Secure certificates after generation

lib/pki.nix

@@ -36,7 +36,7 @@
     }
   '';
 
-  initca =
+  initca' =
     let
       ca_csr = gencsr {
         name = "kubernetes";
@@ -51,9 +51,9 @@
            mkdir -p $out; cp *.pem $out'';
 
    # make ca derivation sha depend on initca cfssl output
-   initca' = pkgs.stdenv.mkDerivation {
+   initca = pkgs.stdenv.mkDerivation {
     name = "ca";
-    src = initca;
+    src = initca';
     buildCommand = ''
       mkdir -p $out;
       cp -r $src/* $out
@@ -61,8 +61,8 @@
   };
 
   ca = {
-    key = "${initca'}/ca-key.pem";
-    cert = "${initca'}/ca.pem";
+    key = "${initca}/ca-key.pem";
+    cert = "${initca}/ca.pem";
   };
 
   cfssl = conf: ''
@@ -72,16 +72,16 @@
     mkdir -p $out; cp *.pem $out
   '';
 
+  toSet = cert:
+    {
+      key = "${cert}/cert-key.pem";
+      cert = "${cert}/cert.pem";
+    };
+
   gencert = conf:
-    let
-      drv = pkgs.runCommand "${conf.name}" {
+      pkgs.runCommand "${conf.name}" {
         buildInputs = [ pkgs.cfssl ];
       } (cfssl conf);
-    in
-      {
-        key = "${drv}/cert-key.pem";
-        cert = "${drv}/cert.pem";
-      };
 
   admin = gencert rec {
       name = "admin";