113 lines
3.3 KiB
Terraform
113 lines
3.3 KiB
Terraform
variable "device_names" {
|
|
type = set(string)
|
|
default = []
|
|
}
|
|
|
|
# 1. Generate Private Keys for each device
|
|
resource "tls_private_key" "device_key" {
|
|
for_each = var.device_names
|
|
algorithm = "RSA"
|
|
rsa_bits = 2048
|
|
}
|
|
|
|
# 1. Save the private key temporarily (needed for the openssl command)
|
|
resource "local_sensitive_file" "tmp_key" {
|
|
for_each = var.device_names
|
|
content = tls_private_key.device_key[each.key].private_key_pem
|
|
filename = "${path.module}/output/${each.key}.key"
|
|
}
|
|
|
|
# 2. Create Certificate Signing Requests (CSR)
|
|
resource "tls_cert_request" "device_csr" {
|
|
for_each = var.device_names
|
|
private_key_pem = tls_private_key.device_key[each.key].private_key_pem
|
|
|
|
subject {
|
|
common_name = each.key
|
|
organization = "My Home Lab"
|
|
}
|
|
}
|
|
|
|
# 3. Sign the Certificates using your existing CA
|
|
# Note: You need your CA cert and key available as files
|
|
resource "tls_locally_signed_cert" "device_cert" {
|
|
for_each = var.device_names
|
|
cert_request_pem = tls_cert_request.device_csr[each.key].cert_request_pem
|
|
ca_private_key_pem = file("${path.module}/MyPrivateCA.key")
|
|
ca_cert_pem = file("${path.module}/MyPrivateCA.crt")
|
|
|
|
validity_period_hours = 8760 # 1 year
|
|
allowed_uses = [
|
|
"client_auth",
|
|
"digital_signature",
|
|
]
|
|
}
|
|
|
|
# 4. EXPORT: Generate the .p12 and the CRL automatically
|
|
# This runs every time a cert is added OR removed
|
|
resource "null_resource" "manage_certs" {
|
|
triggers = {
|
|
devices = join(",", var.device_names)
|
|
}
|
|
|
|
# When a cert is REMOVED from the list, Terraform marks it for destruction.
|
|
# We use a 'destroy' provisioner to trigger the revocation in your CRL.
|
|
provisioner "local-exec" {
|
|
when = destroy
|
|
command = <<EOT
|
|
openssl ca -config openssl.cnf -revoke ${self.id}.crt
|
|
openssl ca -config openssl.cnf -gencrl -out MyPrivateCA.crl
|
|
EOT
|
|
}
|
|
|
|
# When a cert is ADDED, create the physical files and the .p12
|
|
provisioner "local-exec" {
|
|
command = "openssl ca -config openssl.cnf -gencrl -out MyPrivateCA.crl"
|
|
}
|
|
}
|
|
|
|
## 5. Output the .p12 files (Simplified example)
|
|
#resource "local_file" "cert_files" {
|
|
# for_each = var.device_names
|
|
# content = tls_locally_signed_cert.device_cert[each.key].cert_pem
|
|
# filename = "${path.module}/output/${each.key}.crt"
|
|
#}
|
|
# 2. Save the certificate temporarily
|
|
resource "local_file" "tmp_cert" {
|
|
for_each = var.device_names
|
|
content = tls_locally_signed_cert.device_cert[each.key].cert_pem
|
|
filename = "${path.module}/output/${each.key}.crt"
|
|
}
|
|
|
|
# 3. Create the .p12 bundle using local-exec
|
|
resource "null_resource" "create_p12" {
|
|
for_each = var.device_names
|
|
|
|
# This ensures the command runs if the cert or key changes
|
|
triggers = {
|
|
cert_id = tls_locally_signed_cert.device_cert[each.key].id
|
|
}
|
|
|
|
provisioner "local-exec" {
|
|
command = <<EOT
|
|
openssl pkcs12 -export \
|
|
-out ${path.module}/output/${each.key}.p12 \
|
|
-inkey ${path.module}/output/${each.key}.key \
|
|
-in ${path.module}/output/${each.key}.crt \
|
|
-certfile ${path.module}/MyPrivateCA.crt \
|
|
-passout pass:YourSecretPassword123
|
|
EOT
|
|
}
|
|
|
|
# Clean up the raw .key file afterward for security if you like
|
|
# (Optional: Comment out if you want to keep the .key file)
|
|
provisioner "local-exec" {
|
|
command = "rm ${path.module}/output/${each.key}.key"
|
|
}
|
|
|
|
depends_on = [
|
|
local_sensitive_file.tmp_key,
|
|
local_file.tmp_cert
|
|
]
|
|
}
|