Script for setting up secure public connection for a Docker daemon

secure_expose_docker.sh

#!/bin/bash

if [ $# -lt 2 ]; then
        echo "Usage: $0 [domain to connect] [password]"
        exit 1
fi

set -e

red='\033[0;31m'
green='\033[0;32m'
orange='\033[0;33m'
blue='\033[0;34m'
nocolor='\033[0m'

if [ -d /etc/docker ] && [ -f /etc/docker/ca-key.pem ]; then
        echo -ne "${orange}Docker security config already exists: overwrite? [Y/n] ${nocolor}"
        read answer
        if [ "x${answer}" == "xn" ]; then exit; fi
fi

echo -e "${blue}Creating secure public connection for Docker daemon${nocolor}"

[ -d /etc/docker ] || sudo mkdir /etc/docker
cd /etc/docker
sudo rm -v *

echo -e "${blue}Generating Certificate Authority${nocolor}"
sudo openssl genrsa -aes256 -passout pass:$2 -out ca-key.pem 2048
sudo openssl req -new -x509 -days 365 -key ca-key.pem -passin pass:$2 -sha256 -out ca.pem \
                 -subj '/C=NL/ST=./L=./O=./CN=$1'

echo -e "${blue}Generating and signing server key${nocolor}"
sudo openssl genrsa -out server-key.pem 2048
sudo openssl req -subj "/CN=$1" -new -key server-key.pem -out server.csr
sudo openssl x509 -req -days 365 -in server.csr -CA ca.pem -CAkey ca-key.pem -passin pass:$2 \
             -CAcreateserial -out server-cert.pem

echo -e "${blue}Generating and signing client key${nocolor}"
sudo openssl genrsa -out key.pem 2048
sudo openssl req -subj '/CN=client' -new -key key.pem -out client.csr
sudo sh -c 'echo "extendedKeyUsage = clientAuth" > extfile.cnf'
sudo openssl x509 -req -days 365 -in client.csr -CA ca.pem -CAkey ca-key.pem -passin pass:$2 \
                  -CAcreateserial -out cert.pem -extfile extfile.cnf

sudo rm client.csr server.csr
sudo chmod 0400 ca-key.pem key.pem server-key.pem
sudo chmod 0444 ca.pem server-cert.pem cert.pem

echo -e "${blue}Configuring Docker${nocolor}"
echo 'DOCKER_OPTS="--tlsverify --tlscacert=/etc/docker/ca.pem --tlscert=/etc/docker/server-cert.pem --tlskey=/etc/docker/server-key.pem -H tcp://0.0.0.0:4243 -H unix:///var/run/docker.sock"' >> /etc/default/docker
sudo service docker restart

echo -e "${green}Secure Docker daemon connection now available on port 4243${nocolor}"
echo "Let's test the connection by running:"
echo "docker --tlsverify --tlscacert=/etc/docker/ca.pem --tlscert=/etc/docker/cert.pem --tlskey=/etc/docker/key.pem -H=$1:4243 version"
echo

docker --tlsverify --tlscacert=/etc/docker/ca.pem --tlscert=/etc/docker/cert.pem --tlskey=/etc/docker/key.pem -H=$1:4243 version