standardize MLS deployment

Author: Veki301

bin/offline-secrets.sh

@@ -15,13 +15,19 @@ minio_secret_key="$(tr -dc A-Za-z0-9 </dev/urandom | head -c 42)"
 minio_cargohold_access_key="$(tr -dc A-Za-z0-9 </dev/urandom | head -c 20)"
 minio_cargohold_secret_key="$(tr -dc A-Za-z0-9 </dev/urandom | head -c 30)"
 
-zauth="$(sudo docker run $ZAUTH_CONTAINER -m gen-keypair)"
+zauth="$(sudo docker run $ZAUTH_CONTAINER -m gen-keypair -i 1)"
 
 zauth_public=$(echo "$zauth" | awk 'NR==1{ print $2}')
 zauth_private=$(echo "$zauth" | awk 'NR==2{ print $2}')
 
 prometheus_pass="$(tr -dc A-Za-z0-9 </dev/urandom | head -c 16)"
 
+# Generate MLS private keys using openssl
+mls_ed25519_key="$(openssl genpkey -algorithm ed25519 2>/dev/null | awk '{printf "      %s\n", $0}')"
+mls_ecdsa_p256_key="$(openssl genpkey -algorithm ec -pkeyopt ec_paramgen_curve:P-256 2>/dev/null | awk '{printf "      %s\n", $0}')"
+mls_ecdsa_p384_key="$(openssl genpkey -algorithm ec -pkeyopt ec_paramgen_curve:P-384 2>/dev/null | awk '{printf "      %s\n", $0}')"
+mls_ecdsa_p521_key="$(openssl genpkey -algorithm ec -pkeyopt ec_paramgen_curve:P-521 2>/dev/null | awk '{printf "      %s\n", $0}')"
+
 if [[ ! -f $VALUES_DIR/wire-server/secrets.yaml ]]; then
   echo "Writing $VALUES_DIR/wire-server/secrets.yaml"
   cat <<EOF > $VALUES_DIR/wire-server/secrets.yaml
@@ -61,9 +67,22 @@ cannon:
       password: verysecurepassword
 galley:
   secrets:
+    rabbitmq:
+      username: wire-server
+      password: verysecurepassword
     pgPassword: verysecurepassword
     awsKeyId: dummykey
     awsSecretKey: dummysecret
+    mlsPrivateKeys:
+      removal:
+        ed25519: |
+$mls_ed25519_key
+        ecdsa_secp256r1_sha256: |
+$mls_ecdsa_p256_key
+        ecdsa_secp384r1_sha384: |
+$mls_ecdsa_p384_key
+        ecdsa_secp521r1_sha512: |
+$mls_ecdsa_p521_key
 gundeck:
   secrets:
     awsKeyId: dummykey

values/wire-server/prod-secrets.example.yaml

@@ -55,6 +55,20 @@ galley:
     rabbitmq:
       username: wire-server
       password: verysecurepassword
+    mlsPrivateKeys:
+      removal:
+        ed25519: |
+          -----BEGIN PRIVATE KEY-----
+          -----END PRIVATE KEY-----
+        ecdsa_secp256r1_sha256: |
+          -----BEGIN PRIVATE KEY-----
+          -----END PRIVATE KEY-----
+        ecdsa_secp384r1_sha384: |
+          -----BEGIN PRIVATE KEY-----
+          -----END PRIVATE KEY-----
+        ecdsa_secp521r1_sha512: |
+          -----BEGIN PRIVATE KEY-----
+          -----END PRIVATE KEY-----
 
 gundeck:
   secrets: