86 lines
2.0 KiB
Nix
86 lines
2.0 KiB
Nix
with import <nixpkgs> {};
|
|
let
|
|
ca-config = pkgs.writeText "ca-config.json" ''
|
|
{
|
|
"signing": {
|
|
"default": {
|
|
"expiry": "43800h"
|
|
},
|
|
"profiles": {
|
|
"server": {
|
|
"expiry": "43800h",
|
|
"usages": [
|
|
"signing",
|
|
"key encipherment",
|
|
"server auth"
|
|
]
|
|
},
|
|
"client": {
|
|
"expiry": "43800h",
|
|
"usages": [
|
|
"signing",
|
|
"key encipherment",
|
|
"client auth"
|
|
]
|
|
},
|
|
"peer": {
|
|
"expiry": "43800h",
|
|
"usages": [
|
|
"signing",
|
|
"key encipherment",
|
|
"server auth",
|
|
"client auth"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
'';
|
|
|
|
csr = args: pkgs.writeText "${args.cn}-cert.json" ''
|
|
{
|
|
"CN": "${args.cn}",
|
|
"hosts": [ ${args.hosts} ],
|
|
"key": {
|
|
"algo": "rsa",
|
|
"size": 2048
|
|
},
|
|
"names": [
|
|
{
|
|
"C": "NO",
|
|
"L": "Tromsø",
|
|
"O": "Serit IT Partner Tromsø AS",
|
|
"OU": "",
|
|
"ST": ""
|
|
}
|
|
]
|
|
}
|
|
'';
|
|
|
|
ca-csr = csr { cn = "kubernetes"; hosts = ""; };
|
|
ca = pkgs.runCommand "ca-cert" {
|
|
buildInputs = [ pkgs.cfssl ];
|
|
} '' cfssl genkey -initca ${ca-csr} | cfssljson -bare ca; \
|
|
mkdir -p $out; cp *.pem $out'';
|
|
|
|
ca_cert = "${ca}/ca.pem";
|
|
ca_key = "${ca}/ca-key.pem";
|
|
|
|
cfssl = name: profile: ''
|
|
cfssl gencert -ca ${ca_cert} -ca-key ${ca_key} \
|
|
-config=${ca-config} -profile=${profile} ${name} | cfssljson -bare cert; \
|
|
mkdir -p $out; cp *.pem $out
|
|
'';
|
|
in
|
|
rec {
|
|
inherit ca_cert;
|
|
inherit ca_key;
|
|
inherit csr;
|
|
|
|
mkCert = cert:
|
|
pkgs.runCommand "${cert.name}-cert" {
|
|
buildInputs = [ pkgs.cfssl ];
|
|
} (cfssl cert.csr cert.profile);
|
|
|
|
}
|