d0f04c1623
Shimming out the Let's Encrypt domain name to reuse client configuration
doesn't work properly (Pebble uses different endpoint URL formats), is
recommended against by upstream,[1] and is unnecessary now that the ACME
module supports specifying an ACME server. This commit changes the tests
to use the domain name acme.test instead, and renames the letsencrypt
node to acme to reflect that it has nothing to do with the ACME server
that Let's Encrypt runs. The imports are renamed for clarity:
* nixos/tests/common/{letsencrypt => acme}/{common.nix => client}
* nixos/tests/common/{letsencrypt => acme}/{default.nix => server}
The test's other domain names are also adjusted to use *.test for
consistency (and to avoid misuse of non-reserved domain names such
as standalone.com).
[1] https://github.com/letsencrypt/pebble/issues/283#issuecomment-545123242
Co-authored-by: Yegor Timoshenko <yegortimoshenko@riseup.net>
136 lines
4.1 KiB
Nix
136 lines
4.1 KiB
Nix
# The certificate for the ACME service is exported as:
|
|
#
|
|
# config.test-support.acme.caCert
|
|
#
|
|
# This value can be used inside the configuration of other test nodes to inject
|
|
# the snakeoil certificate into security.pki.certificateFiles or into package
|
|
# overlays.
|
|
#
|
|
# Another value that's needed if you don't use a custom resolver (see below for
|
|
# notes on that) is to add the acme node as a nameserver to every node
|
|
# that needs to acquire certificates using ACME, because otherwise the API host
|
|
# for acme.test can't be resolved.
|
|
#
|
|
# A configuration example of a full node setup using this would be this:
|
|
#
|
|
# {
|
|
# acme = import ./common/acme/server;
|
|
#
|
|
# example = { nodes, ... }: {
|
|
# networking.nameservers = [
|
|
# nodes.acme.config.networking.primaryIPAddress
|
|
# ];
|
|
# security.pki.certificateFiles = [
|
|
# nodes.acme.config.test-support.acme.caCert
|
|
# ];
|
|
# };
|
|
# }
|
|
#
|
|
# By default, this module runs a local resolver, generated using resolver.nix
|
|
# from the parent directory to automatically discover all zones in the network.
|
|
#
|
|
# If you do not want this and want to use your own resolver, you can just
|
|
# override networking.nameservers like this:
|
|
#
|
|
# {
|
|
# acme = { nodes, ... }: {
|
|
# imports = [ ./common/acme/server ];
|
|
# networking.nameservers = [
|
|
# nodes.myresolver.config.networking.primaryIPAddress
|
|
# ];
|
|
# };
|
|
#
|
|
# myresolver = ...;
|
|
# }
|
|
#
|
|
# Keep in mind, that currently only _one_ resolver is supported, if you have
|
|
# more than one resolver in networking.nameservers only the first one will be
|
|
# used.
|
|
#
|
|
# Also make sure that whenever you use a resolver from a different test node
|
|
# that it has to be started _before_ the ACME service.
|
|
{ config, pkgs, lib, ... }:
|
|
|
|
|
|
let
|
|
snakeOilCerts = import ./snakeoil-certs.nix;
|
|
|
|
wfeDomain = "acme.test";
|
|
wfeCertFile = snakeOilCerts.${wfeDomain}.cert;
|
|
wfeKeyFile = snakeOilCerts.${wfeDomain}.key;
|
|
|
|
siteDomain = "acme.test";
|
|
siteCertFile = snakeOilCerts.${siteDomain}.cert;
|
|
siteKeyFile = snakeOilCerts.${siteDomain}.key;
|
|
pebble = pkgs.pebble;
|
|
resolver = let
|
|
message = "You need to define a resolver for the acme test module.";
|
|
firstNS = lib.head config.networking.nameservers;
|
|
in if config.networking.nameservers == [] then throw message else firstNS;
|
|
|
|
pebbleConf.pebble = {
|
|
listenAddress = "0.0.0.0:443";
|
|
managementListenAddress = "0.0.0.0:15000";
|
|
certificate = snakeOilCerts.${wfeDomain}.cert;
|
|
privateKey = snakeOilCerts.${wfeDomain}.key;
|
|
httpPort = 80;
|
|
tlsPort = 443;
|
|
ocspResponderURL = "http://0.0.0.0:4002";
|
|
};
|
|
|
|
pebbleConfFile = pkgs.writeText "pebble.conf" (builtins.toJSON pebbleConf);
|
|
pebbleDataDir = "/root/pebble";
|
|
|
|
in {
|
|
imports = [ ../../resolver.nix ];
|
|
|
|
options.test-support.acme.caCert = lib.mkOption {
|
|
type = lib.types.path;
|
|
description = ''
|
|
A certificate file to use with the <literal>nodes</literal> attribute to
|
|
inject the snakeoil CA certificate used in the ACME server into
|
|
<option>security.pki.certificateFiles</option>.
|
|
'';
|
|
};
|
|
|
|
config = {
|
|
test-support = {
|
|
resolver.enable = let
|
|
isLocalResolver = config.networking.nameservers == [ "127.0.0.1" ];
|
|
in lib.mkOverride 900 isLocalResolver;
|
|
acme.caCert = snakeOilCerts.ca.cert;
|
|
};
|
|
|
|
# This has priority 140, because modules/testing/test-instrumentation.nix
|
|
# already overrides this with priority 150.
|
|
networking.nameservers = lib.mkOverride 140 [ "127.0.0.1" ];
|
|
networking.firewall.enable = false;
|
|
|
|
networking.extraHosts = ''
|
|
127.0.0.1 ${wfeDomain}
|
|
${config.networking.primaryIPAddress} ${wfeDomain} ${siteDomain}
|
|
'';
|
|
|
|
systemd.services = {
|
|
pebble = {
|
|
enable = true;
|
|
description = "Pebble ACME server";
|
|
requires = [ ];
|
|
wantedBy = [ "network.target" ];
|
|
preStart = ''
|
|
mkdir ${pebbleDataDir}
|
|
'';
|
|
script = ''
|
|
cd ${pebbleDataDir}
|
|
${pebble}/bin/pebble -config ${pebbleConfFile}
|
|
'';
|
|
serviceConfig = {
|
|
# Required to bind on privileged ports.
|
|
User = "root";
|
|
Group = "root";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
}
|