#!/bin/sh
# ExecStartPre of xrdp.service: the self-signed TLS certificate the Ubuntu package's
# postinst creates at install time. Created on first start instead, so that every
# machine (and every boot of a RAM-only image) gets its own key rather than one baked
# into the package or image. A key and certificate already in place are kept.
set -eu

key=/etc/xrdp/key.pem
cert=/etc/xrdp/cert.pem

[ -e "$key" ] && [ -e "$cert" ] && exit 0

umask 077
openssl req -x509 -newkey rsa:2048 -nodes -keyout "$key" -out "$cert" -days 3650 \
	-subj "/CN=$(cat /proc/sys/kernel/hostname)" -batch 2>/dev/null
chmod 400 "$key" "$cert"
