Creates a script for installing (trusted) self-signed certificates (#2023)

Author: nicomiguelino

bin/add_certificate.sh

@@ -0,0 +1,43 @@
+#!/bin/bash
+
+set -euo pipefail
+
+function print_usage() {
+  echo "Usage: $0 /path/to/certificate.crt"
+}
+
+if [ "$#" -ne 1 ]; then
+  print_usage
+  exit 1
+fi
+
+CERTIFICATE_PATH=$1
+
+function main() {
+    if [ ! -f $CERTIFICATE_PATH ]; then
+        echo "Certificate file not found: $CERTIFICATE_PATH"
+        exit 1
+    fi
+
+    CERTIFICATE_DIR='/usr/local/share/ca-certificates/custom'
+    CONTAINERS=(anthias-server anthias-viewer)
+    CERTIFICATE_FILENAME=$(basename $CERTIFICATE_PATH)
+
+    cd $HOME/screenly
+
+    for CONTAINER in "${CONTAINERS[@]}"; do
+        docker compose exec -it $CONTAINER mkdir -p $CERTIFICATE_DIR
+        docker compose cp $CERTIFICATE_PATH $CONTAINER:$CERTIFICATE_DIR
+        docker compose exec -it $CONTAINER update-ca-certificates
+
+        if [ "$CONTAINER" == "anthias-viewer" ]; then
+            echo "Running certutil for $CONTAINER..."
+            docker compose exec -it $CONTAINER \
+                certutil -A -n "My CA Certificate" -t "C,C,C" \
+                -i $CERTIFICATE_DIR/$CERTIFICATE_FILENAME \
+                -d "/data/.pki/nssdb"
+        fi
+    done
+}
+
+main

docker/Dockerfile.viewer.tmpl

@@ -40,6 +40,7 @@ RUN --mount=type=cache,target=/var/cache/apt \
         libminizip-dev \
         libnss3 \
         libnss3-dev \
+        libnss3-tools \
         libopus-dev \
         libpci-dev \
         libpng-dev \

docs/README.md

@@ -84,6 +84,18 @@ For most users, it's recommended that you [use the API instead](#accessing-the-r
 
 The SQLite Database can be found here — `~/.screenly/screenly.db`. It can be modified with the `sqlite3` CLI. The schema is relatively straightforward if you're already familiar. The columns of most interest to you will be `name` and `is_enabled`. In addition, `start_date` is useful if you want to use this in a disconnected manner.
 
+## Installing (trusted) self-signed certificates
+
+This section only works for devices running Raspberry Pi OS Lite.
+With running the following script, you can install self-signed certificates:
+
+```bash
+cd $HOME/screenly
+./bin/add_certificate.sh /path/to/certificate.crt
+```
+
+More details about generating self-signed certificates can be found [here](https://devopscube.com/create-self-signed-certificates-openssl/).
+
 ## Wi-Fi Setup
 
 - Read the [Wi-Fi Setup](wifi-setup.md) page for more details on how to set up Wi-Fi on the Raspberry Pi.