From afb44c0b11a9332c60e6d3198c27a8742d71d17b Mon Sep 17 00:00:00 2001
From: nagumii <nagumi@gmail.com>
Date: Thu, 6 Feb 2025 12:59:13 +0200
Subject: [PATCH] Generate ttyd SSL encryption on first boot and whenever
 hostname changes

---
 .../etc/systemd/system/ttyd.service           |  4 ++--
 .../usr/local/bin/femto-network-config.sh     |  2 ++
 .../usr/local/bin/femto-runonce.sh            | 13 +++++------
 .../usr/local/bin/femto-utils.sh              | 23 ++++++++++++++++---
 4 files changed, 30 insertions(+), 12 deletions(-)

diff --git a/foxbuntu/sysdrv/out/rootfs_uclibc_rv1106/etc/systemd/system/ttyd.service b/foxbuntu/sysdrv/out/rootfs_uclibc_rv1106/etc/systemd/system/ttyd.service
index ab6cd49..5f3e727 100644
--- a/foxbuntu/sysdrv/out/rootfs_uclibc_rv1106/etc/systemd/system/ttyd.service
+++ b/foxbuntu/sysdrv/out/rootfs_uclibc_rv1106/etc/systemd/system/ttyd.service
@@ -4,11 +4,11 @@ After=syslog.target
 After=network.target
 
 [Service]
-ExecStart=/opt/ttyd/ttyd -W -6 login
+ExecStart=/opt/ttyd/ttyd -W -6 --ssl --ssl-key /etc/ssl/private/ttyd.key --ssl-cert /etc/ssl/certs/ttyd.crt -i 0.0.0.0 login
 Type=simple
 Restart=always
 User=root
 Group=root
 
 [Install]
-WantedBy=multi-user.target
\ No newline at end of file
+WantedBy=multi-user.target
diff --git a/foxbuntu/sysdrv/out/rootfs_uclibc_rv1106/usr/local/bin/femto-network-config.sh b/foxbuntu/sysdrv/out/rootfs_uclibc_rv1106/usr/local/bin/femto-network-config.sh
index 362c0fd..bbd4fda 100755
--- a/foxbuntu/sysdrv/out/rootfs_uclibc_rv1106/usr/local/bin/femto-network-config.sh
+++ b/foxbuntu/sysdrv/out/rootfs_uclibc_rv1106/usr/local/bin/femto-network-config.sh
@@ -150,6 +150,8 @@ $wifi_settings"
       sed -i "s/$(hostname)/$OPTARG/g" /etc/hosts
       hostnamectl set-hostname "$OPTARG"
       systemctl restart avahi-daemon
+      echo "Regenerating web terminal ssl keys..."
+      femto-utils.sh -T
       ;;
     \?)  # Invalid option
       echo "Invalid option: -$OPTARG"
diff --git a/foxbuntu/sysdrv/out/rootfs_uclibc_rv1106/usr/local/bin/femto-runonce.sh b/foxbuntu/sysdrv/out/rootfs_uclibc_rv1106/usr/local/bin/femto-runonce.sh
index 540838a..46bdeb2 100755
--- a/foxbuntu/sysdrv/out/rootfs_uclibc_rv1106/usr/local/bin/femto-runonce.sh
+++ b/foxbuntu/sysdrv/out/rootfs_uclibc_rv1106/usr/local/bin/femto-runonce.sh
@@ -63,14 +63,13 @@ else
 	log_message "Swap file already allocated, skipping"
 fi
 
-#generate keys
+#generate SSH keys
 log_message "Generating new SSH encryption keys. This can take a minute..."
-sudo rm /etc/ssh/ssh_host_*
-sudo ssh-keygen -q -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ""
-sudo ssh-keygen -q -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N ""
-sudo chmod 600 /etc/ssh/ssh_host_*_key
-sudo chmod 644 /etc/ssh/ssh_host_*_key.pub
-sudo chown root:root /etc/ssh/ssh_host_*
+femto-utils.sh -E
+
+#generate ttyd SSL keys
+log_message "Generating new Web Terminal SSL encryption keys. This can take a minute..."
+femto-utils.sh -T
 
 # prevent randomized mac address for eth0. If `eth0`` is already present in /etc/network/interfaces, skip
 mac="$(awk '/Serial/ {print $3}' /proc/cpuinfo | tail -c 11 | sed 's/^\(.*\)/a2\1/' | sed 's/\(..\)/\1:/g;s/:$//')"
diff --git a/foxbuntu/sysdrv/out/rootfs_uclibc_rv1106/usr/local/bin/femto-utils.sh b/foxbuntu/sysdrv/out/rootfs_uclibc_rv1106/usr/local/bin/femto-utils.sh
index 3978ed8..be31bf4 100755
--- a/foxbuntu/sysdrv/out/rootfs_uclibc_rv1106/usr/local/bin/femto-utils.sh
+++ b/foxbuntu/sysdrv/out/rootfs_uclibc_rv1106/usr/local/bin/femto-utils.sh
@@ -18,7 +18,9 @@ Options are:
 -n             Networking info
 -o             OS info
 -S             Storage & RAM info
--t "enable"    Enable/disable/start/stop/check ttyd (http based terminal).  Options: "enable" "disable" "start" "stop" "check"
+-t "enable"    Enable/disable/start/stop/check ttyd (web terminal).  Options: "enable" "disable" "start" "stop" "check"
+-T             Generate/overwrite ttyd encryption keys
+-E             Generate/overwrite SSH encryption keys
 
 EOF
 )
@@ -233,7 +235,7 @@ ttyd() {
   fi
 }
 
-while getopts ":harsl:ipcnoSt:" opt; do
+while getopts ":harsl:ipcnoSt:TE" opt; do
   case ${opt} in
     h) # Option -h (help)
       echo -e $help
@@ -258,7 +260,22 @@ while getopts ":harsl:ipcnoSt:" opt; do
     n) networking_info ;; # Option -n (Networing info)
     o) os_info ;; # Option -o (OS info)
     S) storage_info ;; # Option -S (Storage & RAM info)
-    t) ttyd $OPTARG ;; # Option -t (ttyd)
+    t) ttyd $OPTARG ;; # Option -t (ttyd service manager)
+    T) # Option -T (new ttyd SSL keys)
+      openssl req -new -newkey rsa:4096 -days 3650 -nodes -x509 -keyout /etc/ssl/private/ttyd.key -out /etc/ssl/certs/ttyd.crt   -subj "/CN=$(hostname)" -addext "subjectAltName=DNS:$(hostname)"
+      chmod 600 /etc/ssl/private/ttyd.key
+      chmod 644 /etc/ssl/certs/ttyd.crt
+      systemctl restart ttyd
+    ;;
+    E) # Option -E (new SSH encryption keys)
+      rm /etc/ssh/ssh_host_*
+      ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ""
+      ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N ""
+      chmod 600 /etc/ssh/ssh_host_*_key
+      chmod 644 /etc/ssh/ssh_host_*_key.pub
+      chown root:root /etc/ssh/ssh_host_*
+      systemctl restart ssh
+    ;;
     \?) # Unknown option)
       echo -e "Unknown argument $1.\n$help"
     ;;