From 18c6809b761bc6755349e1d7e08e74e857ec2c65 Mon Sep 17 00:00:00 2001
From: Chayim <chayim@users.noreply.github.com>
Date: Thu, 16 Dec 2021 09:36:56 +0200
Subject: Support for password-encrypted SSL private keys (#1782)

Adding support for SSL private keys with a password.  This PR also adds support for future SSL tests.
---
 docker/base/Dockerfile          |  1 +
 docker/base/Dockerfile.cluster  |  3 ++-
 docker/base/Dockerfile.sentinel |  1 +
 docker/base/Dockerfile.stunnel  | 11 ++++++++++
 docker/stunnel/conf/redis.conf  |  6 ++++++
 docker/stunnel/create_certs.sh  | 46 +++++++++++++++++++++++++++++++++++++++++
 6 files changed, 67 insertions(+), 1 deletion(-)
 create mode 100644 docker/base/Dockerfile.stunnel
 create mode 100644 docker/stunnel/conf/redis.conf
 create mode 100755 docker/stunnel/create_certs.sh

(limited to 'docker')

diff --git a/docker/base/Dockerfile b/docker/base/Dockerfile
index 60be374..c76d15d 100644
--- a/docker/base/Dockerfile
+++ b/docker/base/Dockerfile
@@ -1,3 +1,4 @@
+# produces redisfab/redis-py:6.2.6
 FROM redis:6.2.6-buster
 
 CMD ["redis-server", "/redis.conf"]
diff --git a/docker/base/Dockerfile.cluster b/docker/base/Dockerfile.cluster
index 70e8013..70df5ba 100644
--- a/docker/base/Dockerfile.cluster
+++ b/docker/base/Dockerfile.cluster
@@ -1,3 +1,4 @@
+# produces redisfab/redis-py-cluster:6.2.6
 FROM redis:6.2.6-buster
 
 COPY create_cluster.sh /create_cluster.sh
@@ -5,4 +6,4 @@ RUN chmod +x /create_cluster.sh
 
 EXPOSE 16379 16380 16381 16382 16383 16384
 
-CMD [ "/create_cluster.sh"]
\ No newline at end of file
+CMD [ "/create_cluster.sh"]
diff --git a/docker/base/Dockerfile.sentinel b/docker/base/Dockerfile.sentinel
index 93c16a7..ef659e3 100644
--- a/docker/base/Dockerfile.sentinel
+++ b/docker/base/Dockerfile.sentinel
@@ -1,3 +1,4 @@
+# produces redisfab/redis-py-sentinel:6.2.6
 FROM redis:6.2.6-buster
 
 CMD ["redis-sentinel", "/sentinel.conf"]
diff --git a/docker/base/Dockerfile.stunnel b/docker/base/Dockerfile.stunnel
new file mode 100644
index 0000000..bf45109
--- /dev/null
+++ b/docker/base/Dockerfile.stunnel
@@ -0,0 +1,11 @@
+# produces redisfab/stunnel:latest
+FROM ubuntu:18.04
+
+RUN apt-get update -qq --fix-missing
+RUN apt-get upgrade -qqy
+RUN apt install -qqy stunnel
+RUN mkdir -p /etc/stunnel/conf.d
+RUN echo "foreground = yes\ninclude = /etc/stunnel/conf.d" > /etc/stunnel/stunnel.conf
+RUN chown -R root:root /etc/stunnel/
+
+CMD ["/usr/bin/stunnel"]
diff --git a/docker/stunnel/conf/redis.conf b/docker/stunnel/conf/redis.conf
new file mode 100644
index 0000000..84f6d40
--- /dev/null
+++ b/docker/stunnel/conf/redis.conf
@@ -0,0 +1,6 @@
+[redis]
+accept = 6666
+connect = master:6379
+cert = /etc/stunnel/keys/server-cert.pem
+key = /etc/stunnel/keys/server-key.pem
+verify = 0
diff --git a/docker/stunnel/create_certs.sh b/docker/stunnel/create_certs.sh
new file mode 100755
index 0000000..f3bcea6
--- /dev/null
+++ b/docker/stunnel/create_certs.sh
@@ -0,0 +1,46 @@
+#!/bin/bash
+
+set -e
+
+DESTDIR=`dirname "$0"`/keys
+test -d ${DESTDIR} || mkdir ${DESTDIR}
+cd ${DESTDIR}
+
+SSL_SUBJECT="/C=CA/ST=Winnipeg/L=Manitoba/O=Some Corp/OU=IT Department/CN=example.com"
+which openssl &>/dev/null
+if [ $? -ne 0 ]; then
+	echo "No openssl binary present, exiting."
+	exit 1
+fi
+
+openssl genrsa -out ca-key.pem 2048 &>/dev/null
+
+openssl req -new -x509 -nodes -days 365000 \
+   -key ca-key.pem \
+   -out ca-cert.pem \
+   -subj "${SSL_SUBJECT}" &>/dev/null
+
+openssl req -newkey rsa:2048 -nodes -days 365000 \
+   -keyout server-key.pem \
+   -out server-req.pem \
+   -subj "${SSL_SUBJECT}" &>/dev/null
+
+openssl x509 -req -days 365000 -set_serial 01 \
+   -in server-req.pem \
+   -out server-cert.pem \
+   -CA ca-cert.pem \
+   -CAkey ca-key.pem &>/dev/null
+
+openssl req -newkey rsa:2048 -nodes -days 365000 \
+   -keyout client-key.pem \
+   -out client-req.pem \
+   -subj "${SSL_SUBJECT}" &>/dev/null
+
+openssl x509 -req -days 365000 -set_serial 01 \
+   -in client-req.pem \
+   -out client-cert.pem \
+   -CA ca-cert.pem \
+   -CAkey ca-key.pem &>/dev/null
+
+echo "Keys generated in ${DESTDIR}:"
+ls
-- 
cgit v1.2.1