Core certificate authority, part 1: Proxy

Cargo.toml

@@ -21,6 +21,7 @@ defguard_proxy_manager = { path = "./crates/defguard_proxy_manager", version = "
 defguard_session_manager = { path = "./crates/defguard_session_manager", version = "0.0.0" }
 defguard_version = { path = "./crates/defguard_version", version = "0.0.0" }
 defguard_web_ui = { path = "./crates/defguard_web_ui", version = "0.0.0" }
+defguard_certs = { path = "./crates/defguard_certs", version = "0.0.0" }
 model_derive = { path = "./crates/model_derive", version = "0.0.0" }
 
 # external dependencies
@@ -120,6 +121,8 @@ webauthn-rs = { version = "0.5", features = [
 ] }
 webauthn-rs-proto = "0.5"
 x25519-dalek = { version = "2.0", features = ["static_secrets"] }
+rcgen = { version = "0.14", features = ["x509-parser", "pem"] }
+rustls-pki-types = "1.13"
 
 [profile.release]
 codegen-units = 1

crates/defguard/Cargo.toml

@@ -16,6 +16,7 @@ defguard_event_logger = { workspace = true }
 defguard_mail = { workspace = true }
 defguard_proxy_manager = { workspace = true }
 defguard_version = { workspace = true }
+defguard_certs = { workspace = true }
 
 # external dependencies
 anyhow = { workspace = true }

crates/defguard/src/main.rs

@@ -12,7 +12,7 @@ use defguard_common::{
         models::{
             Settings,
             User,
-            settings::initialize_current_settings,
+            settings::{initialize_current_settings, update_current_settings},
             // wireguard_peer_stats::WireguardPeerStats,
         },
     },
@@ -128,6 +128,22 @@ async fn main() -> Result<(), anyhow::Error> {
     // initialize global settings struct
     initialize_current_settings(&pool).await?;
 
+    let mut settings = Settings::get_current_settings();
+    if settings.ca_cert_der.is_none() || settings.ca_key_der.is_none() {
+        info!(
+            "No gRPC TLS certificate or key found in settings, generating self-signed certificate for gRPC server."
+        );
+
+        let ca = defguard_certs::CertificateAuthority::new()?;
+
+        let (cert_der, key_der) = (ca.cert_der().to_vec(), ca.key_pair_der().to_vec());
+
+        settings.ca_cert_der = Some(cert_der);
+        settings.ca_key_der = Some(key_der);
+
+        update_current_settings(&pool, settings).await?;
+    }
+
     // read grpc TLS cert and key
     let grpc_cert = config
         .grpc_cert

crates/defguard_certs/Cargo.toml

@@ -0,0 +1,16 @@
+[package]
+name = "defguard_certs"
+version = "0.0.0"
+edition.workspace = true
+license-file.workspace = true
+homepage.workspace = true
+repository.workspace = true
+rust-version.workspace = true
+
+[dependencies]
+base64.workspace = true
+rcgen.workspace = true
+serde.workspace = true
+sqlx.workspace = true
+thiserror.workspace = true
+rustls-pki-types.workspace = true