secubox/secubox-deb
1
0
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-29 22:07:24 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix: Generate SSL certs BEFORE SecuBox package install

Browse Source 
Package postinst scripts check nginx config which requires SSL certs.
Moving cert generation to before dpkg install prevents postinst failures.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
CyberMind-FR 2026-04-07 08:09:35 +02:00
parent 5a58dd2bdf
commit dd46b6e7e7
1 changed files with 25 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
image/build-rpi-usb.sh
View File

@ -580,6 +580,30 @@ chroot "${ROOTFS}" apt-get install -y -q --no-install-recommends \
raspi-firmware firmware-brcm80211 firmware-misc-nonfree \
2>/dev/null || warn "Some firmware unavailable"
# ── Pre-generate SSL certificates for nginx (BEFORE package install) ────
# Packages' postinst scripts check for nginx/certs, so create them first
log "Pre-generating SSL certificates..."
mkdir -p "${ROOTFS}/etc/secubox/tls"
mkdir -p "${ROOTFS}/run/secubox"
mkdir -p "${ROOTFS}/var/lib/secubox"
mkdir -p "${ROOTFS}/etc/nginx/secubox.d"
# Generate on host system (chroot may lack /dev/urandom)
openssl req -x509 -newkey rsa:2048 -days 365 \
-keyout "${ROOTFS}/etc/secubox/tls/key.pem" \
-out "${ROOTFS}/etc/secubox/tls/cert.pem" \
-nodes -subj "/CN=secubox-rpi/O=CyberMind SecuBox/C=FR" \
-addext "subjectAltName=DNS:localhost,DNS:secubox.local,IP:127.0.0.1,IP:192.168.1.1" \
2>/dev/null
if [[ -f "${ROOTFS}/etc/secubox/tls/cert.pem" ]]; then
chmod 640 "${ROOTFS}/etc/secubox/tls/key.pem"
chmod 644 "${ROOTFS}/etc/secubox/tls/cert.pem"
ok "SSL certificates pre-generated"
else
warn "SSL cert generation failed"
fi
# SecuBox packages installation
install -d "${ROOTFS}/tmp/secubox-debs"
DEBS_INSTALLED=0
@ -645,31 +669,7 @@ rm -rf "${ROOTFS}/var/lib/apt/lists"/*
ok "SecuBox packages installed"
# ── Pre-generate SSL certificates for nginx ─────────────────────────
# (firstboot normally does this, but nginx needs certs to start)
# Generate certs on HOST (chroot may lack /dev/urandom) and copy them in
log "Pre-generating SSL certificates..."
mkdir -p "${ROOTFS}/etc/secubox/tls"
mkdir -p "${ROOTFS}/run/secubox"
mkdir -p "${ROOTFS}/var/lib/secubox"
# Generate on host system
openssl req -x509 -newkey rsa:2048 -days 365 \
-keyout "${ROOTFS}/etc/secubox/tls/key.pem" \
-out "${ROOTFS}/etc/secubox/tls/cert.pem" \
-nodes -subj "/CN=secubox-rpi/O=CyberMind SecuBox/C=FR" \
-addext "subjectAltName=DNS:localhost,DNS:secubox.local,IP:127.0.0.1,IP:192.168.1.1" \
2>/dev/null
if [[ -f "${ROOTFS}/etc/secubox/tls/cert.pem" ]]; then
chmod 640 "${ROOTFS}/etc/secubox/tls/key.pem"
chmod 644 "${ROOTFS}/etc/secubox/tls/cert.pem"
ok "SSL certificates pre-generated"
else
warn "SSL cert generation failed - nginx may not start"
fi
# Enable nginx for API proxying
# Enable nginx for API proxying (certs already generated earlier)
ln -sf /usr/lib/systemd/system/nginx.service \
"${ROOTFS}/etc/systemd/system/multi-user.target.wants/nginx.service" 2>/dev/null || true