69 lines
2.1 KiB
Markdown
69 lines
2.1 KiB
Markdown
# Cheese
|
|
|
|
A Certificate Transparency log configuration and deployment tool for Google's [[TesseraCT](github.com/transparency-dev/tesseract)] implementation. It tries to look and feel a little like the one provided by [[Sunlight](https://github.com/FiloSottile/sunlight)].
|
|
|
|
## Configuration Generator
|
|
|
|
The `tesseract/genconf` tool generates CT log configuration files and keys from a YAML specification
|
|
in a very similar way to Sunlight.
|
|
|
|
### Usage
|
|
|
|
1. **Build the tool:**
|
|
```bash
|
|
go build -o tesseract-genconf ./tesseract/genconf/
|
|
```
|
|
|
|
2. **Create YAML configuration file:**
|
|
|
|
```yaml
|
|
listen:
|
|
- "[::]:8080"
|
|
roots: /etc/tesseract/roots.pem
|
|
logs:
|
|
- shortname: example2025h1
|
|
listen: "[::]:16900"
|
|
inception: 2025-01-01
|
|
submissionprefix: https://example2025h1.log.ct.example.com
|
|
monitoringprefix: https://example2025h1.mon.ct.example.com
|
|
extraroots: /etc/tesseract/extra-roots.pem
|
|
secret: /etc/tesseract/keys/example2025h1.pem
|
|
localdirectory: /var/lib/tesseract/example2025h1/data
|
|
notafterstart: 2025-01-01T00:00:00Z
|
|
notafterlimit: 2025-07-01T00:00:00Z
|
|
```
|
|
|
|
3. **Generate private keys:**
|
|
```bash
|
|
mkdir -p /etc/tesseract/keys
|
|
./tesseract-genconf -c config.yaml gen-key
|
|
```
|
|
|
|
4. **Create directories and generate environment files:**
|
|
```bash
|
|
mkdir -p /var/lib/tesseract/example2025h1/data
|
|
./tesseract-genconf -c config.yaml gen-env
|
|
```
|
|
|
|
5. **Generate HTML and JSON files:**
|
|
```bash
|
|
./tesseract-genconf -c config.yaml gen-html
|
|
```
|
|
|
|
6. **Generate nginx configuration files:**
|
|
```bash
|
|
./tesseract-genconf -c config.yaml gen-nginx
|
|
```
|
|
|
|
The port from the main `listen:` field will be used in the NGINX server blocks (in our case
|
|
`:8080`). You can symlink the generated $monitoringprefix.conf files from `/etc/nginx/sites-enabled/`.
|
|
|
|
7. **Generate root certificates (optional):**
|
|
```bash
|
|
# For testing/staging environment, take the ccadb 'testing' roots
|
|
./tesseract-genconf gen-roots --source https://rennet2027h2.log.ct.ipng.ch/ --output roots-staging.pem
|
|
|
|
# For production environment, take the ccadb 'production' roots
|
|
./tesseract-genconf gen-roots --source https://gouda2027h2.log.ct.ipng.ch/ --output roots-production.pem
|
|
```
|