@opsimathically/nodenetproccalld 0.0.2 → 0.0.3

package/README.md

@@ -84,14 +84,33 @@ nodenetproccalld \
   --default-config-overwrite
 ```
 
-4. Generate TLS material for fresh installs (CA/server/client):
+4. Generate a default TLS-generation JSON5 config:
 
 ```bash
-nodenetproccalld --generate-tls-material
+nodenetproccalld --generate-default-tls-config
 ```
 
 By default this writes:
 
+- `./config/tls_generation.config.json5`
+
+You can choose a different output path:
+
+```bash
+nodenetproccalld \
+  --generate-default-tls-config \
+  --default-tls-config-file ./config/tls_generation.config.json5 \
+  --default-tls-config-overwrite
+```
+
+5. Generate TLS material for fresh installs (CA/server/client):
+
+```bash
+nodenetproccalld --generate-tls-material --tls-generation-config ./config/tls_generation.config.json5
+```
+
+By default (from config) this writes:
+
 - `./config/certs/ca.key.pem`
 - `./config/certs/ca.cert.pem`
 - `./config/certs/server.key.pem`
@@ -99,11 +118,16 @@ By default this writes:
 - `./config/certs/client.key.pem`
 - `./config/certs/client.cert.pem`
 
-Useful options:
+This JSON5 config controls SAN values (`server_dns_sans`, `server_ip_sans`) so the generated
+server certificate matches real hostnames like `your_server_name_here`, FQDNs, or service IPs.
+`output_dir` in this config is interpreted relative to your current working directory.
+
+You can still override via direct CLI options when needed:
 
 ```bash
 nodenetproccalld \
   --generate-tls-material \
+  --tls-generation-config ./config/tls_generation.config.json5 \
   --tls-output-dir ./config/certs \
   --tls-overwrite \
   --tls-ca-cn my-local-ca \
@@ -112,7 +136,29 @@ nodenetproccalld \
   --tls-valid-days 365
 ```
 
-5. Start daemon with custom config paths:
+6. Generate a default client TLS package JSON5 config:
+
+```bash
+nodenetproccalld --generate-default-client-tls-config
+```
+
+By default this writes:
+
+- `./config/client_tls_packages.config.json5`
+
+7. Generate client certificate packages from JSON5 config:
+
+```bash
+nodenetproccalld \
+  --generate-client-tls-packages \
+  --client-tls-generation-config ./config/client_tls_packages.config.json5
+```
+
+This reads CA key/cert paths from the config file and outputs per-client bundle tarballs in
+the configured output directory (default template uses `./config/client_certs`).
+Paths in `client_tls_packages.config.json5` are resolved relative to that config file.
+
+8. Start daemon with custom config paths:
 
 ```bash
 nodenetproccalld \
@@ -120,7 +166,7 @@ nodenetproccalld \
   --api-keys-config /absolute/or/relative/api_keys.config.json5
 ```
 
-6. CLI help:
+9. CLI help:
 
 ```bash
 nodenetproccalld --help

package/dist/index.d.mts

@@ -115,14 +115,103 @@ type daemon_generated_default_config_t = {
 
 type daemon_tls_generation_options_t = {
   enabled: boolean;
+  config_file_path?: string;
   output_dir: string;
   overwrite: boolean;
   ca_common_name: string;
   server_common_name: string;
   client_common_name: string;
+  server_dns_sans: string[];
+  server_ip_sans: string[];
+  client_uri_san?: string;
   valid_days: number;
 };
 
