chore: Second cleanup wave - organize root directory
- Archive: 85 agent .txt files → docs/archive/agents/legacy_txt/ - Scripts: Move 110 shell scripts → scripts/ (keep deploy.sh in root) - Models: Move 18 .safetensors → ml/models/checkpoints/training_artifacts/ - Delete: 34 directories (~33GB freed) - target/, coverage_*, test artifacts - Build: Clean 14 build artifacts (.rlib, .o, .pid, binaries) - Tests: Move 14 .rs files → tests/standalone/ - SQL: Move 5 files → sql/ (keep init-db*.sql for Docker) - Wave 153: Archive to docs/archive/historical/wave153/ - Docs: Archive 9 markdown files to wave_d/reports/ and historical/ Total impact: ~34GB freed (both waves), root directory cleaned from 583 to ~40 essential files Directory count reduced from 65 to 31 (52% reduction) All historical data preserved in organized archive structure
This commit is contained in:
jgrusewski
137
scripts/generate_dev_certs.sh
Executable file
137
scripts/generate_dev_certs.sh
Executable file
@@ -0,0 +1,137 @@
|
||||
#!/bin/bash
|
||||
# Generate Development TLS Certificates for Foxhunt HFT Services
|
||||
# Wave 75 Agent 6 - Quick Fix for Missing Certificates
|
||||
|
||||
set -e
|
||||
|
||||
CERT_DIR="/etc/foxhunt/certs"
|
||||
BACKUP_DIR="./certs_dev"
|
||||
|
||||
echo "========================================="
|
||||
echo " Foxhunt HFT - TLS Certificate Generator"
|
||||
echo "========================================="
|
||||
echo ""
|
||||
|
||||
# Check if running as root (required for /etc/foxhunt)
|
||||
if [ "$EUID" -ne 0 ]; then
|
||||
echo "ERROR: This script must be run as root (for /etc/foxhunt access)"
|
||||
echo ""
|
||||
echo "Usage: sudo ./generate_dev_certs.sh"
|
||||
echo ""
|
||||
echo "Alternative: Generate in local directory without sudo"
|
||||
read -p "Generate certificates in ./certs_dev instead? (y/n) " -n 1 -r
|
||||
echo
|
||||
if [[ $REPLY =~ ^[Yy]$ ]]; then
|
||||
CERT_DIR="./certs_dev"
|
||||
echo "Using local directory: $CERT_DIR"
|
||||
else
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
# Create certificate directory
|
||||
echo "[1/5] Creating certificate directory: $CERT_DIR"
|
||||
mkdir -p "$CERT_DIR"
|
||||
cd "$CERT_DIR"
|
||||
|
||||
# Generate CA private key
|
||||
echo "[2/5] Generating CA private key..."
|
||||
openssl genrsa -out ca.key 4096 2>/dev/null
|
||||
|
||||
# Generate CA certificate
|
||||
echo "[3/5] Generating CA certificate..."
|
||||
openssl req -new -x509 -days 3650 -key ca.key -out ca.crt \
|
||||
-subj "/C=US/ST=California/L=San Francisco/O=Foxhunt HFT/OU=Development/CN=Foxhunt Root CA" \
|
||||
2>/dev/null
|
||||
|
||||
# Generate server private key
|
||||
echo "[4/5] Generating server private key..."
|
||||
openssl genrsa -out server.key 4096 2>/dev/null
|
||||
|
||||
# Create server certificate signing request
|
||||
echo "[5/5] Generating server certificate..."
|
||||
openssl req -new -key server.key -out server.csr \
|
||||
-subj "/C=US/ST=California/L=San Francisco/O=Foxhunt HFT/OU=Services/CN=localhost" \
|
||||
2>/dev/null
|
||||
|
||||
# Create SAN configuration for localhost + service names
|
||||
cat > san.cnf <<EOF
|
||||
[req]
|
||||
distinguished_name = req_distinguished_name
|
||||
req_extensions = v3_req
|
||||
|
||||
[req_distinguished_name]
|
||||
|
||||
[v3_req]
|
||||
basicConstraints = CA:FALSE
|
||||
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
||||
subjectAltName = @alt_names
|
||||
|
||||
[alt_names]
|
||||
DNS.1 = localhost
|
||||
DNS.2 = trading.foxhunt.local
|
||||
DNS.3 = backtesting.foxhunt.local
|
||||
DNS.4 = ml-training.foxhunt.local
|
||||
DNS.5 = api-gateway.foxhunt.local
|
||||
IP.1 = 127.0.0.1
|
||||
IP.2 = 0.0.0.0
|
||||
EOF
|
||||
|
||||
# Sign server certificate with CA
|
||||
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
|
||||
-out server.crt -days 365 -extensions v3_req -extfile san.cnf 2>/dev/null
|
||||
|
||||
# Generate client certificates (for mutual TLS)
|
||||
echo "[BONUS] Generating client certificates..."
|
||||
openssl genrsa -out client.key 4096 2>/dev/null
|
||||
openssl req -new -key client.key -out client.csr \
|
||||
-subj "/C=US/ST=California/L=San Francisco/O=Foxhunt HFT/OU=Clients/CN=foxhunt-client" \
|
||||
2>/dev/null
|
||||
openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
|
||||
-out client.crt -days 365 2>/dev/null
|
||||
|
||||
# Set proper permissions
|
||||
chmod 600 *.key
|
||||
chmod 644 *.crt
|
||||
|
||||
# Clean up temporary files
|
||||
rm -f *.csr *.srl san.cnf
|
||||
|
||||
echo ""
|
||||
echo "========================================="
|
||||
echo " Certificates Generated Successfully!"
|
||||
echo "========================================="
|
||||
echo ""
|
||||
echo "Location: $CERT_DIR"
|
||||
echo ""
|
||||
echo "Files created:"
|
||||
ls -lh "$CERT_DIR"
|
||||
echo ""
|
||||
echo "Certificate Details:"
|
||||
echo "-------------------"
|
||||
openssl x509 -in server.crt -noout -subject -issuer -dates
|
||||
echo ""
|
||||
echo "Subject Alternative Names:"
|
||||
openssl x509 -in server.crt -noout -text | grep -A 1 "Subject Alternative Name"
|
||||
echo ""
|
||||
|
||||
if [ "$CERT_DIR" != "/etc/foxhunt/certs" ]; then
|
||||
echo "⚠️ IMPORTANT: Certificates generated in local directory!"
|
||||
echo ""
|
||||
echo "To use these certificates, copy them to /etc/foxhunt/certs:"
|
||||
echo ""
|
||||
echo " sudo mkdir -p /etc/foxhunt/certs"
|
||||
echo " sudo cp $CERT_DIR/* /etc/foxhunt/certs/"
|
||||
echo " sudo chmod 600 /etc/foxhunt/certs/*.key"
|
||||
echo " sudo chmod 644 /etc/foxhunt/certs/*.crt"
|
||||
echo ""
|
||||
fi
|
||||
|
||||
echo "Next steps:"
|
||||
echo "1. Verify certificates: openssl verify -CAfile $CERT_DIR/ca.crt $CERT_DIR/server.crt"
|
||||
echo "2. Restart services: sudo systemctl restart foxhunt-*"
|
||||
echo "3. Run health check: ./quick_health_check.sh"
|
||||
echo ""
|
||||
echo "⚠️ NOTE: These are DEVELOPMENT certificates (self-signed)"
|
||||
echo " For production, use proper CA-signed certificates or Vault PKI"
|
||||
echo ""
|
||||
Reference in New Issue
Block a user