From 61afd863f7182eb30c1788ac0e2000ea7997b104 Mon Sep 17 00:00:00 2001 From: Galip Tolga Erdem Date: Thu, 31 Mar 2022 00:33:17 +0300 Subject: [PATCH] added ps cert generator --- .../EShopOnAbpAuthServerModule.cs | 1 - .../appsettings.Docker.json | 11 --- .../appsettings.Docker.json | 11 --- etc/docker/certs/generate_certs.ps1 | 60 ++++++++++++++ etc/docker/docker-compose.yml | 78 +++++++++---------- 5 files changed, 99 insertions(+), 62 deletions(-) create mode 100644 etc/docker/certs/generate_certs.ps1 diff --git a/apps/auth-server/src/EShopOnAbp.AuthServer/EShopOnAbpAuthServerModule.cs b/apps/auth-server/src/EShopOnAbp.AuthServer/EShopOnAbpAuthServerModule.cs index 11f59d6e..8b57f016 100644 --- a/apps/auth-server/src/EShopOnAbp.AuthServer/EShopOnAbpAuthServerModule.cs +++ b/apps/auth-server/src/EShopOnAbp.AuthServer/EShopOnAbpAuthServerModule.cs @@ -185,7 +185,6 @@ public class EShopOnAbpAuthServerModule : AbpModule app.UseJwtTokenMiddleware(); app.UseAbpSerilogEnrichers(); app.UseUnitOfWork(); - app.UseForwardedHeaders(); app.UseIdentityServer(); app.UseAuthorization(); app.UseSwagger(); diff --git a/apps/auth-server/src/EShopOnAbp.AuthServer/appsettings.Docker.json b/apps/auth-server/src/EShopOnAbp.AuthServer/appsettings.Docker.json index 211c73ff..5e2fe164 100644 --- a/apps/auth-server/src/EShopOnAbp.AuthServer/appsettings.Docker.json +++ b/apps/auth-server/src/EShopOnAbp.AuthServer/appsettings.Docker.json @@ -4,27 +4,16 @@ "CorsOrigins": "http://app-web,https://identity-service,https://administration-service,https://catalog-service,https://basket-service,https://ordering-service,https://payment-service", "RedirectAllowedUrls": "http://app-web" }, - "Logging": { - "LogLevel": { - "Default": "Information", - "Microsoft": "Warning", - "Microsoft.Hosting.Lifetime": "Information" - } - }, "AuthServer": { "Authority": "http://app-authserver", "RequireHttpsMetadata": "false", "SwaggerClientId": "WebGateway_Swagger", "SwaggerClientSecret": "1q2w3e*" }, - "AllowedHosts": "*", "ConnectionStrings": { "IdentityService": "User ID=postgres;Password=myPassw0rd;Host=postgres-db;Port=5432;Database=EShopOnAbp_Identity;Pooling=false;", "AdministrationService": "User ID=postgres;Password=myPassw0rd;Host=postgres-db;Port=5432;Database=EShopOnAbp_Administration;Pooling=false;" }, - "StringEncryption": { - "DefaultPassPhrase": "gsKnGZ041HLL4IM8" - }, "Redis": { "Configuration": "redis" }, diff --git a/apps/public-web/src/EShopOnAbp.PublicWeb/appsettings.Docker.json b/apps/public-web/src/EShopOnAbp.PublicWeb/appsettings.Docker.json index 9eb3dd5b..47024036 100644 --- a/apps/public-web/src/EShopOnAbp.PublicWeb/appsettings.Docker.json +++ b/apps/public-web/src/EShopOnAbp.PublicWeb/appsettings.Docker.json @@ -2,22 +2,11 @@ "App": { "SelfUrl": "https://app-publicweb" }, - "Logging": { - "LogLevel": { - "Default": "Information", - "Microsoft": "Warning", - "Microsoft.Hosting.Lifetime": "Information" - } - }, - "AllowedHosts": "*", "RemoteServices": { "Default": { "BaseUrl": "http://gateway-web-public" } }, - "StringEncryption": { - "DefaultPassPhrase": "gsKnGZ041HLL4IM8" - }, "Redis": { "Configuration": "redis" }, diff --git a/etc/docker/certs/generate_certs.ps1 b/etc/docker/certs/generate_certs.ps1 new file mode 100644 index 00000000..449c232c --- /dev/null +++ b/etc/docker/certs/generate_certs.ps1 @@ -0,0 +1,60 @@ +# Source: https://stackoverflow.com/a/62060315 +# Generate self-signed certificate to be used by IdentityServer. +# When using localhost - API cannot see the IdentityServer from within the docker-compose'd network. +# You have to run this script as Administrator (open Powershell by right click -> Run as Administrator). + +$rootCN = "eShopOnAbp" +$authserverCNs = "app-authserver", "localhost" +$publicWebCNs = "app-public-web", "localhost" +$administrationServiceCNs = "administration-service", "localhost" +$identityServiceCNs = "identity-service", "localhost" +$catalogServiceCNs = "catalog-service", "localhost" +$basketServiceCNs = "basket-service", "localhost" +$orderingServiceCNs = "ordering-service", "localhost" +$paymentServiceCNs = "payment-service", "localhost" + +$alreadyExistingCertsRoot = Get-ChildItem -Path Cert:\LocalMachine\My -Recurse | Where-Object {$_.Subject -eq "CN=$rootCN"} + +if ($alreadyExistingCertsRoot.Count -eq 1) { + Write-Output "Skipping creating Root CA certificate as it already exists." + $rootCA = [Microsoft.CertificateServices.Commands.Certificate] $alreadyExistingCertsRoot[0] +} else { + $rootCA = New-SelfSignedCertificate -Subject $rootCN -KeyUsageProperty Sign -KeyUsage CertSign -CertStoreLocation Cert:\LocalMachine\My +} + +$authserverCert = New-SelfSignedCertificate -DnsName $authserverCNs -Signer $rootCN -CertStoreLocation Cert:\LocalMachine\My +# $publicWebCert = New-SelfSignedCertificate -DnsName $publicWebCNs -Signer $rootCN -CertStoreLocation Cert:\LocalMachine\My +# $administrationServiceCert = New-SelfSignedCertificate -DnsName $administrationServiceCNs -Signer $rootCN -CertStoreLocation Cert:\LocalMachine\My +# $identityServiceCert = New-SelfSignedCertificate -DnsName $identityServiceCNs -Signer $rootCN -CertStoreLocation Cert:\LocalMachine\My +# $catalogServiceCert = New-SelfSignedCertificate -DnsName $catalogServiceCNs -Signer $rootCN -CertStoreLocation Cert:\LocalMachine\My +# $basketServiceCert = New-SelfSignedCertificate -DnsName $basketServiceCNs -Signer $rootCN -CertStoreLocation Cert:\LocalMachine\My +# $orderingServiceCert = New-SelfSignedCertificate -DnsName $orderingServiceCNs -Signer $rootCN -CertStoreLocation Cert:\LocalMachine\My +# $paymentServiceCert = New-SelfSignedCertificate -DnsName $paymentServiceCNs -Signer $rootCN -CertStoreLocation Cert:\LocalMachine\My + +$password = ConvertTo-SecureString -String "8b6039b6-c67a-448b-977b-0ce6d3fcfd49" -Force -AsPlainText + +Export-PfxCertificate -Cert $rootCA -FilePath eShopOnAbp-root-cert.pfx -Password $password | Out-Null +Export-PfxCertificate -Cert $authserverCert -FilePath app-authserver-cert.pfx -Password $password | Out-Null +# Export-PfxCertificate -Cert $publicWebCert -FilePath app-public-cert.pfx -Password $password | Out-Null +# Export-PfxCertificate -Cert $administrationServiceCert -FilePath administration-service-cert.pfx -Password $password | Out-Null +# Export-PfxCertificate -Cert $identityServiceCert -FilePath identity-service-cert.pfx -Password $password | Out-Null +# Export-PfxCertificate -Cert $catalogServiceCert -FilePath catalog-service-cert.pfx -Password $password | Out-Null +# Export-PfxCertificate -Cert $basketServiceCert -FilePath basket-service-cert.pfx -Password $password | Out-Null +# Export-PfxCertificate -Cert $orderingServiceCert -FilePath ordering-service-cert.pfx -Password $password | Out-Null +# Export-PfxCertificate -Cert $paymentServiceCert -FilePath payment-service-cert.pfx -Password $password | Out-Null + +# Export .cer to be converted to .crt to be trusted within the Docker container. +Export-Certificate -Cert $rootCA -FilePath eShopOnAbp-root-cert.cer -Type CERT | Out-Null + +# Trust it on your host machine. +$store = New-Object System.Security.Cryptography.X509Certificates.X509Store "Root","LocalMachine" +$store.Open("ReadWrite") + +$rootCertAlreadyTrusted = ($store.Certificates | Where-Object {$_.Subject -eq "CN=$rootCN"} | Measure-Object).Count -eq 1 + +if ($rootCertAlreadyTrusted -eq $false) { + Write-Output "Adding the root CA certificate to the trust store." + $store.Add($rootCA) +} + +$store.Close() \ No newline at end of file diff --git a/etc/docker/docker-compose.yml b/etc/docker/docker-compose.yml index 652f42c5..a0134896 100644 --- a/etc/docker/docker-compose.yml +++ b/etc/docker/docker-compose.yml @@ -8,13 +8,13 @@ services: context: ../../ dockerfile: services/administration/src/EShopOnAbp.AdministrationService.HttpApi.Host/Dockerfile environment: - - ASPNETCORE_ENVIRONMENT=Staging + - ASPNETCORE_ENVIRONMENT=Docker - ASPNETCORE_URLS=https://+:443;http://+:80; - Kestrel__Certificates__Default__Path=/root/certificate/localhost.pfx - Kestrel__Certificates__Default__Password=8b6039b6-c67a-448b-977b-0ce6d3fcfd49 - - Redis__Configuration=redis - - RabbitMQ__Connections__Default__HostName=rabbitmq - - ConnectionStrings__AdministrationService=User ID=postgres;Password=myPassw0rd;Host=postgres-db;Port=5432;Database=EShopOnAbp_Administration;Pooling=false; + # - Redis__Configuration=redis + # - RabbitMQ__Connections__Default__HostName=rabbitmq + # - ConnectionStrings__AdministrationService=User ID=postgres;Password=myPassw0rd;Host=postgres-db;Port=5432;Database=EShopOnAbp_Administration;Pooling=false; ports: - "44353:443" depends_on: @@ -36,7 +36,7 @@ services: context: ../../ dockerfile: services/identity/src/EShopOnAbp.IdentityService.HttpApi.Host/Dockerfile environment: - - ASPNETCORE_ENVIRONMENT=Staging + - ASPNETCORE_ENVIRONMENT=Docker - ASPNETCORE_URLS=https://+:443;http://+:80 - Kestrel__Certificates__Default__Path=/root/certificate/localhost.pfx - Kestrel__Certificates__Default__Password=8b6039b6-c67a-448b-977b-0ce6d3fcfd49 @@ -65,17 +65,17 @@ services: context: ../../ dockerfile: services/catalog/src/EShopOnAbp.CatalogService.HttpApi.Host/Dockerfile environment: - - ASPNETCORE_ENVIRONMENT=Staging + - ASPNETCORE_ENVIRONMENT=Docker - ASPNETCORE_URLS=https://+:443;http://+:80;http://+:81; - Kestrel__Certificates__Default__Path=/root/certificate/localhost.pfx - Kestrel__Certificates__Default__Password=8b6039b6-c67a-448b-977b-0ce6d3fcfd49 - Kestrel__EndPoints__Http__Url=http://docker.host.internal:80 - Kestrel__EndPoints__Https__Url=https://docker.host.internal:443 - Kestrel__EndPoints__gRPC__Url=http://docker.host.internal:81 - - Redis__Configuration=redis - - RabbitMQ__Connections__Default__HostName=rabbitmq - - ConnectionStrings__CatalogService=mongodb://mongodb/EShopOnAbp_Catalog - - ConnectionStrings__AdministrationService=User