Add sentinel-proxy

6 files changed, 120 insertions, 0 deletions

diff --git a/sentinel-proxy/Makefile b/sentinel-proxy/Makefile
new file mode 100644
index 0000000..2721647
--- /dev/null
+++ b/sentinel-proxy/Makefile
@@ -0,0 +1,60 @@
+#
+## Copyright (C) 2018-2019 CZ.NIC z.s.p.o. (http://www.nic.cz/)
+#
+## This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+# #
+#
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=sentinel-proxy
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_BRANCH:=token_crc
+
+PKG_MAINTAINER:=CZ.NIC <packaging@turris.cz>
+PKG_LICENSE:=GPL-3.0
+
+PKG_FIXUP:=autoreconf
+
+include $(INCLUDE_DIR)/autopkg-branch.mk
+include $(INCLUDE_DIR)/package.mk
+
+define Package/sentinel-proxy
+  SECTION:=net
+  CATEGORY:=Network
+  SUBMENU:=Sentinel
+  TITLE:=Proxy
+  URL:=https://gitlab.labs.nic.cz/turris/sentinel/proxy
+  DEPENDS:=+czmq +libpaho-mqtt-c +zlib +libopenssl +sentinel-certgen
+endef
+
+define Package/sentinel-proxy/description
+  Central daemon proxying all Sentinel trafic on router to Turris servers.
+endef
+
+define Package/sentinel-proxy/install
+	$(INSTALL_DIR) $(1)/etc/sentinel
+	$(INSTALL_BIN) ./files/ca.pem $(1)/etc/sentinel/ca.pem
+
+	$(INSTALL_DIR) $(1)/usr/bin
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/sentinel_proxy $(1)/usr/bin/sentinel-proxy
+
+	$(INSTALL_DIR) $(1)/etc/init.d
+	$(INSTALL_BIN) files/init $(1)/etc/init.d/sentinel-proxy
+
+	$(INSTALL_DIR) $(1)/etc/config
+	$(INSTALL_BIN) files/uci $(1)/etc/config/sentinel
+
+	$(INSTALL_DIR) $(1)/etc/sentinel-certgen_hooks.d
+	$(INSTALL_BIN) files/restart-proxy-hook.sh $(1)/etc/sentinel-certgen_hooks.d/restart-proxy
+
+	$(INSTALL_DIR) $(1)/etc/cron.d
+	$(INSTALL_DATA) files/renew.cron $(1)/etc/cron.d/certgen-certs-renew
+endef
+
+define Package/sentinel-proxy/conffiles
+/etc/config/sentinel
+endef
+
+$(eval $(call BuildPackage,sentinel-proxy))
diff --git a/sentinel-proxy/files/ca.pem b/sentinel-proxy/files/ca.pem
new file mode 100644
index 0000000..91094e1
--- /dev/null
+++ b/sentinel-proxy/files/ca.pem
@@ -0,0 +1,38 @@
+-----BEGIN CERTIFICATE-----
+MIIGsDCCBJigAwIBAgIJAM3oziL/qM4GMA0GCSqGSIb3DQEBCwUAMIGWMQswCQYD
+VQQGEwJDWjELMAkGA1UECBMCQ1oxDzANBgNVBAcTBlByYWd1ZTEPMA0GA1UEChMG
+Q1ouTklDMQ8wDQYDVQQLEwZUdXJyaXMxFDASBgNVBAMTC1NlbnRpbmVsIENBMREw
+DwYDVQQpEwhTZW50aW5lbDEeMBwGCSqGSIb3DQEJARYPYWRtaW5AdHVycmlzLmN6
+MB4XDTE4MDEyNjA4MzMzOVoXDTI4MDEyNDA4MzMzOVowgZYxCzAJBgNVBAYTAkNa
+MQswCQYDVQQIEwJDWjEPMA0GA1UEBxMGUHJhZ3VlMQ8wDQYDVQQKEwZDWi5OSUMx
+DzANBgNVBAsTBlR1cnJpczEUMBIGA1UEAxMLU2VudGluZWwgQ0ExETAPBgNVBCkT
+CFNlbnRpbmVsMR4wHAYJKoZIhvcNAQkBFg9hZG1pbkB0dXJyaXMuY3owggIiMA0G
+CSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDAwpqRmGRX8qg4lJNJNzXWwj1nVMTm
+vc2W5vjpfwr93YoSqOz4rKlO7fQs3Zbe4LleXwAZncV5lAU1EkOD24Tjb5nKeGjM
+JDvkKL0QGCuSUC1VYdbaqlhZRDNkdB6GiR/MJTHx/op1RcKqi/muc4ywbjFdf1yp
+OJ6pOoifRqEuQkumWXT3dHdE5HuSHdxFLqL4Xre7fa0fs0YXb487VWIgJq/ASQrR
