mirror of
https://github.com/suitenumerique/docs.git
synced 2026-09-18 15:50:21 +02:00
Manuel RaynaudandAnthony LC
e7a76632fa
notify the backend when the worker persists new content for
a document, so the lists ordered by `updated_at` follow the edits made on the
collaboration server. The backend serves it on
`POST /api/v1.0/documents/{id}/content-updated/`, authenticated with a short
lived RS256 JWT the collaboration server signs (`aud: "docs-backend"`) and
the backend verifies against the JWKS the collaboration server publishes on
`/collaboration/jwks/v1` — the mirror of the admin token the backend signs to
call it, so no long lived secret is shared and either side can roll its key
on its own
40 lines
1.4 KiB
Bash
Executable File
40 lines
1.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
# Generate the RSA keys signing the JWT tokens exchanged between the services.
|
|
#
|
|
# Two directions, hence two keys:
|
|
# - "private.pem" signs the tokens the backend issues to call the converter and
|
|
# the collaboration server.
|
|
# - "yhub-private.pem" signs the calls the collaboration server makes to the
|
|
# backend.
|
|
#
|
|
# Only the private halves exist as files: each service publishes the public half
|
|
# of its own key on its JWKS endpoint, where the other one reads it.
|
|
#
|
|
# Development only. The keys are generated locally and never committed: they
|
|
# land in "data/", which is gitignored. The dev stack mounts them in the
|
|
# containers, where the *_FILE settings point at them.
|
|
#
|
|
# Idempotent: existing keys are kept. Delete a file to roll it.
|
|
|
|
set -eo pipefail
|
|
|
|
REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
KEY_DIR="${REPO_DIR}/data/jwt"
|
|
|
|
mkdir -p "${KEY_DIR}"
|
|
|
|
if [ ! -f "${KEY_DIR}/private.pem" ]; then
|
|
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 \
|
|
-out "${KEY_DIR}/private.pem" 2>/dev/null
|
|
chmod 600 "${KEY_DIR}/private.pem"
|
|
echo "✓ backend JWT private key generated in ${KEY_DIR}/private.pem"
|
|
fi
|
|
|
|
if [ ! -f "${KEY_DIR}/yhub-private.pem" ]; then
|
|
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 \
|
|
-out "${KEY_DIR}/yhub-private.pem" 2>/dev/null
|
|
chmod 600 "${KEY_DIR}/yhub-private.pem"
|
|
echo "✓ collaboration JWT private key generated in ${KEY_DIR}/yhub-private.pem"
|
|
fi
|