91 lines
2.6 KiB
Bash
Executable File
91 lines
2.6 KiB
Bash
Executable File
#!/bin/bash
|
|
# 生成自签名证书脚本
|
|
# 用于 OPENCLAW AKS 部署的 HTTPS 访问
|
|
|
|
set -e
|
|
|
|
# 配置变量
|
|
DOMAIN="${1:-openclaw.yourdomain.com}" # 从命令行参数获取域名，默认为 openclaw.yourdomain.com
|
|
NAMESPACE="${2:-openclaw}" # Kubernetes 命名空间
|
|
SECRET_NAME="${3:-openclaw-tls}" # Kubernetes Secret 名称
|
|
CERT_DIR="./certs"
|
|
DAYS_VALID=365 # 证书有效期（天）
|
|
|
|
echo "=========================================="
|
|
echo "生成自签名证书 for OPENCLAW"
|
|
echo "=========================================="
|
|
echo "域名: $DOMAIN"
|
|
echo "命名空间: $NAMESPACE"
|
|
echo "Secret 名称: $SECRET_NAME"
|
|
echo "=========================================="
|
|
|
|
# 创建证书目录
|
|
mkdir -p "$CERT_DIR"
|
|
|
|
# 生成私钥
|
|
echo "1. 生成私钥..."
|
|
openssl genrsa -out "$CERT_DIR/tls.key" 2048
|
|
|
|
# 生成证书签名请求 (CSR)
|
|
echo "2. 生成证书签名请求..."
|
|
openssl req -new -key "$CERT_DIR/tls.key" -out "$CERT_DIR/tls.csr" \
|
|
-subj "/C=CN/ST=Beijing/L=Beijing/O=OpenClaw/CN=$DOMAIN"
|
|
|
|
# 生成自签名证书
|
|
echo "3. 生成自签名证书..."
|
|
openssl x509 -req -days $DAYS_VALID -in "$CERT_DIR/tls.csr" -signkey "$CERT_DIR/tls.key" \
|
|
-out "$CERT_DIR/tls.crt" \
|
|
-extensions v3_req \
|
|
-extfile <(cat <<EOF
|
|
[req]
|
|
distinguished_name = req_distinguished_name
|
|
req_extensions = v3_req
|
|
|
|
[v3_req]
|
|
basicConstraints = CA:FALSE
|
|
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
|
|
subjectAltName = @alt_names
|
|
|
|
[alt_names]
|
|
DNS.1 = $DOMAIN
|
|
DNS.2 = *.$DOMAIN
|
|
DNS.3 = localhost
|
|
IP.1 = 127.0.0.1
|
|
EOF
|
|
)
|
|
|
|
# 清理 CSR 文件
|
|
rm -f "$CERT_DIR/tls.csr"
|
|
|
|
echo "4. 证书生成完成！"
|
|
echo ""
|
|
echo "证书文件："
|
|
echo " - 私钥: $CERT_DIR/tls.key"
|
|
echo " - 证书: $CERT_DIR/tls.crt"
|
|
echo ""
|
|
|
|
# 创建 Kubernetes Secret
|
|
echo "5. 创建 Kubernetes Secret..."
|
|
kubectl create secret tls "$SECRET_NAME" \
|
|
--cert="$CERT_DIR/tls.crt" \
|
|
--key="$CERT_DIR/tls.key" \
|
|
--namespace="$NAMESPACE" \
|
|
--dry-run=client -o yaml | kubectl apply -f -
|
|
|
|
echo ""
|
|
echo "=========================================="
|
|
echo "✅ 完成！"
|
|
echo "=========================================="
|
|
echo "Secret '$SECRET_NAME' 已创建在命名空间 '$NAMESPACE' 中"
|
|
echo ""
|
|
echo "下一步："
|
|
echo "1. 更新 deploay.yaml 中的 Ingress 配置，添加 TLS 部分"
|
|
echo "2. 将域名 '$DOMAIN' 指向你的 AKS Ingress IP"
|
|
echo "3. 访问 https://$DOMAIN (浏览器会显示安全警告，这是正常的)"
|
|
echo ""
|
|
echo "注意：自签名证书会在浏览器中显示安全警告，"
|
|
echo " 需要手动接受证书才能访问。"
|
|
echo "=========================================="
|
|
|
|
|