commit 39796cad46f1d0b0a14e84a680ababf5ab1ff86d · pyrox.dev/nixpkgs

nixos/modules/security/acme/default.nix

···

       325
       325
        
               '');

     

       326
       326
        
             } // optionalAttrs (data.listenHTTP != null && toInt (elemAt (splitString ":" data.listenHTTP) 1) < 1024) {

     

       327
       327
        
               CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];

     

       328
       328
       +
               AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];

     

       328
       329
        
             };

     

       329
       330
        
       

     

       330
       331
        
             # Working directory will be /tmp

+20 -1

nixos/tests/acme.nix

···

       173
       173
        
             services.nginx.logError = "stderr info";

     

       174
       174
        
       

     

       175
       175
        
             specialisation = {

     

       176
       176
       +
               # Tests HTTP-01 verification using Lego's built-in web server

     

       177
       177
       +
               http01lego.configuration = { ... }: {

     

       178
       178
       +
                 security.acme = {

     

       179
       179
       +
                   certs."http.example.test" = {

     

       180
       180
       +
                     listenHTTP = ":80";

     

       181
       181
       +
                   };

     

       182
       182
       +
                 };

     

       183
       183
       +
       

     

       184
       184
       +
                 networking.firewall.allowedTCPPorts = [ 80 ];

     

       185
       185
       +
               };

     

       186
       186
       +
       

     

       176
       187
        
               # First derivation used to test general ACME features

     

       177
       188
        
               general.configuration = { ... }: let

     

       178
       189
        
                 caDomain = nodes.acme.test-support.acme.caDomain;

     
···

       446
       457
        
       

     

       447
       458
        
             download_ca_certs(client)

     

       448
       459
        
       

     

       449
       449
       -
             # Perform general tests first

     

       460
       460
       +
             # Perform http-01 w/ lego test first

     

       461
       461
       +
             switch_to(webserver, "http01lego")

     

       462
       462
       +
       

     

       463
       463
       +
             with subtest("Can request certificate with Lego's built in web server"):

     

       464
       464
       +
                 webserver.wait_for_unit("acme-finished-http.example.test.target")

     

       465
       465
       +
                 check_fullchain(webserver, "http.example.test")

     

       466
       466
       +
                 check_issuer(webserver, "http.example.test", "pebble")

     

       467
       467
       +
       

     

       468
       468
       +
             # Perform general tests

     

       450
       469
        
             switch_to(webserver, "general")

     

       451
       470
        
       

     

       452
       471
        
             with subtest("Can request certificate with HTTP-01 challenge"):