Make cert algo configurable (for linkerd ecdsa)

modules/initca.nix

@@ -1,12 +1,18 @@
-{ pkgs ? import <nixpkgs> {}, ca ? null, name ? "ca", hosts ? [], ...}:
+{
+  pkgs ? import <nixpkgs> {},
+  ca ? null,
+  name ? "ca",
+  algo ? "rsa",
+  hosts ? [],
+  ...}:
 with pkgs;
 let
   ca_csr = pkgs.writeText "${name}-csr.json" (builtins.toJSON {
       inherit hosts;
       CN = "${name}";
       key = {
-          algo = "rsa";
+        inherit algo;
-          size = 2048;
+        size = if algo == "ecdsa" then 256 else 2048;
       };
       names = [
         {

modules/linkerd-certs.nix

@@ -3,12 +3,14 @@ let
   identity = import ./initca.nix {
     inherit pkgs;
     name = "linkerd-identity-ca";
+    algo = "ecdsa";
     hosts = [ "identity.linkerd.cluster.local" ];
   };
 
   webhook = import ./initca.nix {
     inherit pkgs;
     name = "linkerd-webhook-ca";
+    algo = "ecdsa";
     hosts = [ "webhook.linkerd.cluster.local" ];
   };
 in {

modules/pki.nix

@@ -1,4 +1,4 @@
-{ pkgs, ca ? "" }:
+{ pkgs, ca ? "", algo ? "rsa" }:
 let
   initca = import ./initca.nix { inherit pkgs ca; };
 
@@ -33,8 +33,8 @@ let
       csr = {
         CN = "${args.cn}";
         key = {
-          algo = "rsa";
+          inherit algo;
-          size = 2048;
+          size = if algo == "ecdsa" then 256 else 2048;
         };
         names = [
           {