+Zcj1z3oMJaQYrEnHL64NcdKUer0hzExhOdUk9/SWTtDMUWiFeDV/Kh45a781lUd8
+zI/TkG14mkOuc72y0dyoi9gOjtiJHSaKkVle47rEk+VhNA/3TsBLcQ2pA335iK96
+aFdeos3wQQaKouADye/9HsHofK2AE8aRkHPC4dK2mufqOhw36v74jAbRm3xsosDn
+TpADgVOroOV3JtNJROGCoDqOWNSnjv3Nw46acOVt7JS8Ry/7ubXAEtDYv0CPyK0z
+M7/9ztfN+ub2/fsbjJixwWcoEijDnmU1wq5zEeP64XxT49R56/ChMT0xhKXmnnlw
+ijV/EGX35xNPGRd3Wi9Z9F+zJePccVNOtobq6CQ00EuHKkFytqMNMqfe7+XxkZug
+h70eTGwSYd3iLiKsbsE/2+Eynv9Jqj7rEbzlvRYEImZjHlvSuXRDyYd7mMzbQzek
+F+APPvY9YlmEGQIDAQABo4H+MIH7MB0GA1UdDgQWBBS75bhWkQWeTeGGlxwRcO4d
+uRywjTCBywYDVR0jBIHDMIHAgBS75bhWkQWeTeGGlxwRcO4duRywjaGBnKSBmTCB
+ljELMAkGA1UEBhMCQ1oxCzAJBgNVBAgTAkNaMQ8wDQYDVQQHEwZQcmFndWUxDzAN
+BgNVBAoTBkNaLk5JQzEPMA0GA1UECxMGVHVycmlzMRQwEgYDVQQDEwtTZW50aW5l
+bCBDQTERMA8GA1UEKRMIU2VudGluZWwxHjAcBgkqhkiG9w0BCQEWD2FkbWluQHR1
+cnJpcy5jeoIJAM3oziL/qM4GMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQAD
+ggIBAIGfkxSiYMO54JUqJmRPJeFml1qs++YQP0j4bhEToOP85j7ZoxIGfFYdakr7
+RXJ5JmVceNw+MQ7JLWL0ydBvKaEYpUXVyqMYMeICxIZcB8jrgAwATxMzv5Ku5EXx
++7ee/aswCtkc5WO9c8BNLuqewCwHhplTBMSpR7BJ7zfCQnk3o1BBeXY41TcDj6/C
+oY5rDv0Zput9m9f5w0+/ukUm6O2TnUh6L622Jv8EQlEeeP1xvKLKeNQOzjEYlguI
+fXqqVXsjxToRRjY6XfOWbuxZDkEp5TXDqIqLIo2PhS4b/phXJw/S0v//oRh1YOKo
+VEu4vBpTL2pKYFdaPGGLRR0ajXUKJagkQPyy+3I4TWvqE2c1LIkpJF/PlRuets3u
+LxldSbBHLV380ubGa288ywDXI65PE4jdjaa/V1dcJ+kkgwc4BMIfFkU0LenQ8ucL
+Mh6iFfeT0iXTyU7Jm9gfn+nqHoZY4i6i3g/2Byt1Dn36RAcjGXxAO2G19roCux9d
+S42NowRqdbAVOFKjkQ2Ojk4i5FsqVkX+Ykf5jEfD/LnGZSKcHNjRIKU60Lc0r2+H
+EzKOPyTHDcUioPfuXGcl112WfqU+/HWt4nW0QEpNKCNpZ6Opsl0alpESWOBSBN6j
++SZimokYV8q+L9XhyY6Y7Q7d9Szdm269J6FrPqih15AvpnTf
+-----END CERTIFICATE-----
diff --git a/sentinel-proxy/files/init b/sentinel-proxy/files/init
new file mode 100644
index 0000000..5737dce
--- /dev/null
+++ b/sentinel-proxy/files/init
@@ -0,0 +1,12 @@
+#!/bin/sh /etc/rc.common
+
+USE_PROCD=1
+START=95
+STOP=10
+
+start_service() {
+    procd_open_instance
+    procd_set_param command /bin/sh -c 'sentinel-certgen certs && exec sentinel-proxy'
+    procd_set_param respawn 600 5 5
+    procd_close_instance
+}
diff --git a/sentinel-proxy/files/renew.cron b/sentinel-proxy/files/renew.cron
new file mode 100644
index 0000000..85aecb5
--- /dev/null
+++ b/sentinel-proxy/files/renew.cron
@@ -0,0 +1,5 @@
+## crontab
+#
+
+# Periodically check and renew Sentinel:Proxy certificate
+42 */12 * * * root sentinel-certgen certs --hooks-dir /etc/sentinel-certgen_hooks.d
diff --git a/sentinel-proxy/files/restart-proxy-hook.sh b/sentinel-proxy/files/restart-proxy-hook.sh
new file mode 100644
index 0000000..781c368
--- /dev/null
+++ b/sentinel-proxy/files/restart-proxy-hook.sh
@@ -0,0 +1,3 @@
+#!/bin/sh
+# restart Sentinel:Proxy service after Certgen renews the certificate
+/etc/init.d/sentinel-proxy restart
diff --git a/sentinel-proxy/files/uci b/sentinel-proxy/files/uci
new file mode 100644
index 0000000..139597f
--- /dev/null
+++ b/sentinel-proxy/files/uci
@@ -0,0 +1,2 @@
+
+