mirror of
https://github.com/shankar0123/certctl.git
synced 2026-06-07 19:21:29 +00:00
Shankar
c014c17cc6
Add certificate export in PEM (JSON or file download) and PKCS#12 formats. Private keys are never included — they stay on agents. Add EKU-aware issuance threading profile EKUs (serverAuth, clientAuth, codeSigning, emailProtection, timeStamping) through the full issuance pipeline. Fix agent CSR SAN splitting for email addresses, adaptive KeyUsage flags for S/MIME vs TLS, and a pre-existing generateID collision bug in deployment job creation. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
335 lines
30 KiB
SQL
335 lines
30 KiB
SQL
-- =============================================================================
|
|
-- Demo Seed Data for certctl
|
|
-- Run after schema migration to populate a realistic demo environment
|
|
-- =============================================================================
|
|
|
|
-- Teams
|
|
INSERT INTO teams (id, name, description, created_at, updated_at) VALUES
|
|
('t-platform', 'Platform Engineering', 'Core infrastructure and platform services', NOW(), NOW()),
|
|
('t-security', 'Security Operations', 'Security tooling and compliance', NOW(), NOW()),
|
|
('t-payments', 'Payments', 'Payment processing services', NOW(), NOW()),
|
|
('t-frontend', 'Frontend', 'Web and mobile applications', NOW(), NOW()),
|
|
('t-data', 'Data Engineering', 'Data pipelines and analytics', NOW(), NOW())
|
|
ON CONFLICT (id) DO NOTHING;
|
|
|
|
-- Owners
|
|
INSERT INTO owners (id, name, email, team_id, created_at, updated_at) VALUES
|
|
('o-alice', 'Alice Chen', 'alice@example.com', 't-platform', NOW(), NOW()),
|
|
('o-bob', 'Bob Martinez', 'bob@example.com', 't-security', NOW(), NOW()),
|
|
('o-carol', 'Carol Williams', 'carol@example.com', 't-payments', NOW(), NOW()),
|
|
('o-dave', 'Dave Kim', 'dave@example.com', 't-frontend', NOW(), NOW()),
|
|
('o-eve', 'Eve Johnson', 'eve@example.com', 't-data', NOW(), NOW())
|
|
ON CONFLICT (id) DO NOTHING;
|
|
|
|
-- Renewal Policies
|
|
INSERT INTO renewal_policies (id, name, renewal_window_days, auto_renew, max_retries, retry_interval_minutes, alert_thresholds_days, created_at, updated_at) VALUES
|
|
('rp-standard', 'Standard 30-day', 30, true, 3, 60, '[30, 14, 7, 0]'::jsonb, NOW(), NOW()),
|
|
('rp-urgent', 'Urgent 14-day', 14, true, 5, 30, '[14, 7, 3, 0]'::jsonb, NOW(), NOW()),
|
|
('rp-manual', 'Manual Only', 30, false, 0, 0, '[30, 14, 7, 0]'::jsonb, NOW(), NOW())
|
|
ON CONFLICT (id) DO NOTHING;
|
|
|
|
-- Issuers
|
|
INSERT INTO issuers (id, name, type, config, enabled, created_at, updated_at) VALUES
|
|
('iss-local', 'Local Dev CA', 'local', '{"ca_common_name": "CertCtl Demo CA", "validity_days": 90}', true, NOW(), NOW()),
|
|
('iss-acme-le', 'Let''s Encrypt Staging', 'acme', '{"directory_url": "https://acme-staging-v02.api.letsencrypt.org/directory", "email": "admin@example.com"}', true, NOW(), NOW()),
|
|
('iss-stepca', 'step-ca Internal', 'stepca', '{"ca_url": "https://ca.internal:9000", "provisioner_name": "certctl", "validity_days": 90}', false, NOW(), NOW()),
|
|
('iss-digicert', 'DigiCert (disabled)', 'generic_ca', '{"api_url": "https://api.digicert.com", "api_key": "REDACTED"}', false, NOW(), NOW())
|
|
ON CONFLICT (id) DO NOTHING;
|
|
|
|
-- Agents
|
|
INSERT INTO agents (id, name, hostname, status, last_heartbeat_at, registered_at, api_key_hash, os, architecture, ip_address, version) VALUES
|
|
('ag-web-prod', 'web-prod-agent', 'web-prod-01.internal', 'online', NOW() - INTERVAL '30 seconds', NOW() - INTERVAL '90 days', 'demo_hash_1', 'linux', 'amd64', '10.0.1.10', '1.0.0'),
|
|
('ag-web-staging', 'web-staging-agent', 'web-stg-01.internal', 'online', NOW() - INTERVAL '45 seconds', NOW() - INTERVAL '60 days', 'demo_hash_2', 'linux', 'amd64', '10.0.2.20', '1.0.0'),