+type daemon_tls_generation_config_file_t = {
+  output_dir?: string;
+  overwrite?: boolean;
+  ca_common_name?: string;
+  server_common_name?: string;
+  client_common_name?: string;
+  server_dns_sans?: string[];
+  server_ip_sans?: string[];
+  client_uri_san?: string;
+  valid_days?: number;
+};
+
+type daemon_default_tls_config_generation_options_t = {
+  enabled: boolean;
+  output_file_path: string;
+  overwrite: boolean;
+};
+
+type daemon_generated_default_tls_config_t = {
+  output_file_path: string;
+};
+
+type daemon_client_tls_package_config_client_t = {
+  client_name: string;
+  common_name?: string;
+  uri_san?: string;
+  package_name?: string;
+  valid_days?: number;
+};
+
+type daemon_client_tls_package_generation_config_file_t = {
+  ca_key_file: string;
+  ca_cert_file: string;
+  output_dir?: string;
+  overwrite?: boolean;
+  default_valid_days?: number;
+  clients: daemon_client_tls_package_config_client_t[];
+};
+
+type daemon_client_tls_package_generation_options_t = {
+  enabled: boolean;
+  config_file_path: string;
+};
+
+type daemon_default_client_tls_config_generation_options_t = {
+  enabled: boolean;
+  output_file_path: string;
+  overwrite: boolean;
+};
+
+type daemon_generated_default_client_tls_config_t = {
+  output_file_path: string;
+};
+
+type daemon_generated_client_tls_package_entry_t = {
+  client_name: string;
+  package_path: string;
+  directory_path: string;
+  client_cert_path: string;
+  client_key_path: string;
+  ca_cert_path: string;
+};
+
+type daemon_client_tls_package_runtime_client_t = {
+  client_name: string;
+  common_name: string;
+  uri_san: string;
+  package_name: string;
+  valid_days: number;
+};
+
+type daemon_client_tls_package_generation_runtime_options_t = {
+  ca_key_file: string;
+  ca_cert_file: string;
+  output_dir: string;
+  overwrite: boolean;
+  default_valid_days: number;
+  clients: daemon_client_tls_package_runtime_client_t[];
+};
+
+type daemon_generated_client_tls_packages_t = {
+  output_dir: string;
+  packages: daemon_generated_client_tls_package_entry_t[];
+};
+
 type daemon_generated_tls_material_t = {
   output_dir: string;
   ca_key_path: string;
@@ -136,7 +225,10 @@ type daemon_generated_tls_material_t = {
 type daemon_cli_options_t = daemon_config_paths_t & {
   help: boolean;
   default_config_generation: daemon_default_config_generation_options_t;
+  default_tls_config_generation: daemon_default_tls_config_generation_options_t;
+  default_client_tls_config_generation: daemon_default_client_tls_config_generation_options_t;
   tls_generation: daemon_tls_generation_options_t;
+  client_tls_package_generation: daemon_client_tls_package_generation_options_t;
 };
 
 type daemon_auth_callback_params_t = Parameters<networkprocedurecall_auth_callback_t>[0];
@@ -153,6 +245,30 @@ declare class ApiKeyAuthorizer {
     private matchOptionalValue;
 }
 
+declare class ClientTlsPackageConfigFileLoader {
+    loadClientTlsPackageOptions(params: {
+        client_tls_package_generation_options: daemon_client_tls_package_generation_options_t;
+    }): daemon_client_tls_package_generation_runtime_options_t;
+    private buildRuntimeClients;
+    private assertUniqueClientNames;
+    private assertUniquePackageNames;
+}
+
+declare class ClientTlsPackageGenerator {
+    generateClientTlsPackages(params: {
+        runtime_options: daemon_client_tls_package_generation_runtime_options_t;
+    }): daemon_generated_client_tls_packages_t;
+    private assertOpenSslAvailable;
+    private assertTarAvailable;
+    private assertCaFiles;
+    private buildClientFileMap;
+    private prepareClientOutput;
+    private generateClientCertificate;
+    private writeClientReadme;
+    private createTarPackage;
+    private runOpenSslCommand;
+}
+
 declare class ConfigValidator {
     validateServerConfig(params: {
         server_config_raw: unknown;
@@ -204,12 +320,24 @@ declare class DaemonProcess {
     private requestStop;
 }
 
+declare class DefaultClientTlsGenerationConfigGenerator {
+    generateDefaultClientTlsGenerationConfig(params: {
+        default_client_tls_config_generation_options: daemon_default_client_tls_config_generation_options_t;
+    }): daemon_generated_default_client_tls_config_t;
+}
+
 declare class DefaultConfigGenerator {
     generateDefaultConfig(params: {
         default_config_generation_options: daemon_default_config_generation_options_t;
     }): daemon_generated_default_config_t;
 }
 
