oceanbox/platform
6
0
Fork 0
Code Issues 10 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Force ca derivation sha change when new ca is generated.

Browse Source
This commit is contained in:
Jonas Juselius
2018-05-24 14:50:59 +02:00
parent 490dd3edd3
commit 4ac3287a34
5 changed files with 52 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
bin/initca.sh
View File

@@ -1,2 +1,3 @@
#!/usr/bin/env bash #!/usr/bin/env bash
nix-instantiate --add-root `pwd`/gcroots/certs --indirect -E "import ./certs.nix" # nix-store --add-root `pwd`/gcroots/initca --indirect -r $(nix-instantiate ./initca.nix)
nix-build -o gcroots/initca ./initca.nix

56
fs0.nix
View File

@@ -8,36 +8,36 @@ let
''; '';
nixosConfig = node: ip: nixosConfig = node: ip:
let let
cert = pki.trust node ''"${node}", "${ip}", "127.0.0.1"''; cert = pki.trust node ''"${node}", "${ip}", "127.0.0.1"'';
in in
{ {
imports = [ imports = [
(./nixos/hardware-configuration + "/${node}.nix") (./nixos/hardware-configuration + "/${node}.nix")
./nixos/configuration.nix ./nixos/configuration.nix
]; ];
boot.kernelModules = [ boot.kernelModules = [
"dm_snapshot" "dm_snapshot"
"dm_mirror" "dm_mirror"
"dm_thin_pool" "dm_thin_pool"
]; ];
networking = { networking = {
hostName = node; hostName = node;
extraHosts = clusterHosts; extraHosts = clusterHosts;
firewall.allowedTCPPortRanges = [ { from = 5000; to = 50000; } ]; firewall.allowedTCPPortRanges = [ { from = 5000; to = 50000; } ];
firewall.allowedTCPPorts = [ 111 ]; firewall.allowedTCPPorts = [ 111 ];
firewall.allowedUDPPorts = [ 111 24007 24008 ]; firewall.allowedUDPPorts = [ 111 24007 24008 ];
};
services.glusterfs = {
enable = true;
tlsSettings = {
caCert = pki.ca.cert;
tlsKeyPath = cert.key;
tlsPem = cert.cert;
}; };
services.glusterfs = {
enable = true;
tlsSettings = {
caCert = pki.ca.cert;
tlsKeyPath = cert.key;
tlsPem = cert.cert;
};
};
environment.systemPackages = [ pkgs.lvm2 ];
}; };
environment.systemPackages = [ pkgs.lvm2 ];
};
in in
{ {
fs0-0 = { ... }: fs0-0 = { ... }:

14
kube0.nix
View File

@@ -24,12 +24,12 @@ let
"10.253.18.102", "10.253.18.102",
"127.0.0.1" "127.0.0.1"
''; '';
k0-0 = pki.worker { name = "k0-0"; ip = "10.253.18.100"; }; k0-0 = pki.worker { name = "k0-0"; ip = "10.253.18.100"; };
k0-1 = pki.worker { name = "k0-1"; ip = "10.253.18.101"; }; k0-1 = pki.worker { name = "k0-1"; ip = "10.253.18.101"; };
k0-2 = pki.worker { name = "k0-2"; ip = "10.253.18.102"; }; k0-2 = pki.worker { name = "k0-2"; ip = "10.253.18.102"; };
k0-3 = pki.worker { name = "k0-3"; ip = "10.253.18.103"; }; k0-3 = pki.worker { name = "k0-3"; ip = "10.253.18.103"; };
k0-4 = pki.worker { name = "k0-4"; ip = "10.253.18.107"; }; k0-4 = pki.worker { name = "k0-4"; ip = "10.253.18.107"; };
k0-5 = pki.worker { name = "k0-5"; ip = "10.253.18.108"; }; k0-5 = pki.worker { name = "k0-5"; ip = "10.253.18.108"; };
}; };
cluster = callPackage ./lib/k8s.nix { cluster = callPackage ./lib/k8s.nix {
masterNode = "10.253.18.100"; masterNode = "10.253.18.100";
@@ -58,7 +58,7 @@ in
]; ];
services.dnsmasq.enable = true; services.dnsmasq.enable = true;
fileSystems."/data" = { fileSystems."/data" = {
device = "k0-0:gv0"; device = "fs0-0:gv0";
fsType = "glusterfs"; fsType = "glusterfs";
}; };
environment.systemPackages = [ pkgs.lvm2 ]; environment.systemPackages = [ pkgs.lvm2 ];

17
lib/pki.nix
View File

@@ -45,13 +45,24 @@
hosts = ""; hosts = "";
}; };
in in
pkgs.runCommand "ca" { pkgs.runCommand "initca" {
buildInputs = [ pkgs.cfssl ]; buildInputs = [ pkgs.cfssl ];
} '' cfssl genkey -initca ${ca_csr} | cfssljson -bare ca; \ } '' cfssl genkey -initca ${ca_csr} | cfssljson -bare ca; \
mkdir -p $out; cp *.pem $out''; mkdir -p $out; cp *.pem $out'';
# make ca derivation sha depend on initca cfssl output
initca' = pkgs.stdenv.mkDerivation {
name = "ca";
src = initca;
buildCommand = ''
mkdir -p $out;
cp -r $src/* $out
'';
};
ca = { ca = {
key = "${initca}/ca-key.pem"; key = "${initca'}/ca-key.pem";
cert = "${initca}/ca.pem"; cert = "${initca'}/ca.pem";
}; };
cfssl = conf: '' cfssl = conf: ''

2
nixos/configuration.nix
View File

@@ -23,7 +23,7 @@
services.vmwareGuest.enable = true; services.vmwareGuest.enable = true;
# The NixOS release to be compatible with for stateful data such as databases. # The NixOS release to be compatible with for stateful data such as databases.
system.nixos.stateVersion = "18.03"; system.nixos.stateVersion = "18.09";
programs.fish.enable = true; programs.fish.enable = true;
programs.tmux.enable = true; programs.tmux.enable = true;