···

       
325
       
 
       
        '');

     

       
326
       
 
       
      } // optionalAttrs (data.listenHTTP != null && toInt (elemAt (splitString ":" data.listenHTTP) 1) < 1024) {

     

       
327
       
 
       
        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];

     

       
0
       
 
       

     

       
328
       
 
       
      };

     

       
329
       
 
       


     

       
330
       
 
       
      # Working directory will be /tmp

     

···

       
325
       
 
       
        '');

     

       
326
       
 
       
      } // optionalAttrs (data.listenHTTP != null && toInt (elemAt (splitString ":" data.listenHTTP) 1) < 1024) {

     

       
327
       
 
       
        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];

     

       
328
       
+
       
        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];

     

       
329
       
 
       
      };

     

       
330
       
 
       


     

       
331
       
 
       
      # Working directory will be /tmp

     

···

       
173
       
 
       
      services.nginx.logError = "stderr info";

     

       
174
       
 
       


     

       
175
       
 
       
      specialisation = {

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
176
       
 
       
        # First derivation used to test general ACME features

     

       
177
       
 
       
        general.configuration = { ... }: let

     

       
178
       
 
       
          caDomain = nodes.acme.test-support.acme.caDomain;

     
···

       
446
       
 
       


     

       
447
       
 
       
      download_ca_certs(client)

     

       
448
       
 
       


     

       
449
       
-
       
      # Perform general tests first

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
450
       
 
       
      switch_to(webserver, "general")

     

       
451
       
 
       


     

       
452
       
 
       
      with subtest("Can request certificate with HTTP-01 challenge"):

     

···

       
173
       
 
       
      services.nginx.logError = "stderr info";

     

       
174
       
 
       


     

       
175
       
 
       
      specialisation = {

     

       
176
       
+
       
        # Tests HTTP-01 verification using Lego's built-in web server

     

       
177
       
+
       
        http01lego.configuration = { ... }: {

     

       
178
       
+
       
          security.acme = {

     

       
179
       
+
       
            certs."http.example.test" = {

     

       
180
       
+
       
              listenHTTP = ":80";

     

       
181
       
+
       
            };

     

       
182
       
+
       
          };

     

       
183
       
+
       


     

       
184
       
+
       
          networking.firewall.allowedTCPPorts = [ 80 ];

     

       
185
       
+
       
        };

     

       
186
       
+
       


     

       
187
       
 
       
        # First derivation used to test general ACME features

     

       
188
       
 
       
        general.configuration = { ... }: let

     

       
189
       
 
       
          caDomain = nodes.acme.test-support.acme.caDomain;

     
···

       
457
       
 
       


     

       
458
       
 
       
      download_ca_certs(client)

     

       
459
       
 
       


     

       
460
       
+
       
      # Perform http-01 w/ lego test first

     

       
461
       
+
       
      switch_to(webserver, "http01lego")

     

       
462
       
+
       


     

       
463
       
+
       
      with subtest("Can request certificate with Lego's built in web server"):

     

       
464
       
+
       
          webserver.wait_for_unit("acme-finished-http.example.test.target")

     

       
465
       
+
       
          check_fullchain(webserver, "http.example.test")

     

       
466
       
+
       
          check_issuer(webserver, "http.example.test", "pebble")

     

       
467
       
+
       


     

       
468
       
+
       
      # Perform general tests

     

       
469
       
 
       
      switch_to(webserver, "general")

     

       
470
       
 
       


     

       
471
       
 
       
      with subtest("Can request certificate with HTTP-01 challenge"):