Method get_or_generate_key_store

dstack-util/src/system_setup.rs:496–581

(&self)

    }

    async fn get_or_generate_key_store(&self) -> Result<GatewayKeyStore> {
        // Try to load existing cache
        let cache = GatewayKeyStore::load();

        // If cache is fully valid, return it
        if let Some(ref cache) = cache {
            if cache.is_cert_valid() {
                info!("Using cached gateway key store");
                return Ok(cache.clone());
            }
        }

        // Reuse WireGuard keys from cache if available, otherwise generate new ones
        let (wg_sk, wg_pk) = if let Some(ref cache) = cache {
            info!("Reusing cached WireGuard keys");
            (cache.wg_sk.clone(), cache.wg_pk.clone())
        } else {
            info!("Generating new WireGuard keys");
            let sk = cmd!(wg genkey)?;
            let pk =
                cmd!(echo $sk | wg pubkey).or(Err(anyhow!("Failed to generate public key")))?;
            (sk, pk)
        };

        // Request new client certificates
        info!("Requesting new client certificates");
        let now = std::time::SystemTime::now()
            .duration_since(std::time::UNIX_EPOCH)
            .map(|d| d.as_secs())
            .unwrap_or(0);
        let cert_not_after = now + CERT_VALIDITY_SECS;
        let cert_client = CertRequestClient::create(
            self.keys,
            self.shared.sys_config.pccs_url.as_deref(),
            self.shared.sys_config.vm_config.clone(),
        )
        .await
        .context("Failed to create cert client")?;
        let key =
            KeyPair::generate_for(&PKCS_ECDSA_P256_SHA256).context("Failed to generate key")?;

        // Request certificate without quote (for new gateways)
        let config = CertConfigV2 {
            org_name: None,
            subject: "dstack-guest-agent".to_string(),
            subject_alt_names: vec![],
            usage_server_auth: false,
            usage_client_auth: true,
            ext_quote: false,
            ext_app_info: true,
            not_before: None,
            not_after: Some(cert_not_after),
        };
        let certs = sign_cert_request(&cert_client, &key, config)
            .await
            .context("Failed to request cert")?;
        let client_cert = certs.join("\n");
        let client_key = key.serialize_pem();