Adam MillerandTaylor Mutch 71209e6ac6 feat(rpm): replace init-pki.sh with openshell-gateway generate-certs (#1426) ...

* feat(rpm): replace init-pki.sh with openshell-gateway generate-certs

Cuts the RPM gateway over to the unified Rust certgen path. The systemd
user unit's first ExecStartPre now invokes:

  /usr/bin/openshell-gateway generate-certs --output-dir %S/openshell/tls

producing the same six-PEM layout init-pki.sh built (ca.{crt,key},
server/tls.{crt,key}, client/tls.{crt,key}) and the same CLI mTLS copy
under $XDG_CONFIG_HOME/openshell/gateways/openshell/mtls/. None of the
OPENSHELL_TLS_* / OPENSHELL_PODMAN_TLS_* paths in the unit change.

Adds host.containers.internal to the gateway's built-in SAN list so
podman containers reaching their host validate cleanly with no
per-deployment --server-san flag. Docker (host.docker.internal) and
Kubernetes (cluster.local DNS) were already covered.

Drops 197 lines of openssl shell, the install/file lines for the script
itself, and updates the docs (man page, RPM CONFIGURATION.md, env-file
generator comment) to point at the new entrypoint. The %S state dir,
unit security hardening, and consumer paths are untouched.

* docs(certgen): remove stale init-pki.sh references in comments

---------

Co-authored-by: Taylor Mutch <taylormutch@gmail.com>

2026-05-18 11:34:53 -05:00

..

src

feat(rpm): replace init-pki.sh with openshell-gateway generate-certs (#1426)

2026-05-18 11:34:53 -05:00

Cargo.toml

refactor(cli): remove gateway lifecycle management (#1221)

2026-05-07 09:54:13 -07:00