43 lines
1.8 KiB
JavaScript
43 lines
1.8 KiB
JavaScript
#!/usr/bin/env node
|
|
// Generates a dedicated Ed25519 keypair for signing connect links
|
|
// (openwork://connect?token=<JWT>).
|
|
//
|
|
// node scripts/generate-connect-link-keypair.mjs [kid]
|
|
//
|
|
// The PRIVATE key belongs in the deployment operator's secret store only
|
|
// (env DEN_CONNECT_LINK_PRIVATE_KEY, alongside DEN_CONNECT_LINK_KEY_ID) —
|
|
// never in this repository. The PUBLIC key is safe to publish and is what
|
|
// desktop builds embed (apps/desktop/electron/connect-link-keys.mjs).
|
|
|
|
import { generateKeyPairSync } from "node:crypto"
|
|
|
|
const now = new Date()
|
|
const defaultKid = `owc-${now.getUTCFullYear()}-${String(now.getUTCMonth() + 1).padStart(2, "0")}`
|
|
const kid = process.argv[2]?.trim() || defaultKid
|
|
|
|
if (!/^[A-Za-z0-9._-]{1,64}$/.test(kid)) {
|
|
console.error(`Invalid kid "${kid}" — use 1-64 chars of [A-Za-z0-9._-].`)
|
|
process.exit(1)
|
|
}
|
|
|
|
const { publicKey, privateKey } = generateKeyPairSync("ed25519", {
|
|
publicKeyEncoding: { type: "spki", format: "pem" },
|
|
privateKeyEncoding: { type: "pkcs8", format: "pem" },
|
|
})
|
|
|
|
console.log(`# Connect-link signing keypair (kid: ${kid})`)
|
|
console.log("#")
|
|
console.log("# 1. Store the PRIVATE key in the deployment's secret store, e.g.:")
|
|
console.log(`# DEN_CONNECT_LINK_KEY_ID=${kid}`)
|
|
console.log("# DEN_CONNECT_LINK_PRIVATE_KEY=<private PEM below>")
|
|
console.log("# (Infisical / Render dashboard / Helm secret.values.connectLinkPrivateKey)")
|
|
console.log("# 2. Add the PUBLIC key to VENDOR_CONNECT_LINK_PUBLIC_KEYS in")
|
|
console.log("# apps/desktop/electron/connect-link-keys.mjs under this kid.")
|
|
console.log("# 3. Never commit the private key.")
|
|
console.log()
|
|
console.log("== PRIVATE KEY (secret) ==")
|
|
console.log(privateKey.trimEnd())
|
|
console.log()
|
|
console.log("== PUBLIC KEY (embed in desktop build) ==")
|
|
console.log(publicKey.trimEnd())
|