|
|
('ag-lb-prod', 'lb-prod-agent', 'f5-prod-01.internal', 'online', NOW() - INTERVAL '15 seconds', NOW() - INTERVAL '120 days', 'demo_hash_3', 'linux', 'amd64', '10.0.1.50', '1.0.0'),
|
|
('ag-iis-prod', 'iis-prod-agent', 'iis-prod-01.internal', 'offline', NOW() - INTERVAL '3 hours', NOW() - INTERVAL '30 days', 'demo_hash_4', 'windows', 'amd64', '10.0.3.15', '1.0.0'),
|
|
('ag-data-prod', 'data-prod-agent', 'data-prod-01.internal', 'online', NOW() - INTERVAL '20 seconds', NOW() - INTERVAL '45 days', 'demo_hash_5', 'linux', 'arm64', '10.0.4.30', '1.0.0')
|
|
ON CONFLICT (id) DO NOTHING;
|
|
|
|
-- Deployment Targets
|
|
INSERT INTO deployment_targets (id, name, type, agent_id, config, enabled, created_at, updated_at) VALUES
|
|
('tgt-nginx-prod', 'NGINX Production', 'nginx', 'ag-web-prod', '{"cert_path": "/etc/nginx/ssl/cert.pem", "key_path": "/etc/nginx/ssl/key.pem", "reload_command": "nginx -s reload"}', true, NOW(), NOW()),
|
|
('tgt-nginx-staging', 'NGINX Staging', 'nginx', 'ag-web-staging', '{"cert_path": "/etc/nginx/ssl/cert.pem", "key_path": "/etc/nginx/ssl/key.pem", "reload_command": "nginx -s reload"}', true, NOW(), NOW()),
|
|
('tgt-f5-prod', 'F5 BIG-IP Production','f5', 'ag-lb-prod', '{"host": "f5-prod-01.internal", "partition": "Common", "ssl_profile": "clientssl"}', true, NOW(), NOW()),
|
|
('tgt-iis-prod', 'IIS Production', 'iis', 'ag-iis-prod', '{"site_name": "Default Web Site", "binding_info": "*:443:"}', true, NOW(), NOW()),
|
|
('tgt-nginx-data', 'NGINX Data Services', 'nginx', 'ag-data-prod', '{"cert_path": "/etc/nginx/ssl/cert.pem", "key_path": "/etc/nginx/ssl/key.pem", "reload_command": "nginx -s reload"}', true, NOW(), NOW())
|
|
ON CONFLICT (id) DO NOTHING;
|
|
|
|
-- Certificate Profiles
|
|
INSERT INTO certificate_profiles (id, name, description, allowed_key_algorithms, max_ttl_seconds, allowed_ekus, required_san_patterns, spiffe_uri_pattern, allow_short_lived, enabled, created_at, updated_at) VALUES
|
|
('prof-standard-tls', 'Standard TLS',
|
|
'Default profile for web-facing TLS certificates. Requires ECDSA P-256+ or RSA 2048+.',
|
|
'[{"algorithm": "ECDSA", "min_size": 256}, {"algorithm": "RSA", "min_size": 2048}]'::jsonb,
|
|
7776000, -- 90 days
|
|
'["serverAuth"]'::jsonb,
|
|
'[]'::jsonb,
|
|
'', false, true, NOW(), NOW()),
|
|
|
|
('prof-internal-mtls', 'Internal mTLS',
|
|
'Mutual TLS profile for internal service-to-service communication.',
|
|
'[{"algorithm": "ECDSA", "min_size": 256}]'::jsonb,
|
|
2592000, -- 30 days
|
|
'["serverAuth", "clientAuth"]'::jsonb,
|
|
'[".*\\.internal\\.example\\.com$"]'::jsonb,
|
|
'', false, true, NOW(), NOW()),
|
|
|
|
('prof-short-lived', 'Short-Lived Credential',
|
|
'Ephemeral certificates for CI/CD pipelines and container workloads. TTL under 1 hour, expiry = revocation.',
|
|
'[{"algorithm": "ECDSA", "min_size": 256}]'::jsonb,
|
|
300, -- 5 minutes
|
|
'["serverAuth", "clientAuth"]'::jsonb,
|
|
'[]'::jsonb,
|
|
'spiffe://example.com/workload/*',
|
|
true, true, NOW(), NOW()),
|
|
|
|
('prof-high-security', 'High Security',
|
|
'For PCI-DSS and compliance-sensitive workloads. RSA 4096+ or ECDSA P-384+ only.',
|
|
'[{"algorithm": "ECDSA", "min_size": 384}, {"algorithm": "RSA", "min_size": 4096}]'::jsonb,
|
|
4060800, -- 47 days (Ballot SC-081v3 target)
|
|
'["serverAuth"]'::jsonb,
|
|
'[".*\\.example\\.com$"]'::jsonb,
|
|
'', false, true, NOW(), NOW()),
|
|
|
|
('prof-smime', 'S/MIME Email',
|
|
'S/MIME certificate profile for email signing and encryption. Requires emailProtection EKU.',
|
|
'[{"algorithm": "ECDSA", "min_size": 256}, {"algorithm": "RSA", "min_size": 2048}]'::jsonb,
|
|
