keystore-init

#!/bin/bash

#cd "$( dirname "${BASH_SOURCE[0]}" )/.."

set -vx

cd "$(dirname "${BASH_SOURCE[0]}")/.."
. bin/util.sh

function createKeyStore() {
  keystorefile="$1"
  KEYTOOL_OPTS="-keystore ${keystorefile} -storepass radarbase -keypass radarbase $KEYSTORE_INIT_OPTS"

  if ! keytool -list $KEYTOOL_OPTS -alias radarbase-managementportal-ec >/dev/null 2>/dev/null; then
    KEYTOOL_CREATE_OPTS="-genkeypair -alias radarbase-managementportal-ec -keyalg EC -groupname secp256r1 -sigalg SHA256withECDSA -storetype PKCS12 $KEYSTORE_CREATE_OPTS"
    if [ -n "${MANAGEMENTPORTAL_KEY_DNAME}" ]; then
      KEYTOOL_CREATE_OPTS="$KEYTOOL_CREATE_OPTS -dname ${MANAGEMENTPORTAL_KEY_DNAME}"
    fi
    echo "--> Generating keystore to hold EC keypair for JWT signing"
    keytool $KEYTOOL_CREATE_OPTS $KEYTOOL_OPTS
  else
    echo "--> ECDSA keypair for signing JWTs already exists. Not creating a new one."
  fi

  if ! keytool -list $KEYTOOL_OPTS -alias selfsigned >/dev/null 2>/dev/null; then
    KEYTOOL_CREATE_OPTS="-genkeypair -alias selfsigned -keyalg RSA -keysize 4096 -storetype PKCS12 $KEYSTORE_CREATE_OPTS"
    if [ -n "${MANAGEMENTPORTAL_KEY_DNAME}" ]; then
      KEYTOOL_CREATE_OPTS="$KEYTOOL_CREATE_OPTS -dname ${MANAGEMENTPORTAL_KEY_DNAME}"
    fi
    echo "--> Generating keystore to hold RSA keypair for JWT signing"
    keytool $KEYTOOL_CREATE_OPTS $KEYTOOL_OPTS
  else
    echo "--> RSA keypair for signing JWTs already exists. Not creating a new one."
  fi

  chmod 400 "${keystorefile}"
}

if [ ! -f etc/management-portal/keystore.p12 ]; then
  mkdir -p etc/management-portal
  
  if [ -f etc/keystore.p12 ]; then
    cp etc/keystore.p12 etc/management-portal/keystore.p12
  fi
fi

createKeyStore etc/management-portal/keystore.p12