1
+ .DELETE_ON_ERROR :
2
+
1
3
STEP_VERSION =0.15.3
2
4
3
5
export STEPPATH =${PWD}/data/.step
4
6
5
7
.PHONY : help
6
8
help :
7
9
@echo " Comandi disponibili:"
8
- @grep -E ' ^[a-zA-Z0-9_-]+:.*?## .*$$' $(MAKEFILE_LIST ) | sort | awk ' BEGIN {FS = ":.*?## "}; {printf "\033[32m%-30s\033[0m %s\n", $$1, $$2}'
10
+ @grep -E ' ^[a-zA-Z0-9_-]+:.*?## .*$$' $(MAKEFILE_LIST ) | awk ' BEGIN {FS = ":.*?## "}; {printf "\033[32m%-30s\033[0m %s\n", $$1, $$2}'
9
11
10
12
data/step-${STEP_VERSION}.tgz :
11
13
rm -frv data/step*
12
14
wget -O data/step-${STEP_VERSION} .tgz https://github.com/smallstep/cli/releases/download/v${STEP_VERSION} /step_linux_${STEP_VERSION} _amd64.tar.gz
13
15
tar -C data -xf data/step-${STEP_VERSION} .tgz
14
16
ln -s step_${STEP_VERSION} /bin/step data/step
15
17
16
- data/.step/config/defaults.json : data/step-${STEP_VERSION}.tgz
18
+ data/step : data/step-${STEP_VERSION}.tgz
19
+
20
+ configs-plain/files.tar : data/step configs-cipher/files.tar.jwe
21
+ data/step crypto jwe decrypt \
22
+ < configs-cipher/files.tar.jwe \
23
+ > configs-plain/files.tar
24
+ tar xv \
25
+ --directory configs-plain/ \
26
+ --file configs-plain/files.tar
27
+
28
+ data/.step/config/defaults.json : data/step-${STEP_VERSION}.tgz configs-plain/files.tar
17
29
data/step ca bootstrap --force \
18
- --ca-url $(file < configs/ca-url) \
19
- --fingerprint $(file < configs/ca-fingerprint)
30
+ --ca-url $(file < configs-plain /ca-url) \
31
+ --fingerprint $(file < configs-plain /ca-fingerprint)
20
32
21
33
data/user_email :
22
34
systemd-ask-password --echo " Inserisci la tua email Confinet:" > data/user_email
23
35
24
- data/TOKEN : data/.step/config/defaults.json
25
- rm -f data/TOKEN
36
+ data/TOKEN : data/.step/config/defaults.json configs-plain/files.tar data/user_email
26
37
step oauth \
27
38
--oidc \
28
39
--bare \
29
- --client-id $(file < configs/client-id) \
30
- --client-secret $(file < configs/client-secret) \
40
+ --client-id $(file < configs-plain /client-id) \
41
+ --client-secret $(file < configs-plain /client-secret) \
31
42
--email $(file < data/user_email) \
32
43
> data/TOKEN
33
44
@@ -41,8 +52,8 @@ data/.step/user.crt: data/user_email data/TOKEN
41
52
data/.step/user.key
42
53
rm -f data/TOKEN
43
54
44
- data/pfext01-step.ovpn : data/.step/user.crt
45
- cp -a configs/pfext01-step.ovpn data/pfext01-step.ovpn.tmp
55
+ data/pfext01-step.ovpn : data/.step/config/defaults.json data/.step/ user.crt configs-plain/files.tar
56
+ cp -a configs-plain /pfext01-step.ovpn data/pfext01-step.ovpn.tmp
46
57
echo " <ca>" >> data/pfext01-step.ovpn.tmp
47
58
cat data/.step/certs/root_ca.crt >> data/pfext01-step.ovpn.tmp
48
59
echo " </ca>" >> data/pfext01-step.ovpn.tmp
@@ -64,8 +75,18 @@ import-pfext01-step-openvpn: data/pfext01-step.ovpn ## Importa configurazione VP
64
75
-echo -e " set ipv4.never-default yes\nsave\nquit" \
65
76
| nmcli connection edit pfext01-step
66
77
67
- ok : data/pfext01-step.ovpn
68
- data/step
78
+ .PHONY : encrypt-configs
79
+ encrypt-configs : data/step # # Cifra le configurazioni modificate
80
+ tar cvp \
81
+ --directory configs-plain/ \
82
+ --file configs-plain/files.tar \
83
+ --exclude ./files.tar \
84
+ --exclude ./.gitignore \
85
+ ./
86
+ data/step crypto jwe encrypt --alg PBES2-HS512+A256KW \
87
+ < configs-plain/files.tar \
88
+ > configs-cipher/files.tar.jwe
89
+ rm configs-plain/files.tar
69
90
70
91
.PHONY : clean
71
92
clean :
0 commit comments