major improvements

2026-06-12 09:14:49 -05:00
parent a2634a7454
commit b6672ee375
47 changed files with 1498 additions and 231 deletions
@@ -0,0 +1,117 @@
+@echo off
+REM Generate self-signed TLS certificates for Overlord (Windows)
+REM Requires OpenSSL to be installed and in PATH
+
+setlocal EnableDelayedExpansion
+
+set "SCRIPT_DIR=%~dp0"
+for %%I in ("%SCRIPT_DIR%..") do set "ROOT=%%~fI\"
+
+set "CERT_DIR=%ROOT%certs"
+set DAYS=3650
+set COUNTRY=US
+set STATE=State
+set CITY=City
+set ORG=Overlord
+set ORG_UNIT=IT
+
+if "%~1"=="" (
+    set COMMON_NAME=localhost
+) else (
+    set COMMON_NAME=%~1
+)
+
+echo =========================================
+echo Generating TLS Certificates for Overlord
+echo =========================================
+echo Common Name: %COMMON_NAME%
+echo Certificate Directory: %CERT_DIR%
+echo Validity: %DAYS% days
+echo.
+
+REM Check if OpenSSL is available
+where openssl >nul 2>nul
+if %ERRORLEVEL% neq 0 (
+    echo ERROR: OpenSSL is not installed or not in PATH
+    echo.
+    echo Please install OpenSSL from:
+    echo   - https://slproweb.com/products/Win32OpenSSL.html
+    echo   - Or use Chocolatey: choco install openssl
+    echo   - Or use Git Bash which includes OpenSSL
+    exit /b 1
+)
+
+REM Create certs directory if it doesn't exist
+if not exist "%CERT_DIR%" mkdir "%CERT_DIR%"
+
+REM Generate private key
+echo [1/3] Generating private key...
+openssl genrsa -out "%CERT_DIR%\server.key" 2048
+
+REM Generate certificate signing request
+echo [2/3] Generating certificate signing request...
+openssl req -new -key "%CERT_DIR%\server.key" -out "%CERT_DIR%\server.csr" -subj "/C=%COUNTRY%/ST=%STATE%/L=%CITY%/O=%ORG%/OU=%ORG_UNIT%/CN=%COMMON_NAME%"
+
+REM Generate self-signed certificate with SAN
+echo [3/3] Generating self-signed certificate...
+(
+echo [req]
+echo default_bits = 2048
+echo prompt = no
+echo default_md = sha256
+echo distinguished_name = dn
+echo req_extensions = req_ext
+echo.
+echo [dn]
+echo C=%COUNTRY%
+echo ST=%STATE%
+echo L=%CITY%
+echo O=%ORG%
+echo OU=%ORG_UNIT%
+echo CN=%COMMON_NAME%
+echo.
+echo [req_ext]
+echo subjectAltName = @alt_names
+echo.
+echo [alt_names]
+echo DNS.1 = %COMMON_NAME%
+echo DNS.2 = localhost
+echo DNS.3 = *.local
+echo IP.1 = 127.0.0.1
+echo IP.2 = ::1
+) > "%CERT_DIR%\san.cnf"
+
+if not "%~2"=="" (
+    echo IP.3 = %~2>> "%CERT_DIR%\san.cnf"
+    echo Added IP: %~2
+)
+
+openssl x509 -req -in "%CERT_DIR%\server.csr" -signkey "%CERT_DIR%\server.key" -out "%CERT_DIR%\server.crt" -days %DAYS% -sha256 -extfile "%CERT_DIR%\san.cnf" -extensions req_ext
+
+REM Clean up
+del "%CERT_DIR%\server.csr"
+del "%CERT_DIR%\san.cnf"
+
+echo.
+echo =========================================
+echo ✓ Certificates generated successfully!
+echo =========================================
+echo Certificate: %CERT_DIR%\server.crt
+echo Private Key: %CERT_DIR%\server.key
+echo.
+echo To use these certificates:
+echo   1. Set environment variable: set OVERLORD_TLS=true
+echo   2. Optionally set custom paths:
+echo      set OVERLORD_TLS_CERT=%CERT_DIR%\server.crt
+echo      set OVERLORD_TLS_KEY=%CERT_DIR%\server.key
+echo.
+echo ⚠️  NOTE: Self-signed certificates require clients to:
+echo   - Skip certificate verification (insecure), OR
+echo   - Trust the server.crt certificate manually
+echo.
+echo For production, use proper certificates from:
+echo   - Let's Encrypt (free, automated)
+echo   - Your organization's certificate authority
+echo =========================================
+
+endlocal