ID=postgres;Password=myPassw0rd;Host=postgres-db;Port=5432;Database=EShopOnAbp_Administration;Pooling=false; + # - Redis__Configuration=redis + # - RabbitMQ__Connections__Default__HostName=rabbitmq + # - ConnectionStrings__CatalogService=mongodb://mongodb/EShopOnAbp_Catalog + # - ConnectionStrings__AdministrationService=User ID=postgres;Password=myPassw0rd;Host=postgres-db;Port=5432;Database=EShopOnAbp_Administration;Pooling=false; ports: - "44354:443" - "5000:80" @@ -99,15 +99,15 @@ services: context: ../../ dockerfile: services/basket/src/EShopOnAbp.BasketService.HttpApi.Host/Dockerfile environment: - - ASPNETCORE_ENVIRONMENT=Staging + - ASPNETCORE_ENVIRONMENT=Docker - ASPNETCORE_URLS=https://+:443;http://+:80; - Kestrel__Certificates__Default__Path=/root/certificate/localhost.pfx - Kestrel__Certificates__Default__Password=8b6039b6-c67a-448b-977b-0ce6d3fcfd49 - - Redis__Configuration=redis - - RabbitMQ__Connections__Default__HostName=rabbitmq - - RemoteServices__Catalog__BaseUrl=https://catalog-service - - RemoteServices__Catalog__GrpcUrl=http://catalog-service - - ConnectionStrings__AdministrationService=User ID=postgres;Password=myPassw0rd;Host=postgres-db;Port=5432;Database=EShopOnAbp_Administration;Pooling=false; + # - Redis__Configuration=redis + # - RabbitMQ__Connections__Default__HostName=rabbitmq + # - RemoteServices__Catalog__BaseUrl=https://catalog-service + # - RemoteServices__Catalog__GrpcUrl=http://catalog-service + # - ConnectionStrings__AdministrationService=User ID=postgres;Password=myPassw0rd;Host=postgres-db;Port=5432;Database=EShopOnAbp_Administration;Pooling=false; ports: - "44355:443" depends_on: @@ -129,7 +129,7 @@ services: context: ../../ dockerfile: services/ordering/src/EShopOnAbp.OrderingService.HttpApi.Host/Dockerfile environment: - - ASPNETCORE_ENVIRONMENT=Staging + - ASPNETCORE_ENVIRONMENT=Docker - ASPNETCORE_URLS=https://+:443;http://+:80; - Kestrel__Certificates__Default__Path=/root/certificate/localhost.pfx - Kestrel__Certificates__Default__Password=8b6039b6-c67a-448b-977b-0ce6d3fcfd49 @@ -158,7 +158,7 @@ services: context: ../../ dockerfile: services/payment/src/EShopOnAbp.PaymentService.HttpApi.Host/Dockerfile environment: - - ASPNETCORE_ENVIRONMENT=Staging + - ASPNETCORE_ENVIRONMENT=Docker - ASPNETCORE_URLS=https://+:443;http://+:80; - Kestrel__Certificates__Default__Path=/root/certificate/localhost.pfx - Kestrel__Certificates__Default__Password=8b6039b6-c67a-448b-977b-0ce6d3fcfd49 @@ -211,22 +211,22 @@ services: context: ../../ dockerfile: apps/auth-server/src/EShopOnAbp.AuthServer/Dockerfile environment: - - ASPNETCORE_ENVIRONMENT=Development + - ASPNETCORE_ENVIRONMENT=Docker - ASPNETCORE_URLS=https://+:443;http://+:80; + - ASPNETCORE_HTTPS_PORT=44330 - Kestrel__Certificates__Default__Path=/root/certificate/localhost.pfx - Kestrel__Certificates__Default__Password=8b6039b6-c67a-448b-977b-0ce6d3fcfd49 - - Redis__Configuration=redis - - RabbitMQ__Connections__Default__HostName=rabbitmq - - App__SelfUrl=https://app-authserver - - App__CorsOrigins=http://app-web,https://identity-service,https://administration-service,https://catalog-service,https://basket-service,https://ordering-service,https://payment-service - - App__RedirectAllowedUrls=http://app-web - - AuthServer__Authority=http://app-authserver - - AuthServer__RequireHttpsMetadata=false - - ConnectionStrings__IdentityService=User ID=postgres;Password=myPassw0rd;Host=postgres-db;Port=5432;Database=EShopOnAbp_Identity;Pooling=false; - - ConnectionStrings__AdministrationService=User ID=postgres;Password=myPassw0rd;Host=postgres-db;Port=5432;Database=EShopOnAbp_Administration;Pooling=false; + # - Redis__Configuration=redis + # - RabbitMQ__Connections__Default__HostName=rabbitmq + # - App__SelfUrl=https://app-authserver + # - App__CorsOrigins=http://app-web,https://identity-service,https://administration-service,https://catalog-service,https://basket-service,https://ordering-service,https://payment-service + # - App__RedirectAllowedUrls=http://app-web + - AuthServer__Authority=https://app-authserver + - AuthServer__RequireHttpsMetadata=true + # - ConnectionStrings__IdentityService=User ID=postgres;Password=myPassw0rd;Host=postgres-db;Port=5432;Database=EShopOnAbp_Identity;Pooling=false; + # - ConnectionStrings__AdministrationService=User ID=postgres;Password=myPassw0rd;Host=postgres-db;Port=5432;Database=EShopOnAbp_Administration;Pooling=false; ports: - "44330:443" - - "5001:80" depends_on: redis: condition: service_healthy @@ -246,17 +246,17 @@ services: context: ../../ dockerfile: apps/public-web/src/EShopOnAbp.PublicWeb/Dockerfile environment: - - ASPNETCORE_ENVIRONMENT=Staging + - ASPNETCORE_ENVIRONMENT=Docker - ASPNETCORE_URLS=https://+:443;http://+:80; - Kestrel__Certificates__Default__Path=/root/certificate/localhost.pfx - Kestrel__Certificates__Default__Password=8b6039b6-c67a-448b-977b-0ce6d3fcfd49 - - Redis__Configuration=redis - - RabbitMQ__Connections__Default__HostName=rabbitmq - - App__SelfUrl=https://app-publicweb - - AuthServer__Authority=http://app-authserver - - AuthServer__RequireHttpsMetadata=false - - RemoteServices__Default__BaseUrl=http://gateway-web-public - - ReverseProxy__Clusters__cluster1__Destinations__destination1__Address=http://gateway-web-public + # - Redis__Configuration=redis + # - RabbitMQ__Connections__Default__HostName=rabbitmq + # - App__SelfUrl=https://app-publicweb + - AuthServer__Authority=https://app-authserver + - AuthServer__RequireHttpsMetadata=true + # - RemoteServices__Default__BaseUrl=http://gateway-web-public + # - ReverseProxy__Clusters__cluster1__Destinations__destination1__Address=http://gateway-web-public ports: - "44335:443" depends_on: @@ -276,7 +276,7 @@ services: context: ../../ dockerfile: gateways/web/src/EShopOnAbp.WebGateway/Dockerfile environment: - - ASPNETCORE_ENVIRONMENT=Staging + - ASPNETCORE_ENVIRONMENT=Docker # Yarp can't resolve dns, needs to be overridden - ASPNETCORE_URLS=https://+:443;http://+:80; - Kestrel__Certificates__Default__Path=/root/certificate/localhost.pfx - Kestrel__Certificates__Default__Password=8b6039b6-c67a-448b-977b-0ce6d3fcfd49 @@ -308,7 +308,7 @@ services: context: ../../ dockerfile: gateways/web-public/src/EShopOnAbp.WebPublicGateway/Dockerfile environment: - - ASPNETCORE_ENVIRONMENT=Staging #Or use Docker ASPNETCORE_ENVIRONMENT and remove env override - decide + - ASPNETCORE_ENVIRONMENT=Docker # Yarp can't resolve dns, needs to be overridden - ASPNETCORE_URLS=https://+:443;http://+:80; - Kestrel__Certificates__Default__Path=/root/certificate/localhost.pfx - Kestrel__Certificates__Default__Password=8b6039b6-c67a-448b-977b-0ce6d3fcfd49