57e22c01a8
- K8s: rename api-gateway → api manifests, delete web-gateway, update network policies - CI: rename compile/deploy jobs, delete web-gateway jobs - Docker: rename service in compose files - Prometheus: update scrape targets and alert rules - Scripts: update binary references in build/test/cert scripts - FXT CLI: rename api_gateway_url → api_url (with serde alias for compat) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
138 lines
4.2 KiB
Bash
Executable File
138 lines
4.2 KiB
Bash
Executable File
#!/bin/bash
|
|
# Generate Development TLS Certificates for Foxhunt HFT Services
|
|
# Wave 75 Agent 6 - Quick Fix for Missing Certificates
|
|
|
|
set -e
|
|
|
|
CERT_DIR="/etc/foxhunt/certs"
|
|
BACKUP_DIR="./certs_dev"
|
|
|
|
echo "========================================="
|
|
echo " Foxhunt HFT - TLS Certificate Generator"
|
|
echo "========================================="
|
|
echo ""
|
|
|
|
# Check if running as root (required for /etc/foxhunt)
|
|
if [ "$EUID" -ne 0 ]; then
|
|
echo "ERROR: This script must be run as root (for /etc/foxhunt access)"
|
|
echo ""
|
|
echo "Usage: sudo ./generate_dev_certs.sh"
|
|
echo ""
|
|
echo "Alternative: Generate in local directory without sudo"
|
|
read -p "Generate certificates in ./certs_dev instead? (y/n) " -n 1 -r
|
|
echo
|
|
if [[ $REPLY =~ ^[Yy]$ ]]; then
|
|
CERT_DIR="./certs_dev"
|
|
echo "Using local directory: $CERT_DIR"
|
|
else
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
# Create certificate directory
|
|
echo "[1/5] Creating certificate directory: $CERT_DIR"
|
|
mkdir -p "$CERT_DIR"
|
|
cd "$CERT_DIR"
|
|
|
|
# Generate CA private key
|
|
echo "[2/5] Generating CA private key..."
|
|
openssl genrsa -out ca.key 4096 2>/dev/null
|
|
|
|
# Generate CA certificate
|
|
echo "[3/5] Generating CA certificate..."
|
|
openssl req -new -x509 -days 3650 -key ca.key -out ca.crt \
|
|
-subj "/C=US/ST=California/L=San Francisco/O=Foxhunt HFT/OU=Development/CN=Foxhunt Root CA" \
|
|
2>/dev/null
|
|
|
|
# Generate server private key
|
|
echo "[4/5] Generating server private key..."
|
|
openssl genrsa -out server.key 4096 2>/dev/null
|
|
|
|
# Create server certificate signing request
|
|
echo "[5/5] Generating server certificate..."
|
|
openssl req -new -key server.key -out server.csr \
|
|
-subj "/C=US/ST=California/L=San Francisco/O=Foxhunt HFT/OU=Services/CN=localhost" \
|
|
2>/dev/null
|
|
|
|
# Create SAN configuration for localhost + service names
|
|
cat > san.cnf <<EOF
|
|
[req]
|
|
distinguished_name = req_distinguished_name
|
|
req_extensions = v3_req
|
|
|
|
[req_distinguished_name]
|
|
|
|
[v3_req]
|
|
basicConstraints = CA:FALSE
|
|
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
|
subjectAltName = @alt_names
|
|
|
|
[alt_names]
|
|
DNS.1 = localhost
|
|
DNS.2 = trading.foxhunt.local
|
|
DNS.3 = backtesting.foxhunt.local
|
|
DNS.4 = ml-training.foxhunt.local
|
|
DNS.5 = api.foxhunt.local
|
|
IP.1 = 127.0.0.1
|
|
IP.2 = 0.0.0.0
|
|
EOF
|
|
|
|
# Sign server certificate with CA
|
|
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
|
|
-out server.crt -days 365 -extensions v3_req -extfile san.cnf 2>/dev/null
|
|
|
|
# Generate client certificates (for mutual TLS)
|
|
echo "[BONUS] Generating client certificates..."
|
|
openssl genrsa -out client.key 4096 2>/dev/null
|
|
openssl req -new -key client.key -out client.csr \
|
|
-subj "/C=US/ST=California/L=San Francisco/O=Foxhunt HFT/OU=Clients/CN=foxhunt-client" \
|
|
2>/dev/null
|
|
openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
|
|
-out client.crt -days 365 2>/dev/null
|
|
|
|
# Set proper permissions
|
|
chmod 600 *.key
|
|
chmod 644 *.crt
|
|
|
|
# Clean up temporary files
|
|
rm -f *.csr *.srl san.cnf
|
|
|
|
echo ""
|
|
echo "========================================="
|
|
echo " Certificates Generated Successfully!"
|
|
echo "========================================="
|
|
echo ""
|
|
echo "Location: $CERT_DIR"
|
|
echo ""
|
|
echo "Files created:"
|
|
ls -lh "$CERT_DIR"
|
|
echo ""
|
|
echo "Certificate Details:"
|
|
echo "-------------------"
|
|
openssl x509 -in server.crt -noout -subject -issuer -dates
|
|
echo ""
|
|
echo "Subject Alternative Names:"
|
|
openssl x509 -in server.crt -noout -text | grep -A 1 "Subject Alternative Name"
|
|
echo ""
|
|
|
|
if [ "$CERT_DIR" != "/etc/foxhunt/certs" ]; then
|
|
echo "⚠️ IMPORTANT: Certificates generated in local directory!"
|
|
echo ""
|
|
echo "To use these certificates, copy them to /etc/foxhunt/certs:"
|
|
echo ""
|
|
echo " sudo mkdir -p /etc/foxhunt/certs"
|
|
echo " sudo cp $CERT_DIR/* /etc/foxhunt/certs/"
|
|
echo " sudo chmod 600 /etc/foxhunt/certs/*.key"
|
|
echo " sudo chmod 644 /etc/foxhunt/certs/*.crt"
|
|
echo ""
|
|
fi
|
|
|
|
echo "Next steps:"
|
|
echo "1. Verify certificates: openssl verify -CAfile $CERT_DIR/ca.crt $CERT_DIR/server.crt"
|
|
echo "2. Restart services: sudo systemctl restart foxhunt-*"
|
|
echo "3. Run health check: ./quick_health_check.sh"
|
|
echo ""
|
|
echo "⚠️ NOTE: These are DEVELOPMENT certificates (self-signed)"
|
|
echo " For production, use proper CA-signed certificates or Vault PKI"
|
|
echo ""
|