On quickstart initialization, certificates should be generated.
Consider https://www.npmjs.com/package/ursa
or https://www.npmjs.com/package/node-rsa
or https://www.npmjs.com/package/node-forge (can generate both rsa and crt keys)
When initialized, the private key MUST NOT be committed (.gitignore it) but it should be echoed to the console so that the developer can store it somewhere.
An ssl cert should be generated from the key pair, and the server startup should support https on port 8443 (localhost). Note that when in production, it should actually be http only, as ssl termination should be at the load balancer for performance, as once in the docker weave network, ssl security is superfluous. Consider leaving getting https working for a later release unless there is demand.
As teams will be starting projects at separate times, they should generate their own keys, so the key generation should be checked on startup, just with a confirm if not in production. If in production, refuse to start the server.
On quickstart initialization, certificates should be generated.
Consider https://www.npmjs.com/package/ursa
or https://www.npmjs.com/package/node-rsa
or https://www.npmjs.com/package/node-forge (can generate both rsa and crt keys)
When initialized, the private key MUST NOT be committed (.gitignore it) but it should be echoed to the console so that the developer can store it somewhere.
An ssl cert should be generated from the key pair, and the server startup should support https on port 8443 (localhost). Note that when in production, it should actually be http only, as ssl termination should be at the load balancer for performance, as once in the docker weave network, ssl security is superfluous. Consider leaving getting https working for a later release unless there is demand.
As teams will be starting projects at separate times, they should generate their own keys, so the key generation should be checked on startup, just with a confirm if not in production. If in production, refuse to start the server.