Secure certificates after generation

bin/deploy.sh

@@ -5,5 +5,18 @@ if [ $# = 0 ]; then
     exit 1
 fi
 
-nixops modify -d $1 $1.nix
+if [ ! -f $1/deployment.nix ]; then
+    echo "error: $1 does not contain a deployment"
+    exit 1
+fi
+
+mkdir -p $1/gcroots
+
+echo "--- Securing certifiates"
+nix-build -o $1/gcroots/certs $1/build.nix
+
+echo "--- Updating deployment"
+nixops modify -d $1 $1/deployment.nix
+
+echo "--- Deploying $1"
 nixops deploy -d $*