generate k8s

commit messages by http://whatthecommit.com

.gitignore

@@ -1 +1 @@
-/ssl
+/tls

Justfile

@@ -9,11 +9,8 @@ sh:
 logs:
 	podman logs --follow {{ NAME }}
 
-genssl DOMAIN='website.com':
+@setup-tls:
-	mkdir -p ssl
+	make setup-tls
-	openssl req -x509 -new -keyout ssl/key.pem -out ssl/cert.pem -noenc -days 3 \
-		-addext 'subjectAltName=DNS:sub.a.{{DOMAIN}},DNS:a.{{ DOMAIN }},DNS:b.{{DOMAIN}}' \
-		-subj '/CN={{ DOMAIN }}'
 
 container:
 	podman run \
@@ -22,5 +19,5 @@ container:
 		--publish 8443:443 \
 		--volume ./conf.d:/etc/nginx/conf.d:ro,z \
 		--volume ./www:/srv/www:ro,z \
-		--volume ./ssl:/etc/nginx/ssl:ro,z \
+		--volume ./tls:/etc/nginx/tls:ro,z \
 		nginx:alpine

Makefile

@@ -0,0 +1,16 @@
+.PHONY: setup-tls
+
+DOMAIN = website.com
+
+setup-tls: tls/cert.pem
+
+tls/cert.pem: tls/key.pem
+	openssl req -x509 -new -key $< -out $@ -noenc -days 365 \
+		-addext 'subjectAltName=DNS:sub.a.$(DOMAIN),DNS:a.$(DOMAIN),DNS:b.$(DOMAIN)' \
+		-subj '/CN=$(DOMAIN)'
+
+tls/key.pem: tls/
+	openssl genpkey -out $@ -algorithm RSA -pkeyopt bits:4096
+
+tls/:
+	mkdir $@

README.md

@@ -1,25 +1,77 @@
+# what is this?
+
 to play with cookies
 
 this serves a nginx server on port 8443
 
+# how to use?
+
+## set up dns
+
 > [!CAUTION]
-> you want to change your `/etc/hosts` (on \*nix)
+> you want to change your `/etc/hosts` (on \*nix; requires root)
 
 ```
 # /etc/hosts
 127.0.0.1 website.com a.website.com b.website.com sub.a.website.com
 ```
 
-next, install `just` for your system. take a look at <https://just.systems> if unsure how
+the nginx config has these domains hardcoded. change them too if you want
 
-get `podman` too while you're at it. you don't have `openssl`? what insane operating system are you on? get openssl too.
+## set up tls
+
+run `make setup-tls`
+
+you don't have `make`? well install it.
+
+you don't have `openssl`? what insane operating system are you on? get openssl too.
+
+
+## change the cookie attributes
+
+to add attributes, modify the file `cookieattr`
+```
+# cookieattr
+set $cookie_attr 'Secure; Domain=a.host.com; HttpOnly;';
+```
+note that the `;` at the end is the line terminator for nginx config and is necessary
+
+## start the server
+
+### with compose
+
+```console
+$ docker compose up -d
+$ docker compose exec cookies nginx -s reload
+$ # or create a make/just target to do that
+```
+
+### with podman
 
 ```console
-$ just genssl
 $ just container
-$ # now you mess around with conf.d/server.conf
+$ # now you mess around with cookieattr
 $ # you look at https://a.website.com https://b.website.com https://sub.a.website.com
 $ # you can tell you need to tell your browser you want a taste of danger
 $ just reload
-$ # ^ do that when you make changes to server.conf
+$ # ^ do that when you make changes to config
 ```
+
+# what if sth doesn't work?
+
+## using podman?
+give the nginx (sub)user access to the tls directory
+```console
+$ podman unshare setfacl -Rmu:101:rX tls/
+```
+
+## using docker?
+might be the `:z` label in the `volumes` in `docker-compose.yml`. remove it.
+e.g.
+```
+- ./tls:/etc/nginx/tls:ro
+```
+
+## using macOS?
+make is angry with you? you're on your own for this one. just read the commands and run them directly
+

conf.d/cookieattr.part

@@ -0,0 +1 @@
+set $cookie_attr 'Secure;';

conf.d/server.conf

@@ -5,10 +5,12 @@ map $host $flavour {
 }
 server {
 	listen 443 ssl;
-	ssl_certificate /etc/nginx/ssl/cert.pem;
+	ssl_certificate /etc/nginx/tls/cert.pem;
-	ssl_certificate_key /etc/nginx/ssl/key.pem;
+	ssl_certificate_key /etc/nginx/tls/key.pem;
 	server_name a.website.com b.website.com sub.a.website.com;
 
+	include 'conf.d/cookieattr.part';
+
 	root /srv/www;
 
 	try_files $uri $uri.html /index.html =200;
@@ -20,7 +22,7 @@ server {
 	}
 	location /set {
 		try_files $uri $uri.html /index.html =200;
-		add_header set-cookie 'flavour=$flavour; max-age=3600;';
+		add_header set-cookie 'flavour=$flavour; $cookie_attr';
 	}
 	location /clear {
 		try_files $uri $uri.html /index.html =200;

cookieattr

@@ -0,0 +1 @@
+conf.d/cookieattr.part

cookies.k8s.yml

@@ -0,0 +1,57 @@
+# Save the output of this file and use kubectl create -f to import
+# it into Kubernetes.
+#
+# Created with podman-5.8.4
+
+# NOTE: If you generated this yaml from an unprivileged and rootless podman container on an SELinux
+# enabled system, check the podman generate kube man page for steps to follow to ensure that your pod/container
+# has the right permissions to access the volumes added.
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  annotations:
+    bind-mount-options: /home/kevinnlsamuel/project/cookies/www:z
+  creationTimestamp: "2026-09-02T17:51:20Z"
+  labels:
+    app: cookies-pod
+  name: cookies-pod
+spec:
+  containers:
+  - args:
+    - nginx
+    - -g
+    - daemon off;
+    env:
+    - name: TERM
+      value: xterm
+    image: docker.io/library/nginx:alpine
+    name: cookies
+    ports:
+    - containerPort: 443
+      hostPort: 8443
+    tty: true
+    volumeMounts:
+    - mountPath: /etc/nginx/tls
+      name: home-kevinnlsamuel-project-cookies-tls-host-0
+      readOnly: true
+    - mountPath: /etc/nginx/conf.d
+      name: home-kevinnlsamuel-project-cookies-conf.d-host-1
+      readOnly: true
+    - mountPath: /srv/www
+      name: home-kevinnlsamuel-project-cookies-www-host-2
+      readOnly: true
+  volumes:
+  - hostPath:
+      path: /home/kevinnlsamuel/project/cookies/tls
+      type: Directory
+    name: home-kevinnlsamuel-project-cookies-tls-host-0
+  - hostPath:
+      path: /home/kevinnlsamuel/project/cookies/conf.d
+      type: Directory
+    name: home-kevinnlsamuel-project-cookies-conf.d-host-1
+  - hostPath:
+      path: /home/kevinnlsamuel/project/cookies/www
+      type: Directory
+    name: home-kevinnlsamuel-project-cookies-www-host-2
+

docker-compose.yml

@@ -0,0 +1,10 @@
+services:
+  cookies:
+    image: nginx:alpine
+    volumes:
+      - ./conf.d/:/etc/nginx/conf.d:ro,z
+      - ./tls:/etc/nginx/tls:ro,z
+      - ./www:/srv/www:ro,z
+    ports:
+      - 8443:443
+