TNT/devops
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add docker/mTLS

Browse Source
This commit is contained in:
pashko 2025-06-06 11:43:06 +08:00
parent cf998c3146
commit 22529fd6cc
1 changed files with 51 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

51
docker/mTLS Normal file
View File

@ -0,0 +1,51 @@
17 mkdir /etc/docker/tls
18 cd /etc/docker/tls
19 openssl genrsa -out server-key.pem 4096
20 dnf install openssl
21 openssl genrsa -out server-key.pem 4096
22 openssl genrsa -aes256 -out ca-key.pem 4096
23 openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -out ca.pem
24 openssl genrsa -out key.pem 4096
25 openssl genrsa -out server-key.pem 4096
26 openssl req -subj "/CN=dev01.tnt.local" -sha256 -new -key server-key.pem -out server.csr
27 echo subjectAltName = DNS:dev01.tnt.local,IP:10.2.24.21,IP:127.0.0.1 >> extfile.cnf
28 echo extendedKeyUsage = serverAuth >> extfile.cnf
29 openssl x509 -req -days 365 -sha256 -in server.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem -extfile extfile.cnf
30 openssl genrsa -out key.pem 4096
31 openssl req -subj '/CN=client' -new -key key.pem -out client.csr
32 echo extendedKeyUsage = clientAuth > extfile-client.cnf
33 openssl x509 -req -days 365 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out cert.pem -extfile extfile-client.cnf
34 rm -v client.csr server.csr extfile.cnf extfile-client.cnf
35 chmod -v 0400 ca-key.pem key.pem server-key.pem
36 chmod -v 0444 ca.pem server-cert.pem cert.pem
37 systemctl cat docker
38 mcedit /lib/systemd/system/docker.service
39 systemctl stop docker
40 mcedit /lib/systemd/system/docker.service
41 systemctl daemon-reload
42 systemctl start docker
43 systemctl status docker
44 cat /etc/docker/tls/ca.pem
45 cat etc/docker/tls/server-cert.pem
46 cat /etc/docker/tls/server-cert.pem
47 cat /etc/docker/tls/key.pem
48 cat /etc/docker/tls/ca.pem
49 ls -la
50 cat cert.pem
51 cat /etc/docker/tls/key.pem
mcedit /lib/systemd/system/docker.service
[Service]
Type=notify
# the default is not to use systemd for cgroups because the delegate issues still
# exists and systemd currently does not support the cgroup feature set required
# for containers run by docker
#ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock
ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --tlsverify --tlscacert=/etc/docker/tls/ca.pem --tlscert=/etc/docker/tls/server-cert.pem --tlskey=/etc/docker/tls/server-key.pem -H=0.0.0.0:2376
ExecReload=/bin/kill -s HUP $MAINPID
TimeoutSec=0
RestartSec=2
Restart=always