Improve base deployment and pki handling

lib/initca.nix

@@ -1,18 +1,18 @@
-{ pkgs ? import <nixpkgs> {}, initca ? "", ...}:
+{ pkgs ? import <nixpkgs> {}, ca ? "", name ? "ca", ...}:
 with pkgs;
 let
-  initca' =
+  ca' =
     let
-      ca_csr = pkgs.writeText "kube-pki-cacert-csr.json" (builtins.toJSON {
+      ca_csr = pkgs.writeText "${name}-csr.json" (builtins.toJSON {
           key = {
               algo = "rsa";
               size = 2048;
           };
           names = [
             {
-              CN = "kubernetes-cluster-ca";
+              CN = "${name}";
               O = "NixOS";
-              OU = "services.kubernetes.pki.caSpec";
+              OU = "${name}.pki.caSpec";
               L = "generated";
             }
           ];
@@ -22,12 +22,12 @@ let
         buildInputs = [ pkgs.cfssl ];
       } '' cfssl genkey -initca ${ca_csr} | cfssljson -bare ca; \
            mkdir -p $out; cp *.pem $out'';
-  ca = if initca != "" then initca else initca';
+   initca = if ca != "" then ca else ca';
 in
   # make ca derivation sha depend on initca cfssl output
   pkgs.stdenv.mkDerivation {
-    name = "ca";
-    src = ca;
+    inherit name;
+    src = initca;
     buildCommand = ''
       mkdir -p $out;
       cp -r $src/* $out