout -subject 2>/dev/null | grep -o 'CN = [^,]*' | cut -d' ' -f3)
|
|
if [ "$existing_cn" != "$LAN_IP" ]; then
|
|
openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
|
|
-keyout "$CERT_DIR/key.pem" \
|
|
-out "$CERT_DIR/cert.pem" \
|
|
-subj "/CN=$LAN_IP" \
|
|
-addext "subjectAltName=DNS:localhost,IP:127.0.0.1,IP:$LAN_IP" 2>/dev/null
|
|
echo "voice cert regenerated for CN=$LAN_IP (was $existing_cn)"
|
|
else
|
|
echo "voice cert already valid for CN=$LAN_IP"
|
|
fi
|
|
fi
|
|
|
|
exec "$@"
|