Initial commit - Phase 3/4

🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-06 13:45:29 -08:00
parent 1da6730735
commit 4f35df1781
323 changed files with 98287 additions and 1195 deletions
--- a/scripts/generate-ssl-cert.sh
+++ b/scripts/generate-ssl-cert.sh
@@ -0,0 +1,114 @@
+#!/bin/bash
+# Generate self-signed SSL certificate for Dangerous Pi
+# Supports first-boot auto-generation or manual regeneration
+
+set -e
+
+# Configuration
+CERT_DIR="/opt/dangerous-pi/ssl"
+CERT_FILE="$CERT_DIR/dangerous-pi.crt"
+KEY_FILE="$CERT_DIR/dangerous-pi.key"
+DAYS_VALID=3650  # 10 years
+
+# Certificate subject
+SUBJECT="/CN=Dangerous Pi/O=Dangerous Pi/C=US"
+
+# Subject Alternative Names (SANs)
+# - The AP gateway IP
+# - mDNS hostname
+# - Bare hostname
+# - Localhost for development
+SANS="IP:192.168.4.1,DNS:dangerous-pi.local,DNS:dangerous-pi,DNS:localhost,IP:127.0.0.1"
+
+usage() {
+    echo "Usage: $0 [OPTIONS]"
+    echo ""
+    echo "Generate self-signed SSL certificate for Dangerous Pi HTTPS."
+    echo ""
+    echo "Options:"
+    echo "  --force     Regenerate certificate even if one exists"
+    echo "  --cert-dir  Specify certificate directory (default: $CERT_DIR)"
+    echo "  --help      Show this help message"
+    echo ""
+    echo "The certificate will be valid for:"
+    echo "  - 192.168.4.1 (AP gateway IP)"
+    echo "  - dangerous-pi.local (mDNS hostname)"
+    echo "  - dangerous-pi (bare hostname)"
+    echo "  - localhost"
+}
+
+FORCE=false
+
+# Parse arguments
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        --force)
+            FORCE=true
+            shift
+            ;;
+        --cert-dir)
+            CERT_DIR="$2"
+            CERT_FILE="$CERT_DIR/dangerous-pi.crt"
+            KEY_FILE="$CERT_DIR/dangerous-pi.key"
+            shift 2
+            ;;
+        --help)
+            usage
+            exit 0
+            ;;
+        *)
+            echo "Unknown option: $1"
+            usage
+            exit 1
+            ;;
+    esac
+done
+
+# Create SSL directory if it doesn't exist
+mkdir -p "$CERT_DIR"
+
+# Check if certificate already exists
+if [ -f "$CERT_FILE" ] && [ "$FORCE" = false ]; then
+    echo "Certificate already exists at $CERT_FILE"
+    echo "Use --force to regenerate."
+    exit 0
+fi
+
+echo "Generating self-signed SSL certificate for Dangerous Pi..."
+echo "  Certificate: $CERT_FILE"
+echo "  Private key: $KEY_FILE"
+echo "  Validity: $DAYS_VALID days"
+echo ""
+
+# Generate private key and certificate with SANs
+# Using EC P-256 for better performance on Raspberry Pi
+openssl req -x509 -nodes -days "$DAYS_VALID" \
+    -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 \
+    -keyout "$KEY_FILE" \
+    -out "$CERT_FILE" \
+    -subj "$SUBJECT" \
+    -addext "subjectAltName=$SANS" \
+    -addext "basicConstraints=CA:FALSE" \
+    -addext "keyUsage=digitalSignature,keyEncipherment" \
+    -addext "extendedKeyUsage=serverAuth"
+
+# Set secure permissions
+# Private key: owner read/write only
+chmod 600 "$KEY_FILE"
+# Certificate: world readable
+chmod 644 "$CERT_FILE"
+
+# Set ownership to root
+if [ "$EUID" -eq 0 ]; then
+    chown root:root "$KEY_FILE" "$CERT_FILE"
+fi
+
+echo ""
+echo "SSL certificate generated successfully!"
+echo ""
+echo "Certificate details:"
+openssl x509 -in "$CERT_FILE" -noout -subject -dates -ext subjectAltName 2>/dev/null || \
+    openssl x509 -in "$CERT_FILE" -noout -subject -dates
+echo ""
+echo "To enable HTTPS, set HTTPS_ENABLED=true in /opt/dangerous-pi/.env"
+echo "Then restart the services: sudo systemctl restart dangerous-pi-nginx-config nginx"