chore: sync local changes

deploy/clickhouse/configure_clickhouse_https.sh

@@ -46,18 +46,12 @@ CH_CERT_CN="${CH_CERT_CN:-$(hostname -f 2>/dev/null || hostname)}"
 CH_CERT_DNS="${CH_CERT_DNS:-}"
 CH_CERT_IP="${CH_CERT_IP:-}"
 CH_CERT_DAYS="${CH_CERT_DAYS:-825}"
-CH_GENERATE_CA="${CH_GENERATE_CA:-false}"
-
-SRC_CERT="${SRC_CERT:-}"
-SRC_KEY="${SRC_KEY:-}"
-SRC_CA="${SRC_CA:-}"
 
 CH_DIR="/etc/clickhouse-server"
 CH_CONFIG_D_DIR="${CH_DIR}/config.d"
 PKI_DIR="${CH_DIR}/pki"
 SERVER_CERT="${CH_DIR}/server.crt"
 SERVER_KEY="${CH_DIR}/server.key"
-CA_CERT="${CH_DIR}/ca.crt"
 OVERRIDE_FILE="${CH_CONFIG_D_DIR}/waf-https.xml"
 
 mkdir -p "${CH_CONFIG_D_DIR}" "${PKI_DIR}"
@@ -117,72 +111,13 @@ EOF
 
   cp -f "${server_crt}" "${SERVER_CERT}"
   cp -f "${server_key}" "${SERVER_KEY}"
-  rm -f "${CA_CERT}"
 }
 
-generate_cert_with_ca() {
-  echo "[INFO] generating local CA and server certificate ..."
-  local ca_key="${PKI_DIR}/ca.key"
-  local ca_crt="${PKI_DIR}/ca.crt"
-  local server_key="${PKI_DIR}/server.key"
-  local server_csr="${PKI_DIR}/server.csr"
-  local server_crt="${PKI_DIR}/server.crt"
-  local ext_file="${PKI_DIR}/server.ext"
-  local san_line
-  san_line="$(build_san_line)"
-
-  openssl genrsa -out "${ca_key}" 4096
-  openssl req -x509 -new -nodes -key "${ca_key}" -sha256 -days 3650 \
-    -out "${ca_crt}" -subj "/CN=ClickHouse Local CA"
-
-  openssl genrsa -out "${server_key}" 2048
-  openssl req -new -key "${server_key}" -out "${server_csr}" -subj "/CN=${CH_CERT_CN}"
-
-  cat >"${ext_file}" <<EOF
-subjectAltName=${san_line}
-keyUsage=digitalSignature,keyEncipherment
-extendedKeyUsage=serverAuth
-EOF
-
-  openssl x509 -req -in "${server_csr}" -CA "${ca_crt}" -CAkey "${ca_key}" -CAcreateserial \
-    -out "${server_crt}" -days "${CH_CERT_DAYS}" -sha256 -extfile "${ext_file}"
-
-  cp -f "${server_crt}" "${SERVER_CERT}"
-  cp -f "${server_key}" "${SERVER_KEY}"
-  cp -f "${ca_crt}" "${CA_CERT}"
-}
-
-if [[ -n "${SRC_CERT}" || -n "${SRC_KEY}" ]]; then
-  if [[ -z "${SRC_CERT}" || -z "${SRC_KEY}" ]]; then
-    echo "[ERROR] SRC_CERT and SRC_KEY must be provided together"
-    exit 1
-  fi
-  echo "[INFO] using provided certificate files ..."
-  cp -f "${SRC_CERT}" "${SERVER_CERT}"
-  cp -f "${SRC_KEY}" "${SERVER_KEY}"
-  if [[ -n "${SRC_CA}" ]]; then
-    cp -f "${SRC_CA}" "${CA_CERT}"
-  else
-    rm -f "${CA_CERT}"
-  fi
-else
-  case "$(echo "${CH_GENERATE_CA}" | tr '[:upper:]' '[:lower:]')" in
-    1|true|yes|on)
-      generate_cert_with_ca
-      ;;
-    *)
-      generate_self_signed_cert
-      ;;
-  esac
-fi
+generate_self_signed_cert
 
 chown clickhouse:clickhouse "${SERVER_CERT}" "${SERVER_KEY}" || true
 chmod 0644 "${SERVER_CERT}"
 chmod 0640 "${SERVER_KEY}"
-if [[ -f "${CA_CERT}" ]]; then
-  chown clickhouse:clickhouse "${CA_CERT}" || true
-  chmod 0644 "${CA_CERT}"
-fi
 
 echo "[INFO] writing ClickHouse HTTPS override config ..."
 cat >"${OVERRIDE_FILE}" <<EOF
@@ -221,7 +156,3 @@ echo "[OK] ClickHouse HTTPS setup finished"
 echo "     HTTPS port : ${CH_HTTPS_PORT}"
 echo "     cert file  : ${SERVER_CERT}"
 echo "     key file   : ${SERVER_KEY}"
-if [[ -f "${CA_CERT}" ]]; then
-  echo "     CA file    : ${CA_CERT}"
-  echo "     import this CA file into API/Fluent Bit hosts if tls.verify=On"
-fi