weylus_tls.sh

#!/usr/bin/env sh

function die {
    # cleanup to ensure restarting this script doesn't fail because
    # of ports that are still in use
    kill $(jobs -p) > /dev/null 2>&1
    exit $1
}

# generate certificate if it doesn't exist yet
if [ ! -e weylus.pem ]
then
    openssl req -batch -newkey rsa:4096 -sha256 -keyout weylus.key -nodes -x509 -days 365 \
        -subj="/CN=Weylus" -out weylus.crt

    # combine into a pem file as this is everything hitch needs
    cat weylus.key weylus.crt > weylus.pem
    rm weylus.key weylus.crt
fi

# WEYLUS can be used to determine which version of Weylus to run
# If unset, try ./weylus and then weylus from path. If both fail,
# read the path to Weylus from stdin.
if [ -z "$WEYLUS" ]
then
    if [ -e weylus ]
    then
        WEYLUS=./weylus
    else
        if which weylus > /dev/null 2>&1
        then
            WEYLUS=weylus
        else
            echo "Please specify path to weylus."
            echo -n "> "
            read -r WEYLUS
        fi
    fi
fi

if [ -z "$ACCESS_CODE" ]
then
    # generate access code if none is given
    ACCESS_CODE="$(openssl rand -base64 12)"
    echo "Autogenerated access code: $ACCESS_CODE"
fi

# cleanup on CTRL+C
trap die SIGINT

# The TLS proxy will be set up as follows: Proxy all incoming traffic from
# port 1701 to 1702 on which the actual instance of Weylus is running.

# start Weylus listening only on the local interface
$WEYLUS --bind-address "127.0.0.1" \
    --web-port "1702" \
    --access-code "$ACCESS_CODE" \
    --no-gui &

# start the proxy
hitch --frontend="[0.0.0.0]:1701" --backend="[127.0.0.1]:1702" \
    --daemon=off --tls-protos="TLSv1.2 TLSv1.3" "weylus.pem" &

wait