982777addb
Migrate from homelab.fhirworx.io (LAN-only, IP allowlist) to fhirworx.io (public, Gitea SSO via oauth2-proxy). - Domain: homelab.fhirworx.io → fhirworx.io across all configs - SSO: oauth2-proxy (OIDC/Gitea) + auth-handler nginx for Traefik ForwardAuth (converts 401 → 302 redirect, same as corwins.media auth_request pattern) - Cloudflared: tunnel remote config with 20 hostnames → traefik, DNS CNAME records via CF API - Bootstrap: `docker compose run --rm wire` — idempotent cold-start that creates Gitea admin, OAuth2 app, oauth2-proxy credentials, clears Cloudflare Access apps, syncs tunnel config + DNS - Dashboard: rebranded FHIRWORX, HTTPS links, API tile added - Grafana/Woodpecker/Gitea ROOT_URLs updated to HTTPS
53 lines
2.2 KiB
Bash
Executable File
53 lines
2.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Install the homelab self-signed CA into the local trust stores.
|
|
# Run once after cloning the repo or regenerating certs.
|
|
#
|
|
# Usage: ./dev/scripts/install_certs.sh
|
|
|
|
set -uo pipefail
|
|
CERT="$(cd "$(dirname "$0")/../.." && pwd)/infra/traefik/certs/ca.crt"
|
|
CERT_NAME="Homelab CA"
|
|
|
|
if [ ! -f "$CERT" ]; then
|
|
echo "ERROR: $CERT not found. Run from the project root."
|
|
exit 1
|
|
fi
|
|
|
|
echo "Installing homelab CA from $CERT"
|
|
|
|
# ── System trust store (Debian/Ubuntu) ────────────────────────
|
|
if command -v update-ca-certificates &>/dev/null; then
|
|
echo " → system trust store (update-ca-certificates)"
|
|
sudo cp "$CERT" /usr/local/share/ca-certificates/homelab-fhirworx.crt
|
|
sudo update-ca-certificates 2>/dev/null
|
|
fi
|
|
|
|
# ── Firefox (all profiles) ────────────────────────────────────
|
|
if command -v certutil &>/dev/null; then
|
|
echo " → Firefox profiles"
|
|
find "$HOME/.mozilla/firefox" "$HOME/.config/mozilla/firefox" -name "cert9.db" -printf '%h\n' 2>/dev/null | sort -u | while read -r dir; do
|
|
profile="$(basename "$dir")"
|
|
echo " profile: $profile"
|
|
certutil -d "sql:$dir" -A -t "CT,," -n "$CERT_NAME" -i "$CERT" 2>/dev/null || true
|
|
done
|
|
else
|
|
echo " ⚠ certutil not found — install libnss3-tools for Firefox cert import"
|
|
echo " sudo apt install libnss3-tools"
|
|
fi
|
|
|
|
# ── Chromium / Chrome ─────────────────────────────────────────
|
|
NSS_DB="$HOME/.pki/nssdb"
|
|
if [ -d "$NSS_DB" ] && command -v certutil &>/dev/null; then
|
|
echo " → Chromium/Chrome ($NSS_DB)"
|
|
certutil -d "sql:$NSS_DB" -A -t "CT,," -n "$CERT_NAME" -i "$CERT" 2>/dev/null || true
|
|
fi
|
|
|
|
# ── Node.js (for Docusaurus builds) ──────────────────────────
|
|
echo " → NODE_EXTRA_CA_CERTS=$CERT"
|
|
echo " Add to your shell profile:"
|
|
echo " export NODE_EXTRA_CA_CERTS=$CERT"
|
|
|
|
echo ""
|
|
echo "Done. Restart Firefox/Chrome to pick up the new CA."
|
|
echo "HTTPS: https://docs.${DOMAIN:-fhirworx.io} should now load without warnings."
|