31536000, -- 365 days
|
|
'["emailProtection"]'::jsonb,
|
|
'[]'::jsonb,
|
|
'', false, true, NOW(), NOW())
|
|
ON CONFLICT (id) DO NOTHING;
|
|
|
|
-- Managed Certificates — varied statuses and expiry dates for realistic dashboard
|
|
INSERT INTO managed_certificates (id, name, common_name, sans, environment, owner_id, team_id, issuer_id, renewal_policy_id, status, expires_at, tags, last_renewal_at, last_deployment_at, created_at, updated_at) VALUES
|
|
-- Active, healthy certs
|
|
('mc-api-prod', 'api-production', 'api.example.com', ARRAY['api.example.com', 'api-v2.example.com'], 'production', 'o-alice', 't-platform', 'iss-local', 'rp-standard', 'Active', NOW() + INTERVAL '75 days', '{"service": "api-gateway", "tier": "critical"}', NOW() - INTERVAL '15 days', NOW() - INTERVAL '15 days', NOW() - INTERVAL '180 days', NOW()),
|
|
('mc-web-prod', 'web-production', 'www.example.com', ARRAY['www.example.com', 'example.com'], 'production', 'o-dave', 't-frontend', 'iss-local', 'rp-standard', 'Active', NOW() + INTERVAL '60 days', '{"service": "web-app", "tier": "critical"}', NOW() - INTERVAL '30 days', NOW() - INTERVAL '30 days', NOW() - INTERVAL '365 days', NOW()),
|
|
('mc-pay-prod', 'payments-production', 'pay.example.com', ARRAY['pay.example.com', 'checkout.example.com'], 'production', 'o-carol', 't-payments', 'iss-local', 'rp-urgent', 'Active', NOW() + INTERVAL '45 days', '{"service": "payments", "tier": "critical", "pci": "true"}', NOW() - INTERVAL '45 days', NOW() - INTERVAL '45 days', NOW() - INTERVAL '200 days', NOW()),
|
|
('mc-dash-prod', 'dashboard-production', 'dashboard.example.com', ARRAY['dashboard.example.com'], 'production', 'o-dave', 't-frontend', 'iss-local', 'rp-standard', 'Active', NOW() + INTERVAL '82 days', '{"service": "dashboard", "tier": "high"}', NOW() - INTERVAL '8 days', NOW() - INTERVAL '8 days', NOW() - INTERVAL '100 days', NOW()),
|
|
('mc-data-prod', 'data-api-production', 'data.example.com', ARRAY['data.example.com', 'analytics.example.com'], 'production', 'o-eve', 't-data', 'iss-local', 'rp-standard', 'Active', NOW() + INTERVAL '55 days', '{"service": "data-api", "tier": "high"}', NOW() - INTERVAL '35 days', NOW() - INTERVAL '35 days', NOW() - INTERVAL '150 days', NOW()),
|
|
|
|
-- Expiring soon (< 30 days)
|
|
('mc-auth-prod', 'auth-production', 'auth.example.com', ARRAY['auth.example.com', 'login.example.com', 'sso.example.com'], 'production', 'o-bob', 't-security', 'iss-local', 'rp-urgent', 'Expiring', NOW() + INTERVAL '12 days', '{"service": "auth", "tier": "critical"}', NOW() - INTERVAL '78 days', NOW() - INTERVAL '78 days', NOW() - INTERVAL '300 days', NOW()),
|
|
('mc-cdn-prod', 'cdn-production', 'cdn.example.com', ARRAY['cdn.example.com', 'static.example.com'], 'production', 'o-alice', 't-platform', 'iss-local', 'rp-standard', 'Expiring', NOW() + INTERVAL '8 days', '{"service": "cdn", "tier": "high"}', NOW() - INTERVAL '82 days', NOW() - INTERVAL '82 days', NOW() - INTERVAL '250 days', NOW()),
|
|
('mc-mail-prod', 'mail-production', 'mail.example.com', ARRAY['mail.example.com', 'smtp.example.com'], 'production', 'o-bob', 't-security', 'iss-local', 'rp-standard', 'Expiring', NOW() + INTERVAL '5 days', '{"service": "email", "tier": "medium"}', NOW() - INTERVAL '85 days', NOW() - INTERVAL '85 days', NOW() - INTERVAL '400 days', NOW()),
|
|
|
|
-- Expired
|
|
('mc-legacy-prod', 'legacy-app', 'legacy.example.com', ARRAY['legacy.example.com'], 'production', 'o-alice', 't-platform', 'iss-local', 'rp-manual', 'Expired', NOW() - INTERVAL '3 days', '{"service": "legacy", "tier": "low", "decom": "planned"}', NOW() - INTERVAL '93 days', NOW() - INTERVAL '93 days', NOW() - INTERVAL '500 days', NOW()),
|
|
