95 lines
2.3 KiB
Bash
Executable File
95 lines
2.3 KiB
Bash
Executable File
#!/bin/bash
|
|
# ==============================================================================
|
|
# 03-configure-identity.sh
|
|
#
|
|
# Configure identity behavior for single-node sys-fips.
|
|
#
|
|
# Usage:
|
|
# sudo bash 03-configure-identity.sh
|
|
# ==============================================================================
|
|
set -euo pipefail
|
|
|
|
CONFIG_FILE="/etc/fips/fips.yaml"
|
|
|
|
echo "=== FIPS Identity Configuration ==="
|
|
echo ""
|
|
|
|
if [ "$(id -u)" -ne 0 ]; then
|
|
echo "✗ Run as root: sudo bash 03-configure-identity.sh"
|
|
exit 1
|
|
fi
|
|
|
|
if [ ! -f "$CONFIG_FILE" ]; then
|
|
echo "✗ $CONFIG_FILE not found"
|
|
echo " Run: sudo bash 02-install-fips.sh"
|
|
exit 1
|
|
fi
|
|
|
|
if [ -f /etc/fips/fips.pub ]; then
|
|
echo "Current identity detected:"
|
|
echo " npub: $(cat /etc/fips/fips.pub)"
|
|
echo ""
|
|
fi
|
|
|
|
echo "Identity modes:"
|
|
echo " 1) persistent (recommended): key auto-generated once and reused"
|
|
echo " 2) explicit nsec: pin node identity to a specific key"
|
|
echo ""
|
|
|
|
read -r -p "Select mode [1/2] (default 1): " MODE
|
|
MODE="${MODE:-1}"
|
|
|
|
set_identity_block() {
|
|
local identity_line="$1"
|
|
local tmp
|
|
tmp=$(mktemp)
|
|
|
|
# Replace node.identity block in known config format: node: ... then tun:
|
|
awk -v ident="$identity_line" '
|
|
BEGIN { replaced=0; skipping=0 }
|
|
/^node:[[:space:]]*$/ && replaced==0 {
|
|
print "node:";
|
|
print " identity:";
|
|
print " " ident;
|
|
replaced=1;
|
|
skipping=1;
|
|
next;
|
|
}
|
|
skipping==1 {
|
|
if (/^tun:[[:space:]]*$/) {
|
|
skipping=0;
|
|
print $0;
|
|
}
|
|
next;
|
|
}
|
|
{ print $0 }
|
|
' "$CONFIG_FILE" > "$tmp"
|
|
|
|
mv "$tmp" "$CONFIG_FILE"
|
|
chmod 600 "$CONFIG_FILE"
|
|
}
|
|
|
|
case "$MODE" in
|
|
1)
|
|
set_identity_block "persistent: true"
|
|
echo "✓ Set node.identity.persistent=true"
|
|
;;
|
|
2)
|
|
read -r -p "Enter nsec (bech32 or 64-char hex): " NSEC
|
|
if [ -z "$NSEC" ]; then
|
|
echo "✗ Empty nsec is not allowed"
|
|
exit 1
|
|
fi
|
|
set_identity_block "nsec: \"$NSEC\""
|
|
echo "✓ Set node.identity.nsec"
|
|
;;
|
|
*)
|
|
echo "✗ Invalid selection"
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
echo ""
|
|
echo "Config updated: $CONFIG_FILE"
|
|
echo "Next: sudo bash 04-start-fips.sh"
|