update certs

docs/updating-ca.md

@@ -0,0 +1,47 @@
+# Updating CA
+
+## What is it?
+
+My client auth CA expired after 5 years and I needed to either reissue the CA or make a new one.
+
+The original one was built using cfssl.
+I decided that I would work with the CLI tools I've built in rust instead, and so instead of trying to
+renew the cert, I just built a new CA from scratch.
+
+Here is how.
+
+## Make the CA
+
+```
+cd ~/Develop/jpace121-certificate-authority
+j7s_mk_ca --org-name "jpace121.net CA" --valid-length 36500 -o ca
+```
+
+## Tell Nginx
+
+```
+scp ca/cert.pem admin@vpn.jpace121.net:/etc/nginx/client-truststores/jpace121-ca.pem
+```
+Then restart nginx.
+
+## Tell Keycloak
+
+```
+base64 -w 0 ca/cert.pem
+```
+
+Copy to keycloak-config.yaml.
+
+Deploy.
+
+```
+export KUBECONFIG=~/.kube/infra.yaml
+kubectl apply -f keycloak-config.yaml
+kubectl apply -f deployment.yaml
+kubectl rollout restart deployment keycloak-deployment -n keycloak
+```
+
+Watch the logs:
+```
+kubectl logs -n keycloak deployment/keycloak-deployment keycloak
+```

infra-cluster/keycloak/manifests/deployment.yaml

@@ -61,10 +61,8 @@ spec:
           value: "nginx"
         - name: KC_SPI_X509CERT_LOOKUP__NGINX__SSL_CLIENT_CERT
           value: "ssl-client-cert"
-        - name: KC_SPI_TRUSTSTORE__FILE__PASSWORD
-          value: "password"
-        - name: KC_SPI_TRUSTSTORE__FILE__FILE
-          value: "/opt/keycloak-config/truststore.jks"
+        - name: KC_TRUSTSTORE_PATHS
+          value: "/opt/keycloak-config/jpace121-ca.pem"
         - name: KC_HTTPS_CLIENT_AUTH
           value: "request"
         - name: KC_HOSTNAME

infra-cluster/keycloak/manifests/keycloak-config.yaml

@@ -5,4 +5,4 @@ metadata:
   namespace: keycloak
 apiVersion: v1
 binaryData:
-  truststore.jks: MIIC4gIBAzCCAowGCSqGSIb3DQEHAaCCAn0EggJ5MIICdTCCAnEGCSqGSIb3DQEHBqCCAmIwggJeAgEAMIICVwYJKoZIhvcNAQcBMGYGCSqGSIb3DQEFDTBZMDgGCSqGSIb3DQEFDDArBBR06xf6EozPqDQ/xzGXp40CBqhk+AICJxACASAwDAYIKoZIhvcNAgkFADAdBglghkgBZQMEASoEEFizOH2LYOBzcHQsXzKXTJaAggHgiX6o5k8bo8w5RiwFngx7snUOMw9eYheq8YgkhuUhLgnx2uxYcw3ajFXYXuq/M6a5vXjQ7bLpeoidY9YdBl74UZjXEbLnTnWQQjjjoMIhBImmMe4ycxbRJ56EAJ4XDPhMwjf1dsGnCL1LX4KHNqVmHSGdkNJSB+PeU4Z6NrdO6sD9LPgaSTTq5b1czv3I8vH5aY/sT+8U4JR+P7xjNzobHzK2L+zcNTS1Hu29qYllQNsfks3gBsJn2Gmdw8NZXrRXCZZXQt7G4mqdPMuLrkd1pTjndYhsMHFMKA67WhNQe14UMlWPKpAPZ2nnS8x+AIVz2H5mQldVEXdeZDvujLYzRp5LyLwEYRHTIMEahGE0d9BIkijJ6kc5hGpF1IRlimVhZDowvX9sbtjHWgJdo5Gm3UEfSTQ9FSB7E8D11MbNZcaqbJcrK8GwKJHnSokCApaJ/Q2eat7YhhWJ/AkveXF0JYd8VPn4BTeOmukr+uZKzRPRoNyvG3orQYm78gJhmMqloHzI4f1VL68h+80VHtt2m+p99p3ZswyYh9dMhpdEue94VSCaMN9ZpEDB7RTYC6O0ZkVdd4uo6Kmu8MGhF8KQEBBCHKqL8ONVXFAcTzF1g5h8h644G29OmqXiro/Dy/gVME0wMTANBglghkgBZQMEAgEFAAQgGlefxTaHIgl4GJ5h3SQvPJSGNfFH2tCI9jtTh4U8KjEEFATo1+WMtc4hIa6Jt1vjX5YGS5mmAgInEA==
+  jpace121-ca.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJsVENDQVRxZ0F3SUJBZ0lVWUc1c2tnbTJoQUtKWXlwa01ldFhZU0FMaEl3d0NnWUlLb1pJemowRUF3SXcKSnpFWU1CWUdBMVVFQ2d3UGFuQmhZMlV4TWpFdWJtVjBJRU5CTVFzd0NRWURWUVFEREFKRFFUQWdGdzB5TmpFdwpNVEF4TlRVeE5EQmFHQTh5TVRJMk1Ea3hOakUxTlRFME1Gb3dKekVZTUJZR0ExVUVDZ3dQYW5CaFkyVXhNakV1CmJtVjBJRU5CTVFzd0NRWURWUVFEREFKRFFUQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJBakUKdEpVSFZqbTl3eWRuUnhXbFd6U3lKTWRNMGVIbjNSNGZ2STFYbE1uU2VYOXlQN2VxU3pXRm4ydmZvbTJJaCtJUAozK2tRNlVkeCtVaE1UK2h2ZGJ5alFqQkFNQTRHQTFVZER3RUIvd1FFQXdJQmhqQWRCZ05WSFE0RUZnUVVDalI2CkJDQ0huSk5RRXFlK3FmOGZqQjI3bEZBd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBS0JnZ3Foa2pPUFFRREFnTkoKQURCR0FpRUE0VTJmVldIeUIyODdyT2gwMFo1L3lSYlBqNVpoWDg3U3JwSTVHN2k3b0NRQ0lRRFJ3WmlxYmRsRQptaGZiSC94Rm1VemY5TExzYVArbGpzU2VjcytYU1pES2dRPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=