73 lines
2.5 KiB
Python
73 lines
2.5 KiB
Python
"""authentik crypto app config"""
|
|
from datetime import datetime
|
|
from typing import TYPE_CHECKING, Optional
|
|
|
|
from authentik.blueprints.apps import ManagedAppConfig
|
|
from authentik.lib.generators import generate_id
|
|
|
|
if TYPE_CHECKING:
|
|
from authentik.crypto.models import CertificateKeyPair
|
|
|
|
MANAGED_KEY = "goauthentik.io/crypto/jwt-managed"
|
|
|
|
|
|
class AuthentikCryptoConfig(ManagedAppConfig):
|
|
"""authentik crypto app config"""
|
|
|
|
name = "authentik.crypto"
|
|
label = "authentik_crypto"
|
|
verbose_name = "authentik Crypto"
|
|
default = True
|
|
|
|
def reconcile_load_crypto_tasks(self):
|
|
"""Load crypto tasks"""
|
|
self.import_module("authentik.crypto.tasks")
|
|
|
|
def _create_update_cert(self, cert: Optional["CertificateKeyPair"] = None):
|
|
from authentik.crypto.builder import CertificateBuilder
|
|
from authentik.crypto.models import CertificateKeyPair
|
|
|
|
builder = CertificateBuilder()
|
|
builder.common_name = "goauthentik.io"
|
|
builder.build(
|
|
subject_alt_names=["goauthentik.io"],
|
|
validity_days=360,
|
|
)
|
|
if not cert:
|
|
|
|
cert = CertificateKeyPair()
|
|
cert.certificate_data = builder.certificate
|
|
cert.key_data = builder.private_key
|
|
cert.name = "authentik Internal JWT Certificate"
|
|
cert.managed = MANAGED_KEY
|
|
cert.save()
|
|
|
|
def reconcile_managed_jwt_cert(self):
|
|
"""Ensure managed JWT certificate"""
|
|
from authentik.crypto.models import CertificateKeyPair
|
|
|
|
certs = CertificateKeyPair.objects.filter(managed=MANAGED_KEY)
|
|
if not certs.exists():
|
|
self._create_update_cert()
|
|
return
|
|
cert: CertificateKeyPair = certs.first()
|
|
now = datetime.now()
|
|
if now < cert.certificate.not_valid_before or now > cert.certificate.not_valid_after:
|
|
self._create_update_cert(cert)
|
|
|
|
def reconcile_self_signed(self):
|
|
"""Create self-signed keypair"""
|
|
from authentik.crypto.builder import CertificateBuilder
|
|
from authentik.crypto.models import CertificateKeyPair
|
|
|
|
name = "authentik Self-signed Certificate"
|
|
if CertificateKeyPair.objects.filter(name=name).exists():
|
|
return
|
|
builder = CertificateBuilder()
|
|
builder.build(subject_alt_names=[f"{generate_id()}.self-signed.goauthentik.io"])
|
|
CertificateKeyPair.objects.create(
|
|
name="authentik Self-signed Certificate",
|
|
certificate_data=builder.certificate,
|
|
key_data=builder.private_key,
|
|
)
|