Move CNCF distribution registry TLS cert & key generation to system unit

- Moving to system unit allows the generation scriptto update the system trust store
- Distribution quadlet waits for TLS cert & key generation using path activation

2 files changed, 60 insertions, 10 deletions

diff --git a/meta-unit-core/dynamic-layers/virtualization-layer/recipes-core/systemd/systemd-regkeygen/regkeygen.service b/meta-unit-core/dynamic-layers/virtualization-layer/recipes-core/systemd/systemd-regkeygen/regkeygen.service
index 6f1eca2..e5f2cab 100644
--- a/meta-unit-core/dynamic-layers/virtualization-layer/recipes-core/systemd/systemd-regkeygen/regkeygen.service
+++ b/meta-unit-core/dynamic-layers/virtualization-layer/recipes-core/systemd/systemd-regkeygen/regkeygen.service
@@ -1,12 +1,19 @@
 [Unit]
-Description=Generate distribution TLS keys
-ConditionPathExists=!%h/.config/containers/distribution/certs/domain.crt
-ConditionPathExists=!%h/.config/containers/distribution/certs/domain.key
+Description=Generate registry TLS keys for device
+ConditionPathExists=!/home/svc/.config/containers/distribution/certs/domain.crt
+ConditionPathExists=!/home/svc/.config/containers/distribution/certs/domain.key
+ConditionPathExists=!/usr/local/share/ca-certificates/registry.crt
+ConditionPathExists=!/etc/containers/certs.d/localhost:5000/ca.crt
+ConditionPathExists=!/home/svc/.config/containers/certs.d/localhost:5000/ca.crt
+ConditionPathExists=!/home/svc/.local/share/distribution/certs-ready-signal
+After=time-sync.target
+Wants=time-sync.target systemd-time-wait-sync.service
 
 [Service]
 Type=oneshot
-Environment="XDG_CONFIG_HOME=%h/.config"
-ExecStart=%h/bin/regkeygen.sh
+ExecStart=/usr/bin/regkeygen.sh
+Environment="TARGET_USR=svc"
+Environment="DISTRIBUTION_REGISTRY_URL=localhost:5000"
 
 [Install]
-WantedBy=default.target
+WantedBy=multi-user.target
diff --git a/meta-unit-core/dynamic-layers/virtualization-layer/recipes-core/systemd/systemd-regkeygen/regkeygen.sh b/meta-unit-core/dynamic-layers/virtualization-layer/recipes-core/systemd/systemd-regkeygen/regkeygen.sh
index e929194..f1286dd 100644
--- a/meta-unit-core/dynamic-layers/virtualization-layer/recipes-core/systemd/systemd-regkeygen/regkeygen.sh
+++ b/meta-unit-core/dynamic-layers/virtualization-layer/recipes-core/systemd/systemd-regkeygen/regkeygen.sh
@@ -1,10 +1,32 @@
 #!/bin/sh
 
+XDG_LOCAL_HOME="/home/$TARGET_USR/.local"
+XDG_CONFIG_HOME="/home/$TARGET_USR/.config"
+
 set -e
 
-echo "Generating TLS certificate and key for distribution..."
+echo "Cleaning up any previous artifacts..."
+
+rm -f "$XDG_CONFIG_HOME/containers/distribution/certs/domain.key"
+rm -f "$XDG_CONFIG_HOME/containers/distribution/certs/domain.crt"
+rm -f /usr/local/share/ca-certificates/registry.crt
+rm -f "/etc/containers/certs.d/$DISTRIBUTION_REGISTRY_URL/ca.crt"
+rm -f "$XDG_CONFIG_HOME/containers/certs.d/$DISTRIBUTION_REGISTRY_URL/ca.crt"
+rm -f "$XDG_LOCAL_HOME/share/distribution/certs-ready-signal"
+
+echo "Creating necessary system directories..."
+
+mkdir -p "/etc/containers/certs.d/$DISTRIBUTION_REGISTRY_URL/"
+mkdir -p /usr/local/share/ca-certificates
+
+echo "Creating necessary user directories..."
 
 mkdir -p "$XDG_CONFIG_HOME/containers/distribution/certs"
+mkdir -p "$XDG_CONFIG_HOME/containers/certs.d/$DISTRIBUTION_REGISTRY_URL"
+mkdir -p "$XDG_LOCAL_HOME/share/distribution"
+
+echo "Generating TLS certificate and key for local registry..."
+
 openssl req -x509 -newkey ec \
     -pkeyopt ec_paramgen_curve:P-256 \
     -keyout "$XDG_CONFIG_HOME/containers/distribution/certs/domain.key" \
@@ -16,12 +38,33 @@ openssl req -x509 -newkey ec \
 
 echo "Setting permissions on generated artifacts..."
 
-chmod 644 "$XDG_CONFIG_HOME/containers/distribution/certs/domain.key"
+chown $TARGET_USR:$TARGET_USR "$XDG_CONFIG_HOME/containers/distribution/certs/domain.key"
+chown $TARGET_USR:$TARGET_USR "$XDG_CONFIG_HOME/containers/distribution/certs/domain.crt"
+chmod 640 "$XDG_CONFIG_HOME/containers/distribution/certs/domain.key"
 chmod 644 "$XDG_CONFIG_HOME/containers/distribution/certs/domain.crt"
 
+echo "Adding CA to system trust store..."
+
+cp -f "$XDG_CONFIG_HOME/containers/distribution/certs/domain.crt" /usr/local/share/ca-certificates/registry.crt
+update-ca-certificates
+
+echo "Adding CA to containers trust store..."
+
+cp -f "$XDG_CONFIG_HOME/containers/distribution/certs/domain.crt" "/etc/containers/certs.d/$DISTRIBUTION_REGISTRY_URL/ca.crt"
+
 echo "Adding CA to user containers trust store..."
 
-mkdir -p "$XDG_CONFIG_HOME/containers/localhost:5000/"
-cp "$XDG_CONFIG_HOME/containers/distribution/certs/domain.crt" "$XDG_CONFIG_HOME/containers/localhost:5000/ca.crt"
+chown -R $TARGET_USR:$TARGET_USR "$XDG_CONFIG_HOME/containers/certs.d"
+chmod 755 "$XDG_CONFIG_HOME/containers/certs.d/$DISTRIBUTION_REGISTRY_URL"
+
+cp -f "$XDG_CONFIG_HOME/containers/distribution/certs/domain.crt" "$XDG_CONFIG_HOME/containers/certs.d/$DISTRIBUTION_REGISTRY_URL/ca.crt"
+chown $TARGET_USR:$TARGET_USR "$XDG_CONFIG_HOME/containers/certs.d/$DISTRIBUTION_REGISTRY_URL/ca.crt"
+chmod 644 "$XDG_CONFIG_HOME/containers/certs.d/$DISTRIBUTION_REGISTRY_URL/ca.crt"
+
+echo "Creating signal file..."
+
+chown -R $TARGET_USR:$TARGET_USR "$XDG_LOCAL_HOME/share/distribution"
+touch "$XDG_LOCAL_HOME/share/distribution/certs-ready-signal"
+chmod 644 "$XDG_LOCAL_HOME/share/distribution/certs-ready-signal"
 
 echo "Registry TLS configuration created and ready for use"