('mc-old-api', 'old-api-v1', 'api-v1.example.com', ARRAY['api-v1.example.com'], 'production', 'o-alice', 't-platform', 'iss-local', 'rp-manual', 'Expired', NOW() - INTERVAL '15 days', '{"service": "api-v1", "tier": "low", "deprecated": "true"}', NULL, NULL, NOW() - INTERVAL '600 days', NOW()),
|
|
|
|
-- Staging certs
|
|
('mc-api-stg', 'api-staging', 'api.staging.example.com', ARRAY['api.staging.example.com'], 'staging', 'o-alice', 't-platform', 'iss-local', 'rp-standard', 'Active', NOW() + INTERVAL '65 days', '{"service": "api-gateway", "tier": "low"}', NOW() - INTERVAL '25 days', NOW() - INTERVAL '25 days', NOW() - INTERVAL '120 days', NOW()),
|
|
('mc-web-stg', 'web-staging', 'www.staging.example.com', ARRAY['www.staging.example.com', 'staging.example.com'], 'staging', 'o-dave', 't-frontend', 'iss-local', 'rp-standard', 'Active', NOW() + INTERVAL '70 days', '{"service": "web-app", "tier": "low"}', NOW() - INTERVAL '20 days', NOW() - INTERVAL '20 days', NOW() - INTERVAL '100 days', NOW()),
|
|
|
|
-- Renewal in progress
|
|
('mc-grafana-prod', 'grafana-production', 'grafana.example.com', ARRAY['grafana.example.com', 'metrics.example.com'], 'production', 'o-eve', 't-data', 'iss-local', 'rp-standard', 'RenewalInProgress', NOW() + INTERVAL '3 days', '{"service": "monitoring", "tier": "high"}', NOW() - INTERVAL '87 days', NOW() - INTERVAL '87 days', NOW() - INTERVAL '180 days', NOW()),
|
|
|
|
-- Failed
|
|
('mc-vpn-prod', 'vpn-production', 'vpn.example.com', ARRAY['vpn.example.com'], 'production', 'o-bob', 't-security', 'iss-acme-le', 'rp-urgent', 'Failed', NOW() + INTERVAL '1 day', '{"service": "vpn", "tier": "critical"}', NULL, NULL, NOW() - INTERVAL '90 days', NOW()),
|
|
|
|
-- Wildcard
|
|
('mc-wildcard-prod', 'wildcard-production', '*.example.com', ARRAY['*.example.com', 'example.com'], 'production', 'o-alice', 't-platform', 'iss-local', 'rp-standard', 'Active', NOW() + INTERVAL '50 days', '{"service": "wildcard", "tier": "critical"}', NOW() - INTERVAL '40 days', NOW() - INTERVAL '40 days', NOW() - INTERVAL '365 days', NOW())
|
|
ON CONFLICT (id) DO NOTHING;
|
|
|
|
-- Certificate-Target Mappings
|
|
INSERT INTO certificate_target_mappings (certificate_id, target_id) VALUES
|
|
('mc-api-prod', 'tgt-nginx-prod'),
|
|
('mc-api-prod', 'tgt-f5-prod'),
|
|
('mc-web-prod', 'tgt-nginx-prod'),
|
|
('mc-web-prod', 'tgt-f5-prod'),
|
|
('mc-pay-prod', 'tgt-nginx-prod'),
|
|
('mc-pay-prod', 'tgt-f5-prod'),
|
|
('mc-dash-prod', 'tgt-nginx-prod'),
|
|
('mc-data-prod', 'tgt-nginx-data'),
|
|
('mc-auth-prod', 'tgt-nginx-prod'),
|
|
('mc-auth-prod', 'tgt-f5-prod'),
|
|
('mc-cdn-prod', 'tgt-f5-prod'),
|
|
('mc-mail-prod', 'tgt-nginx-prod'),
|
|
('mc-legacy-prod', 'tgt-iis-prod'),
|
|
('mc-api-stg', 'tgt-nginx-staging'),
|
|
('mc-web-stg', 'tgt-nginx-staging'),
|
|
('mc-grafana-prod', 'tgt-nginx-data'),
|
|
('mc-vpn-prod', 'tgt-f5-prod'),
|
|
('mc-wildcard-prod', 'tgt-nginx-prod'),
|
|
('mc-wildcard-prod', 'tgt-f5-prod'),
|
|
('mc-wildcard-prod', 'tgt-nginx-staging')
|
|
ON CONFLICT DO NOTHING;
|
|
|
|
-- Certificate Versions (latest version for each active cert)
|
|
INSERT INTO certificate_versions (id, certificate_id, serial_number, not_before, not_after, fingerprint_sha256, pem_chain, csr_pem, created_at) VALUES
|
|
('cv-api-1', 'mc-api-prod', '0A:1B:2C:3D:4E:5F:00:01', NOW() - INTERVAL '15 days', NOW() + INTERVAL '75 days', 'sha256:ab12cd34ef56', '-----BEGIN CERTIFICATE-----\nMIIDemoAPI...\n-----END CERTIFICATE-----', NULL, NOW() - INTERVAL '15 days'),
|
|
('cv-web-1', 'mc-web-prod', '0A:1B:2C:3D:4E:5F:00:02', NOW() - INTERVAL '30 days', NOW() + INTERVAL '60 days', 'sha256:cd34ef56ab12', '-----BEGIN CERTIFICATE-----\nMIIDemoWeb...\n-----END CERTIFICATE-----', NULL, NOW() - INTERVAL '30 days'),
