feat(database): add CA certificate generation for database servers

app/Actions/Database/StartDragonfly.php

@@ -57,6 +57,17 @@ public function handle(StandaloneDragonfly $database)
             $server = $this->database->destination->server;
             $caCert = SslCertificate::where('server_id', $server->id)->where('is_ca_certificate', true)->first();
 
+            if (! $caCert) {
+                $server->generateCaCertificate();
+                $caCert = SslCertificate::where('server_id', $server->id)->where('is_ca_certificate', true)->first();
+            }
+
+            if (! $caCert) {
+                $this->dispatch('error', 'No CA certificate found for this database. Please generate a CA certificate for this server in the server/advanced page.');
+
+                return;
+            }
+
             $this->ssl_certificate = $this->database->sslCertificates()->first();
 
             if (! $this->ssl_certificate) {

app/Actions/Database/StartKeydb.php

@@ -58,6 +58,17 @@ public function handle(StandaloneKeydb $database)
             $server = $this->database->destination->server;
             $caCert = SslCertificate::where('server_id', $server->id)->where('is_ca_certificate', true)->first();
 
+            if (! $caCert) {
+                $server->generateCaCertificate();
+                $caCert = SslCertificate::where('server_id', $server->id)->where('is_ca_certificate', true)->first();
+            }
+
+            if (! $caCert) {
+                $this->dispatch('error', 'No CA certificate found for this database. Please generate a CA certificate for this server in the server/advanced page.');
+
+                return;
+            }
+
             $this->ssl_certificate = $this->database->sslCertificates()->first();
 
             if (! $this->ssl_certificate) {

app/Actions/Database/StartMariadb.php

@@ -59,6 +59,17 @@ public function handle(StandaloneMariadb $database)
             $server = $this->database->destination->server;
             $caCert = SslCertificate::where('server_id', $server->id)->where('is_ca_certificate', true)->first();
 
+            if (! $caCert) {
+                $server->generateCaCertificate();
+                $caCert = SslCertificate::where('server_id', $server->id)->where('is_ca_certificate', true)->first();
+            }
+
+            if (! $caCert) {
+                $this->dispatch('error', 'No CA certificate found for this database. Please generate a CA certificate for this server in the server/advanced page.');
+
+                return;
+            }
+
             $this->ssl_certificate = $this->database->sslCertificates()->first();
 
             if (! $this->ssl_certificate) {

app/Actions/Database/StartMongodb.php

@@ -63,6 +63,16 @@ public function handle(StandaloneMongodb $database)
             $server = $this->database->destination->server;
             $caCert = SslCertificate::where('server_id', $server->id)->where('is_ca_certificate', true)->first();
 
+            if (! $caCert) {
+                $server->generateCaCertificate();
+                $caCert = SslCertificate::where('server_id', $server->id)->where('is_ca_certificate', true)->first();
+            }
+
+            if (! $caCert) {
+                $this->dispatch('error', 'No CA certificate found for this database. Please generate a CA certificate for this server in the server/advanced page.');
+
+                return;
+            }
             $this->ssl_certificate = $this->database->sslCertificates()->first();
 
             if (! $this->ssl_certificate) {

app/Actions/Database/StartMysql.php

@@ -59,6 +59,17 @@ public function handle(StandaloneMysql $database)
             $server = $this->database->destination->server;
             $caCert = SslCertificate::where('server_id', $server->id)->where('is_ca_certificate', true)->first();
 
+            if (! $caCert) {
+                $server->generateCaCertificate();
+                $caCert = SslCertificate::where('server_id', $server->id)->where('is_ca_certificate', true)->first();
+            }
+
+            if (! $caCert) {
+                $this->dispatch('error', 'No CA certificate found for this database. Please generate a CA certificate for this server in the server/advanced page.');
+
+                return;
+            }
+
             $this->ssl_certificate = $this->database->sslCertificates()->first();
 
             if (! $this->ssl_certificate) {

app/Actions/Database/StartPostgresql.php

@@ -64,6 +64,17 @@ public function handle(StandalonePostgresql $database)
             $server = $this->database->destination->server;
             $caCert = SslCertificate::where('server_id', $server->id)->where('is_ca_certificate', true)->first();
 
