d0f04c1623
Shimming out the Let's Encrypt domain name to reuse client configuration
doesn't work properly (Pebble uses different endpoint URL formats), is
recommended against by upstream,[1] and is unnecessary now that the ACME
module supports specifying an ACME server. This commit changes the tests
to use the domain name acme.test instead, and renames the letsencrypt
node to acme to reflect that it has nothing to do with the ACME server
that Let's Encrypt runs. The imports are renamed for clarity:
* nixos/tests/common/{letsencrypt => acme}/{common.nix => client}
* nixos/tests/common/{letsencrypt => acme}/{default.nix => server}
The test's other domain names are also adjusted to use *.test for
consistency (and to avoid misuse of non-reserved domain names such
as standalone.com).
[1] https://github.com/letsencrypt/pebble/issues/283#issuecomment-545123242
Co-authored-by: Yegor Timoshenko <yegortimoshenko@riseup.net>
69 lines
1.9 KiB
Nix
69 lines
1.9 KiB
Nix
{ pkgs ? import <nixpkgs> {}
|
|
, lib ? pkgs.lib
|
|
, domains ? [ "acme.test" ]
|
|
}:
|
|
|
|
pkgs.runCommand "acme-snakeoil-ca" {
|
|
nativeBuildInputs = [ pkgs.openssl ];
|
|
} ''
|
|
addpem() {
|
|
local file="$1"; shift
|
|
local storeFileName="$(IFS=.; echo "$*")"
|
|
|
|
echo -n " " >> "$out"
|
|
|
|
# Every following argument is an attribute, so let's recurse and check
|
|
# every attribute whether it must be quoted and write it into $out.
|
|
while [ -n "$1" ]; do
|
|
if expr match "$1" '^[a-zA-Z][a-zA-Z0-9]*$' > /dev/null; then
|
|
echo -n "$1" >> "$out"
|
|
else
|
|
echo -n '"' >> "$out"
|
|
echo -n "$1" | sed -e 's/["$]/\\&/g' >> "$out"
|
|
echo -n '"' >> "$out"
|
|
fi
|
|
shift
|
|
[ -z "$1" ] || echo -n . >> "$out"
|
|
done
|
|
|
|
echo " = builtins.toFile \"$storeFileName\" '''" >> "$out"
|
|
sed -e 's/^/ /' "$file" >> "$out"
|
|
|
|
echo " ''';" >> "$out"
|
|
}
|
|
|
|
echo '# Generated via mkcert.sh in the same directory.' > "$out"
|
|
echo '{' >> "$out"
|
|
|
|
openssl req -newkey rsa:4096 -x509 -sha256 -days 36500 \
|
|
-subj '/CN=Snakeoil CA' -nodes -out ca.pem -keyout ca.key
|
|
|
|
addpem ca.key ca key
|
|
addpem ca.pem ca cert
|
|
|
|
${lib.concatMapStrings (fqdn: let
|
|
opensslConfig = pkgs.writeText "snakeoil.cnf" ''
|
|
[req]
|
|
default_bits = 4096
|
|
prompt = no
|
|
default_md = sha256
|
|
req_extensions = req_ext
|
|
distinguished_name = dn
|
|
[dn]
|
|
CN = ${fqdn}
|
|
[req_ext]
|
|
subjectAltName = DNS:${fqdn}
|
|
'';
|
|
in ''
|
|
export OPENSSL_CONF=${lib.escapeShellArg opensslConfig}
|
|
openssl genrsa -out snakeoil.key 4096
|
|
openssl req -new -key snakeoil.key -out snakeoil.csr
|
|
openssl x509 -req -in snakeoil.csr -sha256 -set_serial 666 \
|
|
-CA ca.pem -CAkey ca.key -out snakeoil.pem -days 36500
|
|
addpem snakeoil.key ${lib.escapeShellArg fqdn} key
|
|
addpem snakeoil.pem ${lib.escapeShellArg fqdn} cert
|
|
'') domains}
|
|
|
|
echo '}' >> "$out"
|
|
''
|