|
|
('cv-pay-1', 'mc-pay-prod', '0A:1B:2C:3D:4E:5F:00:03', NOW() - INTERVAL '45 days', NOW() + INTERVAL '45 days', 'sha256:ef56ab12cd34', '-----BEGIN CERTIFICATE-----\nMIIDemoPay...\n-----END CERTIFICATE-----', NULL, NOW() - INTERVAL '45 days'),
|
|
('cv-auth-1', 'mc-auth-prod', '0A:1B:2C:3D:4E:5F:00:04', NOW() - INTERVAL '78 days', NOW() + INTERVAL '12 days', 'sha256:1234abcdef56', '-----BEGIN CERTIFICATE-----\nMIIDemoAuth...\n-----END CERTIFICATE-----', NULL, NOW() - INTERVAL '78 days'),
|
|
('cv-wild-1', 'mc-wildcard-prod', '0A:1B:2C:3D:4E:5F:00:05', NOW() - INTERVAL '40 days', NOW() + INTERVAL '50 days', 'sha256:5678abcdef12', '-----BEGIN CERTIFICATE-----\nMIIDemoWild...\n-----END CERTIFICATE-----', NULL, NOW() - INTERVAL '40 days')
|
|
ON CONFLICT (id) DO NOTHING;
|
|
|
|
-- Recent Audit Events
|
|
INSERT INTO audit_events (id, actor, actor_type, action, resource_type, resource_id, details, timestamp) VALUES
|
|
('audit-demo-01', 'alice@example.com', 'user', 'certificate.renewed', 'certificate', 'mc-api-prod', '{"issuer": "local", "serial": "0A:1B:2C:3D:4E:5F:00:01"}', NOW() - INTERVAL '15 days'),
|
|
('audit-demo-02', 'system', 'system', 'certificate.deployed', 'certificate', 'mc-api-prod', '{"target": "tgt-nginx-prod", "status": "success"}', NOW() - INTERVAL '15 days' + INTERVAL '5 minutes'),
|
|
('audit-demo-03', 'system', 'system', 'certificate.deployed', 'certificate', 'mc-api-prod', '{"target": "tgt-f5-prod", "status": "success"}', NOW() - INTERVAL '15 days' + INTERVAL '8 minutes'),
|
|
('audit-demo-04', 'dave@example.com', 'user', 'certificate.renewed', 'certificate', 'mc-web-prod', '{"issuer": "local", "serial": "0A:1B:2C:3D:4E:5F:00:02"}', NOW() - INTERVAL '30 days'),
|
|
('audit-demo-05', 'carol@example.com', 'user', 'certificate.created', 'certificate', 'mc-pay-prod', '{"common_name": "pay.example.com"}', NOW() - INTERVAL '200 days'),
|
|
('audit-demo-06', 'system', 'system', 'renewal.started', 'certificate', 'mc-grafana-prod', '{"reason": "expiring_in_3_days"}', NOW() - INTERVAL '2 hours'),
|
|
('audit-demo-07', 'system', 'system', 'renewal.failed', 'certificate', 'mc-vpn-prod', '{"error": "ACME challenge failed: DNS timeout", "attempt": 3}', NOW() - INTERVAL '1 hour'),
|
|
('audit-demo-08', 'system', 'system', 'expiration.warning', 'certificate', 'mc-auth-prod', '{"days_until_expiry": 12}', NOW() - INTERVAL '30 minutes'),
|
|
('audit-demo-09', 'system', 'system', 'expiration.warning', 'certificate', 'mc-cdn-prod', '{"days_until_expiry": 8}', NOW() - INTERVAL '25 minutes'),
|
|
('audit-demo-10', 'system', 'system', 'expiration.warning', 'certificate', 'mc-mail-prod', '{"days_until_expiry": 5}', NOW() - INTERVAL '20 minutes'),
|
|
('audit-demo-11', 'bob@example.com', 'user', 'agent.registered', 'agent', 'ag-iis-prod', '{"hostname": "iis-prod-01.internal"}', NOW() - INTERVAL '30 days'),
|
|
('audit-demo-12', 'system', 'system', 'agent.offline', 'agent', 'ag-iis-prod', '{"last_heartbeat": "3 hours ago"}', NOW() - INTERVAL '3 hours'),
|
|
('audit-demo-13', 'alice@example.com', 'user', 'policy.violation', 'certificate', 'mc-legacy-prod', '{"rule": "max-certificate-lifetime", "message": "Certificate expired"}', NOW() - INTERVAL '3 days'),
|
|
('audit-demo-14', 'bob@example.com', 'user', 'issuer.configured', 'issuer', 'iss-local', '{"type": "local", "ca_common_name": "CertCtl Demo CA"}', NOW() - INTERVAL '90 days'),
|
|
('audit-demo-15', 'alice@example.com', 'user', 'target.configured', 'target', 'tgt-nginx-prod', '{"type": "nginx", "agent": "ag-web-prod"}', NOW() - INTERVAL '90 days')
|
|
ON CONFLICT (id) DO NOTHING;
|
|
|
|
-- Policy Violations (reference policy rules by their IDs from seed.sql)
|
|
