diff options
| author | makefu <github@syntax-fehler.de> | 2023-09-09 19:42:08 +0200 |
|---|---|---|
| committer | makefu <github@syntax-fehler.de> | 2023-09-09 19:42:08 +0200 |
| commit | 29d72c898d674d2c18fc0f4a76b5e623de0c3dfe (patch) | |
| tree | fc4b0695c986a1cda6f1fbbbcbe716e203c54fa3 /krebs/5pkgs/simple/renew-krebs-intermediate-ca/default.nix | |
| parent | e157ffa72856e4378aa23b096b2efff233f3cb3d (diff) | |
| parent | 083229d0211096daec08673f743ccc45b1d8a0ac (diff) | |
Merge remote-tracking branch 'lass/master'
Diffstat (limited to 'krebs/5pkgs/simple/renew-krebs-intermediate-ca/default.nix')
| -rw-r--r-- | krebs/5pkgs/simple/renew-krebs-intermediate-ca/default.nix | 30 |
1 files changed, 30 insertions, 0 deletions
diff --git a/krebs/5pkgs/simple/renew-krebs-intermediate-ca/default.nix b/krebs/5pkgs/simple/renew-krebs-intermediate-ca/default.nix new file mode 100644 index 000000000..d3557894d --- /dev/null +++ b/krebs/5pkgs/simple/renew-krebs-intermediate-ca/default.nix @@ -0,0 +1,30 @@ +{ pkgs }: +pkgs.writers.writeDashBin "renew-intermediate-ca" '' + TMPDIR=$(mktemp -d) + trap "rm -rf $TMPDIR;" INT TERM EXIT + mkdir -p "$TMPDIR/krebs" + brain show ca/ca.key > "$TMPDIR/krebs/ca.key" + brain show ca/ca.crt > "$TMPDIR/krebs/ca.crt" + brain show krebs-secrets/hotdog/acme_ca.key > "$TMPDIR/acme.key" + cp ${toString ../../../6assets/krebsAcmeCA.crt} "$TMPDIR/acme.crt" + export STEPPATH="$TMPDIR/step" + cat << EOF > "$TMPDIR/intermediate.tpl" + { + "subject": {{ toJson .Subject }}, + "keyUsage": ["certSign", "crlSign"], + "basicConstraints": { + "isCA": true, + "maxPathLen": 0 + }, + "nameConstraints": { + "critical": true, + "permittedDNSDomains": ["r" ,"w"] + } + } + EOF + + ${pkgs.step-cli}/bin/step ca renew "$TMPDIR/ca.crt" "$TMPDIR/ca.key" \ + --offline \ + --root "$TMPDIR/krebs/ca.crt" \ + --ca-config "$TMPDIR/intermediate.tpl" +'' |