test

.gitignore

@@ -1 +1,3 @@
 client_secret_*.json
+ca.*
+server.*

README.md

@@ -6,3 +6,41 @@ Reference Web UI
 
 Uses an external identity provider (Google OAuth2 currently).
 Navigate https://awakari.cloud
+
+## 2. Server TLS
+
+```shell
+openssl req -x509 -sha256 -newkey rsa:4096 -nodes \
+-keyout ca.key \
+-out ca.crt \
+-addext "subjectAltName=DNS:awakari.cloud" \
+-subj '/O=awakari/CN=awakari.cloud' \
+-days 30
+```
+
+```shell
+kubectl create secret generic \
+  secret-webapp-tls-ca \
+  --from-file=ca.crt=ca.crt
+```
+
+```shell
+openssl req -newkey rsa:4096 -nodes -keyout server.key -out server.csr \
+  -addext "subjectAltName=DNS:awakari.cloud" \
+  -subj "/O=awakari"
+```
+
+```shell
+openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
+  -copy_extensions copyall \
+  -extfile <(printf "subjectAltName=DNS:awakari.cloud") \
+  -out server.crt \
+  -days 30
+```
+
+```shell
+kubectl create secret tls \
+  secret-webapp-tls-server \
+  --key server.key \
+  --cert server.crt
+```

helm/webapp/values-demo-0.yaml

@@ -5,6 +5,6 @@ ingress:
         - path: /
           pathType: ImplementationSpecific
   tls:
-    - secretName: secret-api-tls-server
+    - secretName: secret-webapp-tls-server
       hosts:
         - awakari.cloud

helm/webapp/values.yaml

@@ -47,9 +47,9 @@ ingress:
         - path: /
           pathType: ImplementationSpecific
   tlsCa:
-    secretName: secret-api-tls-ca
+    secretName: secret-webapp-tls-ca
   tls:
-    - secretName: secret-api-tls-server
+    - secretName: secret-webapp-tls-server
       hosts:
         - webapp.local