INSERT INTO policy_violations (id, certificate_id, rule_id, message, severity, created_at) VALUES
|
|
('pv-demo-01', 'mc-legacy-prod', 'pr-max-certificate-lifetime', 'Certificate has expired and exceeds maximum lifetime policy', 'critical', NOW() - INTERVAL '3 days'),
|
|
('pv-demo-02', 'mc-old-api', 'pr-max-certificate-lifetime', 'Certificate expired 15 days ago', 'critical', NOW() - INTERVAL '15 days'),
|
|
('pv-demo-03', 'mc-vpn-prod', 'pr-min-renewal-window', 'Renewal failed within minimum renewal window', 'error', NOW() - INTERVAL '1 hour'),
|
|
('pv-demo-04', 'mc-mail-prod', 'pr-min-renewal-window', 'Certificate expiring in 5 days, below 14-day minimum window','warning', NOW() - INTERVAL '20 minutes')
|
|
ON CONFLICT (id) DO NOTHING;
|
|
|
|
-- Notification Events
|
|
INSERT INTO notification_events (id, type, certificate_id, channel, recipient, message, sent_at, status, error) VALUES
|
|
('ne-demo-01', 'expiration_warning', 'mc-auth-prod', 'email', 'bob@example.com', 'Certificate auth-production expires in 12 days', NOW() - INTERVAL '30 minutes', 'sent', NULL),
|
|
('ne-demo-02', 'expiration_warning', 'mc-cdn-prod', 'email', 'alice@example.com', 'Certificate cdn-production expires in 8 days', NOW() - INTERVAL '25 minutes', 'sent', NULL),
|
|
('ne-demo-03', 'expiration_warning', 'mc-mail-prod', 'email', 'bob@example.com', 'Certificate mail-production expires in 5 days', NOW() - INTERVAL '20 minutes', 'sent', NULL),
|
|
('ne-demo-04', 'renewal_failure', 'mc-vpn-prod', 'webhook', 'https://hooks.example.com/certctl', 'Renewal failed for vpn-production after 3 attempts', NOW() - INTERVAL '1 hour', 'sent', NULL),
|
|
('ne-demo-05', 'renewal_success', 'mc-api-prod', 'email', 'alice@example.com', 'Certificate api-production renewed successfully', NOW() - INTERVAL '15 days', 'sent', NULL),
|
|
('ne-demo-06', 'deployment_success', 'mc-api-prod', 'webhook', 'https://hooks.example.com/certctl', 'Certificate api-production deployed to NGINX Production', NOW() - INTERVAL '15 days', 'sent', NULL)
|
|
ON CONFLICT (id) DO NOTHING;
|
|
|
|
-- Agent Groups
|
|
INSERT INTO agent_groups (id, name, description, match_os, match_architecture, match_ip_cidr, match_version, enabled, created_at, updated_at) VALUES
|
|
('ag-linux-prod', 'Linux Production', 'All Linux agents in production', 'linux', '', '', '', true, NOW(), NOW()),
|
|
('ag-linux-amd64', 'Linux AMD64', 'Linux agents on x86_64 architecture', 'linux', 'amd64', '', '', true, NOW(), NOW()),
|
|
('ag-windows', 'Windows Agents', 'All Windows-based agents', 'windows', '', '', '', true, NOW(), NOW()),
|
|
('ag-datacenter-a', 'Datacenter A', 'Agents in 10.0.1.0/24 subnet', '', '', '10.0.1.0/24', '', true, NOW(), NOW()),
|
|
('ag-manual', 'Manual Group', 'Manually managed agent group (no dynamic criteria)', '', '', '', '', false, NOW(), NOW())
|
|
ON CONFLICT (id) DO NOTHING;
|
|
|
|
-- Network Scan Targets
|
|
INSERT INTO network_scan_targets (id, name, cidrs, ports, enabled, scan_interval_hours, timeout_ms, created_at, updated_at) VALUES
|
|
('nst-dc1-web', 'DC1 Web Servers', '{10.0.1.0/24}', '{443,8443}', true, 6, 5000, NOW(), NOW()),
|
|
('nst-dc2-apps', 'DC2 Application Tier', '{10.0.2.0/24,10.0.3.0/24}', '{443}', true, 6, 5000, NOW(), NOW()),
|
|
('nst-dmz', 'DMZ Public Endpoints', '{192.168.100.0/24}', '{443,8443,9443}', true, 12, 3000, NOW(), NOW())
|
|
ON CONFLICT (id) DO NOTHING;
|
|
|
|
-- Agent Group Members (manual membership for the manual group)
|
|
INSERT INTO agent_group_members (agent_group_id, agent_id, membership_type, created_at) VALUES
|
|
('ag-manual', 'ag-web-prod', 'include', NOW()),
|
|
('ag-manual', 'ag-web-staging', 'include', NOW()),
|
|
('ag-manual', 'ag-iis-prod', 'exclude', NOW())
|
|