+declare class DefaultTlsGenerationConfigGenerator {
+    generateDefaultTlsGenerationConfig(params: {
+        default_tls_config_generation_options: daemon_default_tls_config_generation_options_t;
+    }): daemon_generated_default_tls_config_t;
+}
+
 type daemon_lifecycle_state_t = 'stopped' | 'starting' | 'running' | 'stopping';
 type daemon_runtime_snapshot_t = {
     lifecycle_state: daemon_lifecycle_state_t;
@@ -247,6 +375,13 @@ declare class NetworkProcedureCallDaemon {
     private logMessage;
 }
 
+declare class TlsGenerationConfigFileLoader {
+    loadTlsGenerationOptions(params: {
+        config_file_path: string;
+        fallback_options: daemon_tls_generation_options_t;
+    }): daemon_tls_generation_options_t;
+}
+
 declare class TlsMaterialGenerator {
     generateTlsMaterial(params: {
         tls_generation_options: daemon_tls_generation_options_t;
@@ -262,4 +397,4 @@ declare class TlsMaterialGenerator {
     private getErrorMessage;
 }
 
-export { ApiKeyAuthorizer, ConfigFileLoader, ConfigValidator, DaemonCli, DaemonProcess, DefaultConfigGenerator, NetworkProcedureCallDaemon, TlsMaterialGenerator, type daemon_api_key_entry_t, type daemon_api_key_identity_constraints_t, type daemon_api_keys_config_file_t, type daemon_cli_options_t, type daemon_config_paths_t, type daemon_default_config_generation_options_t, type daemon_generated_default_config_t, type daemon_generated_tls_material_t, type daemon_observability_config_t, type daemon_runtime_api_key_entry_t, type daemon_runtime_config_t, type daemon_server_config_file_t, type daemon_tls_file_config_t, type daemon_tls_generation_options_t, type daemon_worker_config_t };
+export { ApiKeyAuthorizer, ClientTlsPackageConfigFileLoader, ClientTlsPackageGenerator, ConfigFileLoader, ConfigValidator, DaemonCli, DaemonProcess, DefaultClientTlsGenerationConfigGenerator, DefaultConfigGenerator, DefaultTlsGenerationConfigGenerator, NetworkProcedureCallDaemon, TlsGenerationConfigFileLoader, TlsMaterialGenerator, type daemon_api_key_entry_t, type daemon_api_key_identity_constraints_t, type daemon_api_keys_config_file_t, type daemon_cli_options_t, type daemon_client_tls_package_config_client_t, type daemon_client_tls_package_generation_config_file_t, type daemon_client_tls_package_generation_options_t, type daemon_client_tls_package_generation_runtime_options_t, type daemon_client_tls_package_runtime_client_t, type daemon_config_paths_t, type daemon_default_client_tls_config_generation_options_t, type daemon_default_config_generation_options_t, type daemon_default_tls_config_generation_options_t, type daemon_generated_client_tls_package_entry_t, type daemon_generated_client_tls_packages_t, type daemon_generated_default_client_tls_config_t, type daemon_generated_default_config_t, type daemon_generated_default_tls_config_t, type daemon_generated_tls_material_t, type daemon_observability_config_t, type daemon_runtime_api_key_entry_t, type daemon_runtime_config_t, type daemon_server_config_file_t, type daemon_tls_file_config_t, type daemon_tls_generation_config_file_t, type daemon_tls_generation_options_t, type daemon_worker_config_t };

package/dist/index.d.ts

@@ -115,14 +115,103 @@ type daemon_generated_default_config_t = {
 
 type daemon_tls_generation_options_t = {
   enabled: boolean;
+  config_file_path?: string;
   output_dir: string;
   overwrite: boolean;
   ca_common_name: string;
   server_common_name: string;
   client_common_name: string;
+  server_dns_sans: string[];
+  server_ip_sans: string[];
+  client_uri_san?: string;
   valid_days: number;
 };
 
