Force ca derivation sha change when new ca is generated.

bin/initca.sh

@@ -1,2 +1,3 @@
 #!/usr/bin/env bash
-nix-instantiate --add-root `pwd`/gcroots/certs --indirect -E "import ./certs.nix"
+# nix-store --add-root `pwd`/gcroots/initca --indirect -r $(nix-instantiate ./initca.nix)
+nix-build -o gcroots/initca ./initca.nix

kube0.nix

@@ -58,7 +58,7 @@ in
     ];
     services.dnsmasq.enable = true;
     fileSystems."/data" = {
-      device = "k0-0:gv0";
+      device = "fs0-0:gv0";
       fsType = "glusterfs";
     };
     environment.systemPackages = [ pkgs.lvm2 ];

lib/pki.nix

@@ -45,13 +45,24 @@
         hosts = "";
       };
     in
-      pkgs.runCommand "ca" {
+      pkgs.runCommand "initca" {
         buildInputs = [ pkgs.cfssl ];
       } '' cfssl genkey -initca ${ca_csr} | cfssljson -bare ca; \
            mkdir -p $out; cp *.pem $out'';
+
+   # make ca derivation sha depend on initca cfssl output
+   initca' = pkgs.stdenv.mkDerivation {
+    name = "ca";
+    src = initca;
+    buildCommand = ''
+      mkdir -p $out;
+      cp -r $src/* $out
+    '';
+  };
+
   ca = {
-    key = "${initca}/ca-key.pem";
-    cert = "${initca}/ca.pem";
+    key = "${initca'}/ca-key.pem";
+    cert = "${initca'}/ca.pem";
   };
 
   cfssl = conf: ''

nixos/configuration.nix

@@ -23,7 +23,7 @@
   services.vmwareGuest.enable = true;
 
   # The NixOS release to be compatible with for stateful data such as databases.
-  system.nixos.stateVersion = "18.03";
+  system.nixos.stateVersion = "18.09";
   programs.fish.enable = true;
   programs.tmux.enable = true;