ON CONFLICT (agent_group_id, agent_id) DO NOTHING;
|
|
|
|
-- Sentinel agent for network-discovered certificates (created by server on startup, seed for demo)
|
|
INSERT INTO agents (id, name, hostname, status, last_heartbeat_at, registered_at, api_key_hash, os, architecture, ip_address, version) VALUES
|
|
('server-scanner', 'Network Scanner (Server-Side)', 'certctl-server', 'online', NOW(), NOW() - INTERVAL '30 days', 'sentinel_no_auth', 'linux', 'amd64', '127.0.0.1', '2.0.5')
|
|
ON CONFLICT (id) DO NOTHING;
|
|
|
|
-- Discovery Scans — show recent scan activity from agents
|
|
INSERT INTO discovery_scans (id, agent_id, directories, certificates_found, certificates_new, errors_count, scan_duration_ms, started_at, completed_at) VALUES
|
|
('ds-web-prod-01', 'ag-web-prod', '{/etc/nginx/ssl,/etc/pki/tls/certs}', 4, 2, 0, 1250, NOW() - INTERVAL '3 hours', NOW() - INTERVAL '3 hours' + INTERVAL '1 second'),
|
|
('ds-data-prod-01', 'ag-data-prod', '{/etc/nginx/ssl,/opt/certs}', 3, 1, 0, 980, NOW() - INTERVAL '2 hours', NOW() - INTERVAL '2 hours' + INTERVAL '1 second'),
|
|
('ds-network-scan-01','server-scanner', '{network-scan}', 3, 3, 0, 4500, NOW() - INTERVAL '1 hour', NOW() - INTERVAL '1 hour' + INTERVAL '5 seconds')
|
|
ON CONFLICT (id) DO NOTHING;
|
|
|
|
-- Discovered Certificates — populate discovery triage page with realistic mix
|
|
INSERT INTO discovered_certificates (id, fingerprint_sha256, common_name, sans, serial_number, issuer_dn, subject_dn, not_before, not_after, key_algorithm, key_size, is_ca, pem_data, source_path, source_format, agent_id, discovery_scan_id, managed_certificate_id, status, first_seen_at, last_seen_at) VALUES
|
|
-- Unmanaged: found on filesystem, not yet claimed
|
|
('dc-unmanaged-01', 'sha256:f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0',
|
|
'internal-service.example.com', ARRAY['internal-service.example.com', 'internal-svc.local'],
|
|
'1A:2B:3C:4D:5E:6F:00:11', 'CN=Example Internal CA,O=Example Corp',
|
|
'CN=internal-service.example.com,O=Example Corp', NOW() - INTERVAL '200 days', NOW() + INTERVAL '20 days',
|
|
'RSA', 2048, false, '', '/etc/pki/tls/certs/internal-svc.pem', 'PEM',
|
|
'ag-web-prod', 'ds-web-prod-01', NULL, 'Unmanaged',
|
|
NOW() - INTERVAL '7 days', NOW() - INTERVAL '3 hours'),
|
|
|
|
('dc-unmanaged-02', 'sha256:a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0',
|
|
'monitoring.internal.example.com', ARRAY['monitoring.internal.example.com', 'prometheus.internal.example.com'],
|
|
'2B:3C:4D:5E:6F:7A:00:22', 'CN=Let''s Encrypt Authority X3,O=Let''s Encrypt',
|
|
'CN=monitoring.internal.example.com', NOW() - INTERVAL '60 days', NOW() + INTERVAL '30 days',
|
|
'ECDSA', 256, false, '', '/opt/certs/monitoring.pem', 'PEM',
|
|
'ag-data-prod', 'ds-data-prod-01', NULL, 'Unmanaged',
|
|
NOW() - INTERVAL '5 days', NOW() - INTERVAL '2 hours'),
|
|
|
|
('dc-unmanaged-03', 'sha256:1122334455667788990011223344556677889900',
|
|
'db-replication.example.com', ARRAY['db-replication.example.com'],
|
|
'3C:4D:5E:6F:7A:8B:00:33', 'CN=Example Internal CA,O=Example Corp',
|
|
'CN=db-replication.example.com,O=Example Corp', NOW() - INTERVAL '300 days', NOW() - INTERVAL '10 days',
|
|
'RSA', 4096, false, '', '/etc/pki/tls/certs/db-repl.pem', 'PEM',
|
|
'ag-web-prod', 'ds-web-prod-01', NULL, 'Unmanaged',
|
|
NOW() - INTERVAL '7 days', NOW() - INTERVAL '3 hours'),
|
|
|
|
-- Managed: already linked to managed certificates
|
|
('dc-managed-01', 'sha256:ab12cd34ef56ab12cd34ef56ab12cd34ef56ab12',
|
|
'api.example.com', ARRAY['api.example.com', 'api-v2.example.com'],
|
|
'0A:1B:2C:3D:4E:5F:00:01', 'CN=CertCtl Demo CA',
|
|
'CN=api.example.com', NOW() - INTERVAL '15 days', NOW() + INTERVAL '75 days',
|
|