+type daemon_tls_generation_config_file_t = {
+  output_dir?: string;
+  overwrite?: boolean;
+  ca_common_name?: string;
+  server_common_name?: string;
+  client_common_name?: string;
+  server_dns_sans?: string[];
+  server_ip_sans?: string[];
+  client_uri_san?: string;
+  valid_days?: number;
+};
+
+type daemon_default_tls_config_generation_options_t = {
+  enabled: boolean;
+  output_file_path: string;
+  overwrite: boolean;
+};
+
+type daemon_generated_default_tls_config_t = {
+  output_file_path: string;
+};
+
+type daemon_client_tls_package_config_client_t = {
+  client_name: string;
+  common_name?: string;
+  uri_san?: string;
+  package_name?: string;
+  valid_days?: number;
+};
+
+type daemon_client_tls_package_generation_config_file_t = {
+  ca_key_file: string;
+  ca_cert_file: string;
+  output_dir?: string;
+  overwrite?: boolean;
+  default_valid_days?: number;
+  clients: daemon_client_tls_package_config_client_t[];
+};
+
+type daemon_client_tls_package_generation_options_t = {
+  enabled: boolean;
+  config_file_path: string;
+};
+
+type daemon_default_client_tls_config_generation_options_t = {
+  enabled: boolean;
+  output_file_path: string;
+  overwrite: boolean;
+};
+
+type daemon_generated_default_client_tls_config_t = {
+  output_file_path: string;
+};
+
+type daemon_generated_client_tls_package_entry_t = {
+  client_name: string;
+  package_path: string;
+  directory_path: string;
+  client_cert_path: string;
+  client_key_path: string;
+  ca_cert_path: string;
+};
+
+type daemon_client_tls_package_runtime_client_t = {
+  client_name: string;
+  common_name: string;
+  uri_san: string;
+  package_name: string;
+  valid_days: number;
+};
+
+type daemon_client_tls_package_generation_runtime_options_t = {
+  ca_key_file: string;
+  ca_cert_file: string;
+  output_dir: string;
+  overwrite: boolean;
+  default_valid_days: number;
+  clients: daemon_client_tls_package_runtime_client_t[];
+};
+
+type daemon_generated_client_tls_packages_t = {
+  output_dir: string;
+  packages: daemon_generated_client_tls_package_entry_t[];
+};
+
 type daemon_generated_tls_material_t = {
   output_dir: string;
   ca_key_path: string;
@@ -136,7 +225,10 @@ type daemon_generated_tls_material_t = {
 type daemon_cli_options_t = daemon_config_paths_t & {
   help: boolean;
   default_config_generation: daemon_default_config_generation_options_t;
+  default_tls_config_generation: daemon_default_tls_config_generation_options_t;
+  default_client_tls_config_generation: daemon_default_client_tls_config_generation_options_t;
   tls_generation: daemon_tls_generation_options_t;
+  client_tls_package_generation: daemon_client_tls_package_generation_options_t;
 };
 
 type daemon_auth_callback_params_t = Parameters<networkprocedurecall_auth_callback_t>[0];
@@ -153,6 +245,30 @@ declare class ApiKeyAuthorizer {
     private matchOptionalValue;
 }
 
+declare class ClientTlsPackageConfigFileLoader {
+    loadClientTlsPackageOptions(params: {
+        client_tls_package_generation_options: daemon_client_tls_package_generation_options_t;
+    }): daemon_client_tls_package_generation_runtime_options_t;
+    private buildRuntimeClients;
+    private assertUniqueClientNames;
+    private assertUniquePackageNames;
+}
+
+declare class ClientTlsPackageGenerator {
+    generateClientTlsPackages(params: {
+        runtime_options: daemon_client_tls_package_generation_runtime_options_t;
+    }): daemon_generated_client_tls_packages_t;
+    private assertOpenSslAvailable;
+    private assertTarAvailable;
+    private assertCaFiles;
+    private buildClientFileMap;
+    private prepareClientOutput;
+    private generateClientCertificate;
+    private writeClientReadme;
+    private createTarPackage;
+    private runOpenSslCommand;
+}
+
 declare class ConfigValidator {
     validateServerConfig(params: {
         server_config_raw: unknown;
@@ -204,12 +320,24 @@ declare class DaemonProcess {
     private requestStop;
 }
 