+            if (! $caCert) {
+                $server->generateCaCertificate();
+                $caCert = SslCertificate::where('server_id', $server->id)->where('is_ca_certificate', true)->first();
+            }
+
+            if (! $caCert) {
+                $this->dispatch('error', 'No CA certificate found for this database. Please generate a CA certificate for this server in the server/advanced page.');
+
+                return;
+            }
+
             $this->ssl_certificate = $this->database->sslCertificates()->first();
 
             if (! $this->ssl_certificate) {

app/Actions/Database/StartRedis.php

@@ -58,6 +58,17 @@ public function handle(StandaloneRedis $database)
             $server = $this->database->destination->server;
             $caCert = SslCertificate::where('server_id', $server->id)->where('is_ca_certificate', true)->first();
 
+            if (! $caCert) {
+                $server->generateCaCertificate();
+                $caCert = SslCertificate::where('server_id', $server->id)->where('is_ca_certificate', true)->first();
+            }
+
+            if (! $caCert) {
+                $this->dispatch('error', 'No CA certificate found for this database. Please generate a CA certificate for this server in the server/advanced page.');
+
+                return;
+            }
+
             $this->ssl_certificate = $this->database->sslCertificates()->first();
 
             if (! $this->ssl_certificate) {

app/Livewire/Project/Database/Dragonfly/General.php

@@ -214,10 +214,23 @@ public function regenerateSslCertificate()
                 return;
             }
 
-            $caCert = SslCertificate::where('server_id', $existingCert->server_id)
+            $server = $this->database->destination->server;
+
+            $caCert = SslCertificate::where('server_id', $server->id)
                 ->where('is_ca_certificate', true)
                 ->first();
 
+            if (! $caCert) {
+                $server->generateCaCertificate();
+                $caCert = SslCertificate::where('server_id', $server->id)->where('is_ca_certificate', true)->first();
+            }
+
+            if (! $caCert) {
+                $this->dispatch('error', 'No CA certificate found for this database. Please generate a CA certificate for this server in the server/advanced page.');
+
+                return;
+            }
+
             SslHelper::generateSslCertificate(
                 commonName: $existingCert->commonName,
                 subjectAlternativeNames: $existingCert->subjectAlternativeNames ?? [],

app/Models/Server.php

@@ -7,7 +7,9 @@
 use App\Actions\Server\StartSentinel;
 use App\Enums\ProxyTypes;
 use App\Events\ServerReachabilityChanged;
+use App\Helpers\SslHelper;
 use App\Jobs\CheckAndStartSentinelJob;
+use App\Jobs\RegenerateSslCertJob;
 use App\Notifications\Server\Reachable;
 use App\Notifications\Server\Unreachable;
 use App\Services\ConfigurationRepository;
@@ -1337,4 +1339,41 @@ private function disableSshMux(): void
         $configRepository = app(ConfigurationRepository::class);
         $configRepository->disableSshMux();
     }
+
+    public function generateCaCertificate()
+    {
+        try {
+            ray('Generating CA certificate for server', $this->id);
+            SslHelper::generateSslCertificate(
+                commonName: 'Coolify CA Certificate',
+                serverId: $this->id,
+                isCaCertificate: true,
+                validityDays: 10 * 365
+            );
+            $caCertificate = SslCertificate::where('server_id', $this->id)->where('is_ca_certificate', true)->first();
+            ray('CA certificate generated', $caCertificate);
+            if ($caCertificate) {
+                $certificateContent = $caCertificate->ssl_certificate;
+                $caCertPath = config('constants.coolify.base_config_path').'/ssl/';
+
+                $commands = collect([
+                    "mkdir -p $caCertPath",
+                    "chown -R 9999:root $caCertPath",
+                    "chmod -R 700 $caCertPath",
+                    "rm -rf $caCertPath/coolify-ca.crt",
+                    "echo '{$certificateContent}' > $caCertPath/coolify-ca.crt",
+                    "chmod 644 $caCertPath/coolify-ca.crt",
+                ]);
+
+                instant_remote_process($commands, $this, false);
+
+                dispatch(new RegenerateSslCertJob(
+                    server_id: $this->id,
+                    force_regeneration: true
+                ));
+            }
+        } catch (\Throwable $e) {
+            return handleError($e);
+        }
+    }
 }