51 lines
2.4 KiB
Plaintext
51 lines
2.4 KiB
Plaintext
|
|
17 mkdir /etc/docker/tls
|
|
18 cd /etc/docker/tls
|
|
19 openssl genrsa -out server-key.pem 4096
|
|
20 dnf install openssl
|
|
21 openssl genrsa -out server-key.pem 4096
|
|
22 openssl genrsa -aes256 -out ca-key.pem 4096
|
|
23 openssl req -new -x509 -days 365 -key ca-key.pem -sha256 -out ca.pem
|
|
24 openssl genrsa -out key.pem 4096
|
|
25 openssl genrsa -out server-key.pem 4096
|
|
26 openssl req -subj "/CN=dev01.tnt.local" -sha256 -new -key server-key.pem -out server.csr
|
|
27 echo subjectAltName = DNS:dev01.tnt.local,IP:10.2.24.21,IP:127.0.0.1 >> extfile.cnf
|
|
28 echo extendedKeyUsage = serverAuth >> extfile.cnf
|
|
29 openssl x509 -req -days 365 -sha256 -in server.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out server-cert.pem -extfile extfile.cnf
|
|
30 openssl genrsa -out key.pem 4096
|
|
31 openssl req -subj '/CN=client' -new -key key.pem -out client.csr
|
|
32 echo extendedKeyUsage = clientAuth > extfile-client.cnf
|
|
33 openssl x509 -req -days 365 -sha256 -in client.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out cert.pem -extfile extfile-client.cnf
|
|
34 rm -v client.csr server.csr extfile.cnf extfile-client.cnf
|
|
35 chmod -v 0400 ca-key.pem key.pem server-key.pem
|
|
36 chmod -v 0444 ca.pem server-cert.pem cert.pem
|
|
37 systemctl cat docker
|
|
38 mcedit /lib/systemd/system/docker.service
|
|
39 systemctl stop docker
|
|
40 mcedit /lib/systemd/system/docker.service
|
|
41 systemctl daemon-reload
|
|
42 systemctl start docker
|
|
43 systemctl status docker
|
|
44 cat /etc/docker/tls/ca.pem
|
|
45 cat etc/docker/tls/server-cert.pem
|
|
46 cat /etc/docker/tls/server-cert.pem
|
|
47 cat /etc/docker/tls/key.pem
|
|
48 cat /etc/docker/tls/ca.pem
|
|
49 ls -la
|
|
50 cat cert.pem
|
|
51 cat /etc/docker/tls/key.pem
|
|
|
|
|
|
|
|
mcedit /lib/systemd/system/docker.service
|
|
[Service]
|
|
Type=notify
|
|
# the default is not to use systemd for cgroups because the delegate issues still
|
|
# exists and systemd currently does not support the cgroup feature set required
|
|
# for containers run by docker
|
|
#ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock
|
|
ExecStart=/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --tlsverify --tlscacert=/etc/docker/tls/ca.pem --tlscert=/etc/docker/tls/server-cert.pem --tlskey=/etc/docker/tls/server-key.pem -H=0.0.0.0:2376
|
|
ExecReload=/bin/kill -s HUP $MAINPID
|
|
TimeoutSec=0
|
|
RestartSec=2
|
|
Restart=always |