SolarManager unter Versionsverwaltung

Erster Stand der Hintergrundprozesse, die auf der Synology unter
/volume1/homes/wagner/SolarManager laufen: der Manager selbst, die Sammler
je Geraet, die MQTT-Bruecke, der Wecker und - neu hinzugezogen - der
AutoAction-Runner, der als Hintergrundprozess hierher gehoert und nicht ins
Web-Verzeichnis.

Zugangsdaten stehen nicht mehr im Quelltext, sondern in config.ini, die
nicht mit eingecheckt wird. Vorlage ist config.ini.example, gelesen wird sie
von konfig.py. Betroffen waren solarManager.py (Datenbank und Wattpilot),
zeit.py, gatherWaterData.py, wecker.py und skoda_testdaten.py, das sich das
Passwort bisher aus dem Quelltext eines anderen Moduls herausgesucht hat.

Die Kia-Anbindung ist mit dem Fahrzeug entfallen: kiaTest.py,
gatherCarData.py und hyundai_kia_connect_api sind nicht mehr dabei, ebenso
gatherInverterData.py, auf das nur noch eine auskommentierte Zeile zeigte.

Die mitgelieferten Bibliotheken bleiben im Repository - die NAS hat kein
pip, sie muessen neben den Skripten liegen.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

phaoUtils/tests/ssl/gen.sh

@@ -0,0 +1,82 @@
+#!/bin/sh
+# This file generates the keys and certificates used for testing mosquitto.
+# None of the keys are encrypted, so do not just use this script to generate
+# files for your own use.
+
+set -e
+
+rm -f *.crt *.key *.csr
+for a in root signing; do
+	rm -rf ${a}CA/
+	mkdir -p ${a}CA/newcerts
+	touch ${a}CA/index.txt
+	echo 01 > ${a}CA/serial
+	echo 01 > ${a}CA/crlnumber
+done
+rm -rf certs
+
+BASESUBJ="/C=GB/ST=Derbyshire/L=Derby/O=Paho Project/OU=Testing"
+SBASESUBJ="/C=GB/ST=Nottinghamshire/L=Nottingham/O=Server/OU=Production"
+BBASESUBJ="/C=GB/ST=Nottinghamshire/L=Nottingham/O=Server/OU=Bridge"
+
+# The root CA
+openssl genrsa -out test-root-ca.key 2048
+openssl req -new -x509 -days 3650 -key test-root-ca.key -out test-root-ca.crt -config openssl.cnf -subj "${BASESUBJ}/CN=Root CA/"
+
+# Another root CA that doesn't sign anything
+openssl genrsa -out test-bad-root-ca.key 2048
+openssl req -new -x509 -days 3650 -key test-bad-root-ca.key -out test-bad-root-ca.crt -config openssl.cnf -subj "${BASESUBJ}/CN=Bad Root CA/"
+
+# This is a root CA that has the exact same details as the real root CA, but is a different key and certificate. Effectively a "fake" CA.
+openssl genrsa -out test-fake-root-ca.key 2048
+openssl req -new -x509 -days 3650 -key test-fake-root-ca.key -out test-fake-root-ca.crt -config openssl.cnf -subj "${BASESUBJ}/CN=Root CA/"
+
+# An intermediate CA, signed by the root CA, used to sign server/client csrs.
+openssl genrsa -out test-signing-ca.key 2048
+openssl req -out test-signing-ca.csr -key test-signing-ca.key -new -config openssl.cnf -subj "${BASESUBJ}/CN=Signing CA/"
+openssl ca -batch -config openssl.cnf -name CA_root -extensions v3_ca -out test-signing-ca.crt -infiles test-signing-ca.csr
+
+# An alternative intermediate CA, signed by the root CA, not used to sign anything.
+openssl genrsa -out test-alt-ca.key 2048
+openssl req -out test-alt-ca.csr -key test-alt-ca.key -new -config openssl.cnf -subj "${BASESUBJ}/CN=Alternative Signing CA/"
+openssl ca -batch -config openssl.cnf -name CA_root -extensions v3_ca -out test-alt-ca.crt -infiles test-alt-ca.csr
+
+# Valid server key and certificate.
+openssl genrsa -out server.key 2048
+openssl req -new -key server.key -out server.csr -config openssl.cnf -subj "${SBASESUBJ}/CN=localhost/"
+openssl ca -batch -config openssl.cnf -name CA_signing -out server.crt -infiles server.csr
+
+# Expired server certificate, based on the above server key.
+openssl req -new -days 1 -key server.key -out server-expired.csr -config openssl.cnf -subj "${SBASESUBJ}/CN=localhost/"
+echo -n > signingCA/index.txt
+echo 01 > signingCA/serial
+openssl ca -batch -config openssl.cnf -name CA_signing -days 1 -startdate 120820000000Z -enddate 120821000000Z -out server-expired.crt -infiles server-expired.csr
+
+# Valid client key and certificate.
+openssl genrsa -out client.key 2048
+openssl req -new -key client.key -out client.csr -config openssl.cnf -subj "${SBASESUBJ}/CN=test client/"
+openssl ca -batch -config openssl.cnf -name CA_signing -out client.crt -infiles client.csr
+
+# Expired client certificate, based on the above client key.
+openssl req -new -days 1 -key client.key -out client-expired.csr -config openssl.cnf -subj "${SBASESUBJ}/CN=test client expired/"
+openssl ca -batch -config openssl.cnf -name CA_signing -days 1 -startdate 120820000000Z -enddate 120821000000Z -out client-expired.crt -infiles client-expired.csr
+
+# Valid client key and certificate, key is encrypted with a password.
+openssl genrsa -aes128 -passout pass:password -out client-pw.key 2048
+openssl req -new -key client-pw.key -passin pass:password -out client-pw.csr -config openssl.cnf -subj "${SBASESUBJ}/CN=test client with password/"
+openssl ca -batch -config openssl.cnf -name CA_signing -out client-pw.crt -infiles client-pw.csr
+
+# Revoked client certificate, based on a new client key.
+openssl genrsa -out client-revoked.key 2048
+openssl req -new -days 1 -key client-revoked.key -out client-revoked.csr -config openssl.cnf -subj "${SBASESUBJ}/CN=test client revoked/"
+openssl ca -batch -config openssl.cnf -name CA_signing -out client-revoked.crt -infiles client-revoked.csr
+openssl ca -batch -config openssl.cnf -name CA_signing -revoke client-revoked.crt
+openssl ca -batch -config openssl.cnf -name CA_signing -gencrl -out crl.pem
+
+cat test-signing-ca.crt test-root-ca.crt > all-ca.crt
+#mkdir certs
+#cp test-signing-ca.crt certs/test-signing-ca.pem
+#cp test-root-ca.crt certs/test-root.ca.pem
+c_rehash certs
+
+rm -f client-expired.csr client-revoked.csr server-expired.csr server.csr test-alt-ca.csr