New script: Local Certificate Authority based upon Smallstep's step-ca

[fwiegerinck]

✍️ Description

New script to create an Alpine-based container running a local Certificate Authority based upon Smallstep's OS "step-ca" (url: https://smallstep.com/docs/step-ca/).

This release provides - next to the default config GUI - a GUI to configure:

• name of the CA
• DNS hostnames to access the CA
• X509 policies for the allowed DNS and IP addresses
• optionally enable ACME service (at port 443)

---

• Related Issue: #
• Related PR: #
• Related Discussion: #

---

✅ Prerequisites

The following steps must be completed for the pull request to be considered:

• Self-review performed (I have reviewed my code to ensure it follows established patterns and conventions.)
• Testing performed (I have thoroughly tested my changes and verified expected functionality.)

🛠️ Type of Change

Please check the relevant options:

• [] Bug fix (non-breaking change that resolves an issue)
• [] New feature (non-breaking change that adds functionality)
• [] Breaking change (fix or feature that would cause existing functionality to change unexpectedly)
• New script (a fully functional and thoroughly tested script or set of scripts)

---

📋 Additional Information (optional)

Provide any extra context or screenshots about the feature or fix here.

[michelroegl-brunner]

This script breaks a few standards. First, why have you divided the installation in two parts?
Then remove the comments.
and you can remove the part with motd file. This is no longer used this way.

[fwiegerinck]

@michelroegl-brunner Thanks for the feedback.

First, why have you divided the installation in two parts?

Assuming you refer to alpine-step-ca-install.sh, during troubleshooting I found it more stable /easier to complete the steps of the OS first (incl customizations) and amend with the installation and configuration of step-ca. in case the configuration fails, at least the OS is accessible.

Then remove the comments

Done

and you can remove the part with motd file. This is no longer used this way.

I switched to .profile avoiding motd, while the user can still quickly access the fingerprint to onboard new clients to the ACME service.