+declare class DefaultClientTlsGenerationConfigGenerator {
+    generateDefaultClientTlsGenerationConfig(params: {
+        default_client_tls_config_generation_options: daemon_default_client_tls_config_generation_options_t;
+    }): daemon_generated_default_client_tls_config_t;
+}
+
 declare class DefaultConfigGenerator {
     generateDefaultConfig(params: {
         default_config_generation_options: daemon_default_config_generation_options_t;
     }): daemon_generated_default_config_t;
 }
 
+declare class DefaultTlsGenerationConfigGenerator {
+    generateDefaultTlsGenerationConfig(params: {
+        default_tls_config_generation_options: daemon_default_tls_config_generation_options_t;
+    }): daemon_generated_default_tls_config_t;
+}
+
 type daemon_lifecycle_state_t = 'stopped' | 'starting' | 'running' | 'stopping';
 type daemon_runtime_snapshot_t = {
     lifecycle_state: daemon_lifecycle_state_t;
@@ -247,6 +375,13 @@ declare class NetworkProcedureCallDaemon {
     private logMessage;
 }
 
+declare class TlsGenerationConfigFileLoader {
+    loadTlsGenerationOptions(params: {
+        config_file_path: string;
+        fallback_options: daemon_tls_generation_options_t;
+    }): daemon_tls_generation_options_t;
+}
+
 declare class TlsMaterialGenerator {
     generateTlsMaterial(params: {
         tls_generation_options: daemon_tls_generation_options_t;
@@ -262,4 +397,4 @@ declare class TlsMaterialGenerator {
     private getErrorMessage;
 }
 
-export { ApiKeyAuthorizer, ConfigFileLoader, ConfigValidator, DaemonCli, DaemonProcess, DefaultConfigGenerator, NetworkProcedureCallDaemon, TlsMaterialGenerator, type daemon_api_key_entry_t, type daemon_api_key_identity_constraints_t, type daemon_api_keys_config_file_t, type daemon_cli_options_t, type daemon_config_paths_t, type daemon_default_config_generation_options_t, type daemon_generated_default_config_t, type daemon_generated_tls_material_t, type daemon_observability_config_t, type daemon_runtime_api_key_entry_t, type daemon_runtime_config_t, type daemon_server_config_file_t, type daemon_tls_file_config_t, type daemon_tls_generation_options_t, type daemon_worker_config_t };
+export { ApiKeyAuthorizer, ClientTlsPackageConfigFileLoader, ClientTlsPackageGenerator, ConfigFileLoader, ConfigValidator, DaemonCli, DaemonProcess, DefaultClientTlsGenerationConfigGenerator, DefaultConfigGenerator, DefaultTlsGenerationConfigGenerator, NetworkProcedureCallDaemon, TlsGenerationConfigFileLoader, TlsMaterialGenerator, type daemon_api_key_entry_t, type daemon_api_key_identity_constraints_t, type daemon_api_keys_config_file_t, type daemon_cli_options_t, type daemon_client_tls_package_config_client_t, type daemon_client_tls_package_generation_config_file_t, type daemon_client_tls_package_generation_options_t, type daemon_client_tls_package_generation_runtime_options_t, type daemon_client_tls_package_runtime_client_t, type daemon_config_paths_t, type daemon_default_client_tls_config_generation_options_t, type daemon_default_config_generation_options_t, type daemon_default_tls_config_generation_options_t, type daemon_generated_client_tls_package_entry_t, type daemon_generated_client_tls_packages_t, type daemon_generated_default_client_tls_config_t, type daemon_generated_default_config_t, type daemon_generated_default_tls_config_t, type daemon_generated_tls_material_t, type daemon_observability_config_t, type daemon_runtime_api_key_entry_t, type daemon_runtime_config_t, type daemon_server_config_file_t, type daemon_tls_file_config_t, type daemon_tls_generation_config_file_t, type daemon_tls_generation_options_t, type daemon_worker_config_t };