This repository has no description
1.6 kB
35 lines
1{ pkgs, ... }:
2# Private CA of the build farm plus the client cert lass uses towards it.
3# Shared, so every machine importing this sees the same CA. Clan requires a
4# shared generator to be defined identically on all machines, so nothing is
5# deployed from here: per-machine generators (nix-farm-server in builder.nix,
6# nix-farm-client in client.nix) depend on it and copy out the files they
7# need with their own owner/mode. The certs are not secret, but as secret
8# files their paths are known before `clan vars generate` ran, so the configs
9# still evaluate until then.
10{
11 clan.core.vars.generators.nix-farm-ca = {
12 share = true;
13 files."ca.key".deploy = false;
14 files."ca.crt".deploy = false;
15 files."client.key".deploy = false;
16 files."client.crt".deploy = false;
17 runtimeInputs = [ pkgs.openssl ];
18 script = ''
19 openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -nodes \
20 -keyout "$out/ca.key" -out "$out/ca.crt" -days 3650 \
21 -subj "/CN=nix-farm-ca" \
22 -addext "basicConstraints=critical,CA:TRUE" \
23 -addext "keyUsage=critical,keyCertSign,cRLSign"
24
25 openssl req -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -nodes \
26 -keyout "$out/client.key" -out client.csr -subj "/CN=lass"
27 printf '%s\n' \
28 "basicConstraints=critical,CA:FALSE" \
29 "keyUsage=critical,digitalSignature" \
30 "extendedKeyUsage=clientAuth" > client.ext
31 openssl x509 -req -in client.csr -CA "$out/ca.crt" -CAkey "$out/ca.key" \
32 -CAcreateserial -days 3650 -extfile client.ext -out "$out/client.crt"
33 '';
34 };
35}