use NGINX tls ports

[carlomazzaferro]

• Keep the same port as usual for own address
• Use NGINX ports for other node addresses

openssl genrsa -out ca.key 4096
openssl req -x509 -new -nodes -key ca.key -days 3650 \
  -out ca.crt \
  -subj "/CN=MyTestCA"

# 2) Create nginx private key + CSR
openssl genrsa -out nginx.key 2048
openssl req -new -key nginx.key \
  -out nginx.csr \
  -subj "/CN=localhost" \
  -addext "subjectAltName = DNS:localhost, IP:127.0.0.1"

# 3) Sign the nginx CSR with your CA
openssl x509 -req -in nginx.csr \
  -CA ca.crt -CAkey ca.key -CAcreateserial \
  -out nginx.crt -days 365 -sha256 \
  -extensions v3_req \
  -extfile <(printf "[v3_req]\nsubjectAltName=DNS:localhost,IP:127.0.0.1")

Will generate:

• nginx.crt
• nginx.key

To be used in nginx.conf like this, place them in /scripts/tools/ngnix/cert

  ssl_certificate /etc/nginx/cert/nginx.crt;
  ssl_certificate_key /etc/nginx/cert/nginx.key;

• ca.crt, place it in /certs

Locally running (all in different shells):

>>> docker compose -f docker-compose.dev.yaml up
>>> ./scripts/run-server.sh 0 standard --init-servers 
>>> ./scripts/run-server.sh 1 standard 
>>> ./scripts/run-server.sh 2 standard 

If everything goes well, then run the client:

>>> ./scripts/run-client.sh