adding the terradfrom module just in case

2026-03-19 23:34:22 +00:00
parent 2d4a96098c
commit 9335e0ac24
16 changed files with 992 additions and 0 deletions
@@ -0,0 +1,112 @@
+variable "device_names" {
+  type    = set(string)
+  default = []
+}
+
+# 1. Generate Private Keys for each device
+resource "tls_private_key" "device_key" {
+  for_each  = var.device_names
+  algorithm = "RSA"
+  rsa_bits  = 2048
+}
+
+# 1. Save the private key temporarily (needed for the openssl command)
+resource "local_sensitive_file" "tmp_key" {
+  for_each = var.device_names
+  content  = tls_private_key.device_key[each.key].private_key_pem
+  filename = "${path.module}/output/${each.key}.key"
+}
+
+# 2. Create Certificate Signing Requests (CSR)
+resource "tls_cert_request" "device_csr" {
+  for_each        = var.device_names
+  private_key_pem = tls_private_key.device_key[each.key].private_key_pem
+
+  subject {
+    common_name  = each.key
+    organization = "My Home Lab"
+  }
+}
+
+# 3. Sign the Certificates using your existing CA
+# Note: You need your CA cert and key available as files
+resource "tls_locally_signed_cert" "device_cert" {
+  for_each           = var.device_names
+  cert_request_pem   = tls_cert_request.device_csr[each.key].cert_request_pem
+  ca_private_key_pem = file("${path.module}/MyPrivateCA.key")
+  ca_cert_pem        = file("${path.module}/MyPrivateCA.crt")
+
+  validity_period_hours = 8760 # 1 year
+  allowed_uses = [
+    "client_auth",
+    "digital_signature",
+  ]
+}
+
+# 4. EXPORT: Generate the .p12 and the CRL automatically
+# This runs every time a cert is added OR removed
+resource "null_resource" "manage_certs" {
+  triggers = {
+    devices = join(",", var.device_names)
+  }
+
+  # When a cert is REMOVED from the list, Terraform marks it for destruction.
+  # We use a 'destroy' provisioner to trigger the revocation in your CRL.
+  provisioner "local-exec" {
+    when    = destroy
+    command = <<EOT
+      openssl ca -config openssl.cnf -revoke ${self.id}.crt
+      openssl ca -config openssl.cnf -gencrl -out MyPrivateCA.crl
+    EOT
+  }
+
+  # When a cert is ADDED, create the physical files and the .p12
+  provisioner "local-exec" {
+    command = "openssl ca -config openssl.cnf -gencrl -out MyPrivateCA.crl"
+  }
+}
+
+## 5. Output the .p12 files (Simplified example)
+#resource "local_file" "cert_files" {
+#  for_each = var.device_names
+#  content  = tls_locally_signed_cert.device_cert[each.key].cert_pem
+#  filename = "${path.module}/output/${each.key}.crt"
+#}
+# 2. Save the certificate temporarily
+resource "local_file" "tmp_cert" {
+  for_each = var.device_names
+  content  = tls_locally_signed_cert.device_cert[each.key].cert_pem
+  filename = "${path.module}/output/${each.key}.crt"
+}
+
+# 3. Create the .p12 bundle using local-exec
+resource "null_resource" "create_p12" {
+  for_each = var.device_names
+
+  # This ensures the command runs if the cert or key changes
+  triggers = {
+    cert_id = tls_locally_signed_cert.device_cert[each.key].id
+  }
+
+  provisioner "local-exec" {
+    command = <<EOT
+      openssl pkcs12 -export \
+      -out ${path.module}/output/${each.key}.p12 \
+      -inkey ${path.module}/output/${each.key}.key \
+      -in ${path.module}/output/${each.key}.crt \
+      -certfile ${path.module}/MyPrivateCA.crt \
+      -passout pass:YourSecretPassword123
+    EOT
+  }
+
+  # Clean up the raw .key file afterward for security if you like
+  # (Optional: Comment out if you want to keep the .key file)
+  provisioner "local-exec" {
+    command = "rm ${path.module}/output/${each.key}.key"
+  }
+
+  depends_on = [
+    local_sensitive_file.tmp_key,
+    local_file.tmp_cert
+  ]
+}