'ECDSA', 256, false, '', '/etc/nginx/ssl/cert.pem', 'PEM',
|
|
'ag-web-prod', 'ds-web-prod-01', 'mc-api-prod', 'Managed',
|
|
NOW() - INTERVAL '15 days', NOW() - INTERVAL '3 hours'),
|
|
|
|
('dc-managed-02', 'sha256:cd34ef56ab12cd34ef56ab12cd34ef56ab12cd34',
|
|
'data.example.com', ARRAY['data.example.com', 'analytics.example.com'],
|
|
'0A:1B:2C:3D:4E:5F:00:06', 'CN=CertCtl Demo CA',
|
|
'CN=data.example.com', NOW() - INTERVAL '35 days', NOW() + INTERVAL '55 days',
|
|
'ECDSA', 256, false, '', '/etc/nginx/ssl/cert.pem', 'PEM',
|
|
'ag-data-prod', 'ds-data-prod-01', 'mc-data-prod', 'Managed',
|
|
NOW() - INTERVAL '35 days', NOW() - INTERVAL '2 hours'),
|
|
|
|
-- Dismissed: triaged and explicitly ignored
|
|
('dc-dismissed-01', 'sha256:9988776655443322110099887766554433221100',
|
|
'test-selfsigned.local', ARRAY['test-selfsigned.local', 'localhost'],
|
|
'00:00:00:00:00:00:FF:01', 'CN=test-selfsigned.local',
|
|
'CN=test-selfsigned.local', NOW() - INTERVAL '365 days', NOW() + INTERVAL '365 days',
|
|
'RSA', 2048, false, '', '/etc/pki/tls/certs/test.pem', 'PEM',
|
|
'ag-web-prod', 'ds-web-prod-01', NULL, 'Dismissed',
|
|
NOW() - INTERVAL '7 days', NOW() - INTERVAL '3 hours'),
|
|
|
|
-- Network-discovered certs (from server-scanner sentinel agent)
|
|
('dc-network-01', 'sha256:net1aabbccdd11223344556677889900aabbccdd',
|
|
'switch-mgmt.example.com', ARRAY['switch-mgmt.example.com'],
|
|
'5E:6F:7A:8B:9C:0D:00:44', 'CN=Example Network CA,O=Example Corp',
|
|
'CN=switch-mgmt.example.com,O=Example Corp', NOW() - INTERVAL '180 days', NOW() + INTERVAL '5 days',
|
|
'RSA', 2048, false, '', '10.0.1.50:443', 'TLS',
|
|
'server-scanner', 'ds-network-scan-01', NULL, 'Unmanaged',
|
|
NOW() - INTERVAL '1 hour', NOW() - INTERVAL '1 hour'),
|
|
|
|
('dc-network-02', 'sha256:net2eeff00112233445566778899aabbccddeeff',
|
|
'printer.example.com', ARRAY['printer.example.com'],
|
|
'6F:7A:8B:9C:0D:1E:00:55', 'CN=printer.example.com',
|
|
'CN=printer.example.com', NOW() - INTERVAL '400 days', NOW() - INTERVAL '30 days',
|
|
'RSA', 1024, false, '', '10.0.2.100:443', 'TLS',
|
|
'server-scanner', 'ds-network-scan-01', NULL, 'Unmanaged',
|
|
NOW() - INTERVAL '1 hour', NOW() - INTERVAL '1 hour'),
|
|
|
|
('dc-network-03', 'sha256:net3001122334455667788990011223344556677',
|
|
'vpn-appliance.example.com', ARRAY['vpn-appliance.example.com', '10.0.1.1'],
|
|
'7A:8B:9C:0D:1E:2F:00:66', 'CN=Fortinet CA,O=Fortinet',
|
|
'CN=vpn-appliance.example.com', NOW() - INTERVAL '90 days', NOW() + INTERVAL '275 days',
|
|
'RSA', 2048, false, '', '10.0.1.1:443', 'TLS',
|
|
'server-scanner', 'ds-network-scan-01', NULL, 'Unmanaged',
|
|
NOW() - INTERVAL '1 hour', NOW() - INTERVAL '1 hour')
|
|
ON CONFLICT (id) DO NOTHING;
|
|
|
|
-- Jobs — add AwaitingApproval jobs for approval workflow demo
|
|
INSERT INTO jobs (id, type, certificate_id, target_id, agent_id, status, attempts, max_attempts, last_error, scheduled_at, created_at) VALUES
|
|
('job-approval-01', 'renewal', 'mc-auth-prod', NULL, 'ag-web-prod', 'AwaitingApproval', 0, 3, NULL, NOW() - INTERVAL '1 hour', NOW() - INTERVAL '1 hour'),
|
|
('job-approval-02', 'renewal', 'mc-pay-prod', NULL, 'ag-web-prod', 'AwaitingApproval', 0, 3, NULL, NOW() - INTERVAL '30 minutes', NOW() - INTERVAL '30 minutes')
|
|
ON CONFLICT (id) DO NOTHING;
|
|
|
|
-- Update network scan targets with last_scan data so GUI shows recent activity
|
|
UPDATE network_scan_targets SET
|
|
last_scan_at = NOW() - INTERVAL '1 hour',
|
|
last_scan_duration_ms = 4500,
|
|
last_scan_certs_found = 3
|
|
WHERE id = 'nst-dc1-web';
|
|
|
|
UPDATE network_scan_targets SET
|
|
last_scan_at = NOW() - INTERVAL '2 hours',
|
|
last_scan_duration_ms = 8200,
|
|
last_scan_certs_found = 0
|
|
WHERE id = 'nst-dc2-apps';
|