Add one-command server and client bootstraps

2026-09-03 16:34:21 -06:00
parent 742ae9c2b5
commit 3a10098239
19 changed files with 1569 additions and 37 deletions
@@ -33,29 +33,51 @@ if (-not $ekuExtension -or
    throw 'The certificate is not valid for TLS client authentication.'
 }

-if ($PSCmdlet.ShouldProcess($candidate.Thumbprint, 'Trust and allow the SGU client certificate')) {
-    $trustedCertificate = Import-Certificate `
-        -FilePath $CertificatePath `
-        -CertStoreLocation Cert:\LocalMachine\Root |
-        Select-Object -First 1
-
-    $configuration = Get-Content -LiteralPath $BrokerConfigurationPath -Raw | ConvertFrom-Json
-    $allowed = @($configuration.Broker.Tls.AllowedClientThumbprints |
-        ForEach-Object { $_ -replace ' ', '' })
-    if ($allowed -notcontains $trustedCertificate.Thumbprint) {
-        $configuration.Broker.Tls.AllowedClientThumbprints = @($allowed + $trustedCertificate.Thumbprint)
-        $backupPath = "$BrokerConfigurationPath.before-$($trustedCertificate.Thumbprint.Substring(0, 12)).bak"
-        Copy-Item -LiteralPath $BrokerConfigurationPath -Destination $backupPath -Force
-        [IO.File]::WriteAllText(
-            $BrokerConfigurationPath,
-            ($configuration | ConvertTo-Json -Depth 8),
-            [Text.UTF8Encoding]::new($false))
+$mutex = [Threading.Mutex]::new($false, 'Global\SGUAuthBroker-Client-AllowList')
+$lockTaken = $false
+try {
+    try {
+        $lockTaken = $mutex.WaitOne([TimeSpan]::FromSeconds(30))
+    }
+    catch [Threading.AbandonedMutexException] {
+        # The previous updater exited unexpectedly, but this process now owns
+        # the abandoned mutex and can safely rebuild the allow-list from disk.
+        $lockTaken = $true
+    }
+    if (-not $lockTaken) {
+        throw 'Timed out waiting to update the broker client allow-list.'
    }

-    Restart-Service -Name $serviceName -Force
-    (Get-Service -Name $serviceName).WaitForStatus(
-        [System.ServiceProcess.ServiceControllerStatus]::Running,
-        [TimeSpan]::FromSeconds(20))
+    if ($PSCmdlet.ShouldProcess($candidate.Thumbprint, 'Trust and allow the SGU client certificate')) {
+        $trustedCertificate = Import-Certificate `
+            -FilePath $CertificatePath `
+            -CertStoreLocation Cert:\LocalMachine\Root |
+            Select-Object -First 1
+
+        $configuration = Get-Content -LiteralPath $BrokerConfigurationPath -Raw | ConvertFrom-Json
+        $allowed = @($configuration.Broker.Tls.AllowedClientThumbprints |
+            ForEach-Object { $_ -replace ' ', '' })
+        if ($allowed -notcontains $trustedCertificate.Thumbprint) {
+            $configuration.Broker.Tls.AllowedClientThumbprints = @($allowed + $trustedCertificate.Thumbprint)
+            $backupPath = "$BrokerConfigurationPath.before-$($trustedCertificate.Thumbprint.Substring(0, 12)).bak"
+            Copy-Item -LiteralPath $BrokerConfigurationPath -Destination $backupPath -Force
+            [IO.File]::WriteAllText(
+                $BrokerConfigurationPath,
+                ($configuration | ConvertTo-Json -Depth 8),
+                [Text.UTF8Encoding]::new($false))
+        }
+
+        Restart-Service -Name $serviceName -Force
+        (Get-Service -Name $serviceName).WaitForStatus(
+            [System.ServiceProcess.ServiceControllerStatus]::Running,
+            [TimeSpan]::FromSeconds(20))
+    }
+}
+finally {
+    if ($lockTaken) {
+        $mutex.ReleaseMutex()
+    }
+    $mutex.Dispose()
 }

 [pscustomobject]@{