feature(entrypoint): generate self-signed certificate

- generate via specific invocation
- auto-generate if SSL and no mounted certificate found
- allow specifying hostname for certificate

build/entrypoint.sh

@@ -6,10 +6,26 @@
 
 # functions
 certificateGenerateNew() {
-    certificateCheckEnabled
+    # generate self-signed certificate
     printf "\nGenerating new self-signed certificate:\n"
-    printf "Exporting new certificate:\n"
-    exit 0
+    # shellcheck disable=SC3028
+    if [ -z "$CERT_HOSTNAME" ]; then export CERT_HOSTNAME="$HOSTNAME"; fi
+    if ! openssl req -new -x509 -days 365 -nodes -out /certs/fullchain.pem -keyout /certs/privkey.pem -config /etc/selfsigned.cnf; then
+        printf "\nUnable to generate certificate. Is your 'certs' directory writable by this container?\n\n"
+        exit 55
+    fi
+    printf "Exporting pfx certificate..."
+    if ! openssl pkcs12 -export -in /certs/fullchain.pem -inkey /certs/privkey.pem -out "/certs/${CERT_HOSTNAME}.pfx" -name "LiveReload" -passout pass:cert1234; then
+        printf "\nUnable to export generated certificate as PFX.\n\n"
+        exit 56
+    fi
+
+    # print message to user
+    printf "\n\nA self-signed certificate has been generated and saved in the location mounted to '/certs' in this container.\n"
+    printf "The certificate and private key are PEM formatted with names 'fullchain.pem' and 'privkey.pem', respectively.\n"
+    printf "If you need to import them to a Windows machine, please use the '%s.pfx' file with password 'cert1234'.\n\n" "$CERT_HOSTNAME"
+
+    if [ "$1" != "noexit" ]; then exit 0; fi
 }
 
 certificateShow() {
@@ -25,7 +41,6 @@ certificateExport() {
 }
 
 certificateCheckEnabled() {
-    httpsEnabled="$(convertCaseUpper "$LR_HTTPS")"
     if [ "$httpsEnabled" != "TRUE" ]; then
         printf "\nSSL/TLS not enabled. Please set LR_HTTPS=TRUE if you want to enable SSL/TLS.\n"
         exit 1
@@ -42,6 +57,7 @@ doCertNew=0
 doCertShow=0
 doServer=0
 doShell=0
+httpsEnabled="$(convertCaseUpper "$LR_HTTPS")"
 
 # process action parameter
 case "$1" in
@@ -70,6 +86,29 @@ esac
 
 # action: run server
 if [ "$doServer" -eq 1 ]; then
+    printf "Starting LiveReload server:\n"
+
+    # https pre-flight check
+    if [ "$httpsEnabled" = "TRUE" ]; then
+        printf "[SSL/TLS mode enabled]\n"
+        if [ -n "$(find /certs/ -type d -empty -print)" ]; then
+            printf "[Generating certificate]\n"
+            # certs directory is empty --> auto-generate certificates
+            certificateGenerateNew 'noexit'
+        else
+            # certs directory contains certificates --> check if they can read
+            printf "[Checking mounted certificate]\n"
+            if ! [ -r "/certs/fullchain.pem" ]; then
+                printf "\nERROR: SSL/TLS mode selected but unable to read certificate!\n\n"
+                exit 51
+            fi
+            if ! [ -r "/certs/privkey.pem" ]; then
+                printf "\nERROR: SSL/TLS mode selected but unable to read private key!\n\n"
+                exit 52
+            fi
+        fi
+        printf "[Certificate OK]\n"
+    fi
     exec node livereload.js
     exit "$?"
 fi
@@ -102,6 +141,7 @@ exit 99
 # exit codes:
 # 0:   normal exit, no errors
 # 1:   invalid or invalid parameter passed to script
+# 2:   interactive shell required
 # 50:  certificate errors
 # 51:    unable to read certificate/chain
 # 52:    unable to read private key