From e273e97d9cfa1fb351743ae4db4227e2ee6a368d Mon Sep 17 00:00:00 2001
From: Martin Lablans <6804500+lablans@users.noreply.github.com>
Date: Mon, 17 Oct 2022 14:38:34 +0200
Subject: [PATCH] Certificate enrollment (#24)

---
 bridgehead           |  8 ++++++++
 ccp/vars             |  2 ++
 lib/functions.sh     |  2 +-
 lib/prerequisites.sh | 11 ++++++++++-
 4 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/bridgehead b/bridgehead
index 5c7d121..5548a7d 100755
--- a/bridgehead
+++ b/bridgehead
@@ -77,6 +77,14 @@ case "$ACTION" in
 	uninstall)
 		exec ./lib/remove-bridgehead-units.sh $PROJECT
 		;;
+	enroll)
+		if [ -e $PRIVATEKEYFILENAME ]; then
+			echo "Private key already exists at $PRIVATEKEYFILENAME. Please delete first to proceed."
+			exit 1
+		fi
+		docker run --rm -ti -v /etc/bridgehead/pki:/etc/bridgehead/pki samply/beam-enroll:latest --output-file $PRIVATEKEYFILENAME --proxy-id $PROXY_ID --admin-email $SUPPORT_EMAIL
+		chmod 600 $PRIVATEKEYFILENAME
+		;;
 	preRun | preUpdate)
 		fixPermissions
 		;;
diff --git a/ccp/vars b/ccp/vars
index 4152fa4..ce12d1a 100644
--- a/ccp/vars
+++ b/ccp/vars
@@ -5,3 +5,5 @@ SPOT_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | he
 SPOT_BEAM_SECRET_LONG="ApiKey spot.${PROXY_ID} ${SPOT_BEAM_SECRET_SHORT}"
 REPORTHUB_BEAM_SECRET_SHORT="$(cat /proc/sys/kernel/random/uuid | sed 's/[-]//g' | head -c 20)"
 REPORTHUB_BEAM_SECRET_LONG="ApiKey report-hub.${PROXY_ID} ${REPORTHUB_BEAM_SECRET_SHORT}"
+SUPPORT_EMAIL=support-ccp@dkfz-heidelberg.de
+PRIVATEKEYFILENAME=/etc/bridgehead/pki/${SITE_ID}.priv.pem
diff --git a/lib/functions.sh b/lib/functions.sh
index ded0cd9..5059829 100755
--- a/lib/functions.sh
+++ b/lib/functions.sh
@@ -19,7 +19,7 @@ checkOwner(){
 }
 
 printUsage() {
-	echo "Usage: bridgehead start|stop|update|install|uninstall PROJECTNAME"
+	echo "Usage: bridgehead start|stop|update|install|uninstall|enroll PROJECTNAME"
 	echo "PROJECTNAME should be one of ccp|nngm|gbn"
 }
 
diff --git a/lib/prerequisites.sh b/lib/prerequisites.sh
index f4fd3be..2709a6f 100755
--- a/lib/prerequisites.sh
+++ b/lib/prerequisites.sh
@@ -43,7 +43,7 @@ fi
 
 # TODO: Make sure you're in the right directory, or, even better, be independent from the working directory.
 
-log INFO "Checking ssl cert"
+log INFO "Checking ssl cert for accessing bridgehead via https"
 
 if [ ! -d "certs" ]; then
   log WARN "TLS cert missing, we'll now create a self-signed one. Please consider getting an officially signed one (e.g. via Let's Encrypt ...)"
@@ -60,6 +60,15 @@ if [ -e /etc/bridgehead/vault.conf ]; then
 	fi
 fi
 
+log INFO "Checking your beam proxy private key"
+
+if [ -e /etc/bridgehead/pki/${SITE_ID}.priv.pem ]; then
+	log INFO "Success - private key found."
+else
+	log ERROR "Unable to find private key at /etc/bridgehead/pki/${SITE_ID}.priv.pem. To fix, please run bridgehead enroll ${PROJECT} and follow the instructions".
+	exit 1
+fi
+
 log INFO "Success - all prerequisites are met!"
 hc_send log "Success - all prerequisites are met!"