Update Debian / Ubuntu packaging.

.gitignore

@@ -4,11 +4,18 @@
 # Log files
 *.log
 
+# Binary packages
+*.deb
+
 # Rust target directory
 **/target
 
 # Certificates
-/chirpstack/configuration/certs
+/chirpstack/configuration/certs/*.crt
+/chirpstack/configuration/certs/*.key
+/chirpstack/configuration/certs/*.trust
+/chirpstack/configuration/certs/*.pem
+/chirpstack/configuration/certs/*.csr
 /chirpstack/configuration/private_*.toml
 
 # UI

Dockerfile-dev-cache

@@ -20,6 +20,7 @@ RUN apt-get update && \
 		rpm \
 		clang \
 		yarnpkg \
+		golang-cfssl \
 		&& rm -rf /var/lib/apt/lists/*
 
 RUN ln -s /usr/bin/yarnpkg /usr/bin/yarn

Makefile

@@ -6,6 +6,10 @@ build-debug:
 build-release:
 	docker-compose run --rm chirpstack make release
 
+# Builds a .deb release package.
+build-release-deb:
+	docker-compose run --rm chirpstack make release-deb
+
 # Builds the UI.
 build-ui:
 	docker-compose run --rm chirpstack-ui make build

chirpstack/Cargo.toml

@@ -112,7 +112,10 @@ httpmock = "0.6"
 assets = [
 	["target/release/chirpstack", "usr/bin/", "755"],
 	["configuration/*.toml", "etc/chirpstack/", "640"],
+	["configuration/certs/*.json", "etc/chirpstack/certs", "640"],
+	["debian/environment.conf", "etc/systemd/system/chirpstack.service.d/environment.conf", "640"],
 ]
-
+depends = "$auto, golang-cfssl"
+suggests = "postgresql, mosquitto, redis"
 maintainer-scripts = "debian/"
 systemd-units = { enable = true }

chirpstack/Makefile

@@ -17,12 +17,14 @@ test:
 test-lrwn:
 	cd ../lrwn && make test
 
-test-server: debug configuration/certs
-	../target/debug/chirpstack -c ./configuration
+test-server: debug configuration/certs/ca.pem
+	/target/debug/chirpstack -c ./configuration
 
 dbshell:
 	psql -h postgres -U chirpstack chirpstack
 
-configuration/certs:
-	mkdir configuration/certs
-	openssl req -new -newkey rsa:4096 -days 3650 -nodes -x509 -subj "/CN=ChirpStack test CA" -keyout configuration/certs/ca.key -out configuration/certs/ca.crt
+configuration/certs/ca.pem:
+	cfssl gencert -initca configuration/certs/ca-csr.json | cfssljson -bare configuration/certs/ca
+
+configuration/certs/mqtt-server.pem: configuration/certs/ca.pem
+	cfssl gencert -ca configuration/certs/ca.pem -ca-key configuration/certs/ca-key.pem -config configuration/certs/ca-config.json -profile server configuration/certs/mqtt-server.json | cfssljson -bare configuration/certs/mqtt-server

chirpstack/configuration/certs/ca-config.json

@@ -0,0 +1,17 @@
+{
+  "signing": {
+    "default": {
+      "expiry": "8760h"
+    },
+    "profiles": {
+      "server": {
+        "expiry": "8760h",
+        "usages": [
+          "signing",
+          "key encipherment",
+          "server auth"
+        ]
+      }
+    }
+  }
+}

chirpstack/configuration/certs/ca-csr.json

@@ -0,0 +1,7 @@
+{
+  "CN": "ChirpStack CA",
+  "key": {
+    "algo": "rsa",
+    "size": 4096
+  }
+}

chirpstack/configuration/certs/mqtt-server.json

@@ -0,0 +1,10 @@
+{
+	"CN": "mqtt-broker",
+	"hosts": [
+		"*"
+	],
+	"key": {
+		"algo": "rsa",
+		"size": 4096
+	}
+}

chirpstack/debian/environment.conf

@@ -0,0 +1,4 @@
+[Service]
+Environment="MQTT_BROKER_HOST=localhost"
+Environment="POSTGRESQL_HOST=localhost"
+Environment="REDIS_HOST=localhost"

chirpstack/debian/postinst

@@ -3,6 +3,12 @@
 # Set config-file permissions
 chown -R chirpstack:chirpstack /etc/chirpstack
 chmod 750 /etc/chirpstack
+chmod 750 /etc/chirpstack/certs
 chmod 640 /etc/chirpstack/*.toml
 
+# Generate certificates
+CERTROOT=/etc/chirpstack/certs
+cfssl gencert -initca $CERTROOT/ca-csr.json | cfssljson -bare $CERTROOT/ca
+cfssl gencert -ca $CERTROOT/ca.pem -ca-key $CERTROOT/ca-key.pem -config $CERTROOT/ca-config.json -profile server $CERTROOT/mqtt-server.json | cfssljson -bare $CERTROOT/mqtt-server
+
 #DEBHELPER#

chirpstack/debian/service

@@ -4,7 +4,6 @@ Documentation=https://www.chirpstack.io/
 Wants=network-online.target
 After=network-online.target
 
-
 [Service]
 User=chirpstack
 Group=chirpstack