Füge Unterstützung für SSL/TLS in den WebSocket-Server hinzu. Aktualisiere die Konfigurationsdatei, um SSL-Optionen zu ermöglichen, und passe die WebSocketServer-Klasse an, um Zertifikat- und Schlüsselpfade zu akzeptieren. Verbessere die Serverstartlogik, um SSL korrekt zu initialisieren und entsprechende Meldungen auszugeben.
This commit is contained in:
Torsten Schulz (local)
committed by
Torsten (PC)
Torsten (PC)
parent
92e17a9f43
commit
8212e906a3
@@ -5,3 +5,6 @@ DB_USER=yourpart
|
||||
DB_PASSWORD=hitomisan
|
||||
THREAD_COUNT=4
|
||||
WEBSOCKET_PORT=4551
|
||||
WEBSOCKET_SSL_ENABLED=false
|
||||
WEBSOCKET_SSL_CERT_PATH=/etc/yourpart/server.crt
|
||||
WEBSOCKET_SSL_KEY_PATH=/etc/yourpart/server.key
|
||||
112
setup-ssl.sh
Executable file
112
setup-ssl.sh
Executable file
@@ -0,0 +1,112 @@
|
||||
#!/bin/bash
|
||||
|
||||
# SSL/TLS Setup Script für YourPart Daemon
|
||||
# Erstellt oder verwaltet SSL-Zertifikate für WebSocket Secure (WSS)
|
||||
|
||||
set -e
|
||||
|
||||
# Farben für Logging
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
BLUE='\033[0;34m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
log_info() {
|
||||
echo -e "${BLUE}[INFO]${NC} $1"
|
||||
}
|
||||
|
||||
log_success() {
|
||||
echo -e "${GREEN}[SUCCESS]${NC} $1"
|
||||
}
|
||||
|
||||
log_warning() {
|
||||
echo -e "${YELLOW}[WARNING]${NC} $1"
|
||||
}
|
||||
|
||||
log_error() {
|
||||
echo -e "${RED}[ERROR]${NC} $1"
|
||||
}
|
||||
|
||||
CERT_DIR="/etc/yourpart"
|
||||
CERT_FILE="$CERT_DIR/server.crt"
|
||||
KEY_FILE="$CERT_DIR/server.key"
|
||||
CSR_FILE="$CERT_DIR/server.csr"
|
||||
|
||||
# Prüfe ob OpenSSL installiert ist
|
||||
if ! command -v openssl &> /dev/null; then
|
||||
log_error "OpenSSL ist nicht installiert!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
log_info "SSL/TLS Setup für YourPart Daemon"
|
||||
|
||||
# Erstelle Zertifikats-Verzeichnis falls nicht vorhanden
|
||||
if [ ! -d "$CERT_DIR" ]; then
|
||||
log_info "Erstelle Zertifikats-Verzeichnis: $CERT_DIR"
|
||||
sudo mkdir -p "$CERT_DIR"
|
||||
fi
|
||||
|
||||
# Prüfe ob bereits Zertifikate existieren
|
||||
if [ -f "$CERT_FILE" ] && [ -f "$KEY_FILE" ]; then
|
||||
log_info "Zertifikate existieren bereits"
|
||||
|
||||
# Prüfe Gültigkeit der Zertifikate
|
||||
if openssl x509 -in "$CERT_FILE" -text -noout &> /dev/null; then
|
||||
log_success "Zertifikat ist gültig"
|
||||
|
||||
# Zeige Zertifikats-Informationen
|
||||
log_info "Zertifikats-Informationen:"
|
||||
openssl x509 -in "$CERT_FILE" -text -noout | grep -E "(Subject:|Not Before|Not After|DNS:)"
|
||||
|
||||
read -p "Möchten Sie neue Zertifikate erstellen? (y/N): " -n 1 -r
|
||||
echo
|
||||
if [[ ! $REPLY =~ ^[Yy]$ ]]; then
|
||||
log_info "Zertifikate bleiben unverändert"
|
||||
exit 0
|
||||
fi
|
||||
else
|
||||
log_warning "Zertifikat ist ungültig, erstelle neue..."
|
||||
fi
|
||||
fi
|
||||
|
||||
log_info "Erstelle neue SSL-Zertifikate..."
|
||||
|
||||
# Erstelle Private Key
|
||||
log_info "Erstelle Private Key..."
|
||||
sudo openssl genrsa -out "$KEY_FILE" 2048
|
||||
sudo chmod 600 "$KEY_FILE"
|
||||
sudo chown yourpart:yourpart "$KEY_FILE"
|
||||
|
||||
# Erstelle Certificate Signing Request (CSR)
|
||||
log_info "Erstelle Certificate Signing Request..."
|
||||
sudo openssl req -new -key "$KEY_FILE" -out "$CSR_FILE" -subj "/C=DE/ST=Germany/L=Berlin/O=YourPart/OU=IT/CN=your-part.de"
|
||||
|
||||
# Erstelle Self-Signed Certificate
|
||||
log_info "Erstelle Self-Signed Certificate..."
|
||||
sudo openssl x509 -req -days 365 -in "$CSR_FILE" -signkey "$KEY_FILE" -out "$CERT_FILE"
|
||||
|
||||
# Setze korrekte Berechtigungen
|
||||
sudo chmod 644 "$CERT_FILE"
|
||||
sudo chown yourpart:yourpart "$CERT_FILE"
|
||||
|
||||
# Lösche CSR-Datei (nicht mehr benötigt)
|
||||
sudo rm -f "$CSR_FILE"
|
||||
|
||||
log_success "SSL-Zertifikate erfolgreich erstellt!"
