a359cdfb66
Password length and alphabet is unchanged, but the restriction to include at least one numeric and one capital char has been removed. This restriction is not needed by client applications, adds code complexity, and even (insignificantly) reduces entropy. Reason for switching to pwgen: apg uses /dev/random instead of /dev/urandom which brings no security benefits but can stall the generate-secrets script on low-entropy devices due to blocking. Since `security.rngd` has been disabled in NixOS 20.09, blocking in generate-secrets can also appear on regular NixOS desktop systems.
47 lines
1.9 KiB
Bash
Executable File
47 lines
1.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
set -euo pipefail
|
|
|
|
opensslConf=${1:-openssl.cnf}
|
|
|
|
makePasswordSecret() {
|
|
# Passwords have alphabet {a-z, A-Z, 0-9} and ~119 bits of entropy
|
|
[[ -e $1 ]] || pwgen -s 20 1 > "$1"
|
|
}
|
|
makeHMAC() {
|
|
user=$1
|
|
rpcauth $user $(cat bitcoin-rpcpassword-$user) | grep rpcauth | cut -d ':' -f 2 > bitcoin-HMAC-$user
|
|
}
|
|
|
|
makePasswordSecret bitcoin-rpcpassword-privileged
|
|
makePasswordSecret bitcoin-rpcpassword-btcpayserver
|
|
makePasswordSecret bitcoin-rpcpassword-public
|
|
makePasswordSecret lnd-wallet-password
|
|
makePasswordSecret liquid-rpcpassword
|
|
makePasswordSecret lightning-charge-token
|
|
makePasswordSecret spark-wallet-password
|
|
makePasswordSecret backup-encryption-password
|
|
makePasswordSecret jm-wallet-password
|
|
|
|
[[ -e bitcoin-HMAC-privileged ]] || makeHMAC privileged
|
|
[[ -e bitcoin-HMAC-public ]] || makeHMAC public
|
|
[[ -e bitcoin-HMAC-btcpayserver ]] || makeHMAC btcpayserver
|
|
[[ -e lightning-charge-env ]] || echo "API_TOKEN=$(cat lightning-charge-token)" > lightning-charge-env
|
|
[[ -e nanopos-env ]] || echo "CHARGE_TOKEN=$(cat lightning-charge-token)" > nanopos-env
|
|
[[ -e spark-wallet-login ]] || echo "login=spark-wallet:$(cat spark-wallet-password)" > spark-wallet-login
|
|
[[ -e backup-encryption-env ]] || echo "PASSPHRASE=$(cat backup-encryption-password)" > backup-encryption-env
|
|
|
|
if [[ ! -e lnd-key || ! -e lnd-cert ]]; then
|
|
openssl ecparam -genkey -name prime256v1 -out lnd-key
|
|
openssl req -config $opensslConf -new -sha256 -key lnd-key -out lnd.csr -subj '/CN=localhost/O=lnd'
|
|
openssl req -config $opensslConf -x509 -sha256 -days 1825 -key lnd-key -in lnd.csr -out lnd-cert
|
|
rm lnd.csr
|
|
fi
|
|
|
|
if [[ ! -e loop-key || ! -e loop-cert ]]; then
|
|
openssl ecparam -genkey -name prime256v1 -out loop-key
|
|
openssl req -config $opensslConf -new -sha256 -key loop-key -out loop.csr -subj '/CN=localhost/O=loopd'
|
|
openssl req -config $opensslConf -x509 -sha256 -days 1825 -key loop-key -in loop.csr -out loop-cert
|
|
rm loop.csr
|
|
fi
|