|
||||
|
||||
# Zeige Zertifikats-Informationen
|
||||
log_info "Zertifikats-Informationen:"
|
||||
openssl x509 -in "$CERT_FILE" -text -noout | grep -E "(Subject:|Not Before|Not After|DNS:)"
|
||||
|
||||
log_info ""
|
||||
log_info "Nächste Schritte:"
|
||||
log_info "1. Aktiviere SSL in der Konfiguration:"
|
||||
log_info " WEBSOCKET_SSL_ENABLED=true"
|
||||
log_info "2. Starte den Daemon neu:"
|
||||
log_info " sudo systemctl restart yourpart-daemon"
|
||||
log_info "3. Verbinde dich mit:"
|
||||
log_info " wss://your-part.de:4551"
|
||||
log_info ""
|
||||
log_warning "Hinweis: Dies ist ein Self-Signed Certificate!"
|
||||
log_warning "Für Produktionsumgebungen verwenden Sie Zertifikate von einer vertrauenswürdigen CA."
|
||||
@@ -46,8 +46,12 @@ int main() {
|
||||
10
|
||||
);
|
||||
int websocketPort = std::stoi(config.get("WEBSOCKET_PORT"));
|
||||
bool sslEnabled = config.get("WEBSOCKET_SSL_ENABLED") == "true";
|
||||
std::string certPath = sslEnabled ? config.get("WEBSOCKET_SSL_CERT_PATH") : "";
|
||||
std::string keyPath = sslEnabled ? config.get("WEBSOCKET_SSL_KEY_PATH") : "";
|
||||
|
||||
MessageBroker broker;
|
||||
WebSocketServer websocketServer(websocketPort, pool, broker);
|
||||
WebSocketServer websocketServer(websocketPort, pool, broker, sslEnabled, certPath, keyPath);
|
||||
// Use C++23 features for better performance
|
||||
std::vector<std::unique_ptr<Worker>> workers;
|
||||
workers.reserve(9); // Pre-allocate for better performance
|
||||
|
||||
@@ -18,8 +18,9 @@ struct lws_protocols WebSocketServer::protocols[] = {
|
||||
{ nullptr, nullptr, 0, 0 }
|
||||
};
|
||||
|
||||
WebSocketServer::WebSocketServer(int port, ConnectionPool &pool, MessageBroker &broker)
|
||||
: port(port), pool(pool), broker(broker) {}
|
||||
WebSocketServer::WebSocketServer(int port, ConnectionPool &pool, MessageBroker &broker,
|
||||
bool useSSL, const std::string& certPath, const std::string& keyPath)
|
||||
: port(port), pool(pool), broker(broker), useSSL(useSSL), certPath(certPath), keyPath(keyPath) {}
|
||||
|
||||
WebSocketServer::~WebSocketServer() {
|
||||
stop();
|
||||
@@ -57,8 +58,21 @@ void WebSocketServer::startServer() {
|
||||
info.port = port;
|
||||
info.protocols = protocols;
|
||||
|
||||
// SSL/TLS Konfiguration
|
||||
if (useSSL) {
|
||||
if (certPath.empty() || keyPath.empty()) {
|
||||
throw std::runtime_error("SSL enabled but certificate or key path not provided");
|
||||
}
|
||||
info.options = LWS_SERVER_OPTION_DO_SSL_GLOBAL_INIT;
|
||||
info.ssl_cert_filepath = certPath.c_str();
|
||||
info.ssl_private_key_filepath = keyPath.c_str();
|
||||
std::cout << "WebSocket SSL Server starting on port " << port << " with certificates: "
|
||||
<< certPath << " / " << keyPath << std::endl;
|
||||
} else {
|
||||
std::cout << "WebSocket Server starting on port " << port << " (no SSL)" << std::endl;
|
||||
}
|
||||
|
||||
// Reduziere Log-Level um weniger Debug-Ausgaben zu haben
|
||||
// Setze Umgebungsvariable für Log-Level
|
||||
setenv("LWS_LOG_LEVEL", "0", 1); // 0 = nur Fehler
|
||||
|
||||
context = lws_create_context(&info);
|
||||
|
||||
@@ -25,7 +25,8 @@ class Worker; // forward
|
||||
|
||||
class WebSocketServer {
|
||||
public:
|
||||
WebSocketServer(int port, ConnectionPool &pool, MessageBroker &broker);
|
||||
WebSocketServer(int port, ConnectionPool &pool, MessageBroker &broker,
|
||||
bool useSSL = false, const std::string& certPath = "", const std::string& keyPath = "");
|
||||
~WebSocketServer();
|
||||
|
||||
void run();
|
||||
@@ -46,6 +47,9 @@ private:
|
||||
int port;
|
||||
ConnectionPool &pool;
|
||||
MessageBroker &broker;
|
||||
bool useSSL;
|
||||
std::string certPath;
|
||||
std::string keyPath;
|
||||
|
||||
std::atomic<bool> running{false};
|
||||
struct lws_context *context = nullptr;
|
||||
|
||||
Reference in New Issue
Block a user