commit a1cb02148bf9611136b1c939ec46eaf2ac3e8d8a · pyrox.dev/nixpkgs

+4 -1

nixos/modules/security/acme.nix

···

       122
        
             "--email" data.email

     

       123
        
             "--key-type" data.keyType

     

       124
        
           ] ++ protocolOpts

     

       125
       -
             ++ optionals data.ocspMustStaple [ "--must-staple" ]

     

       126
        
             ++ optionals (acmeServer != null) [ "--server" acmeServer ]

     

       127
        
             ++ concatMap (name: [ "-d" name ]) extraDomains

     

       128
        
             ++ data.extraLegoFlags;

     

       129
        
       

     

       0
        
       
     

       0
        
       
     

       130
        
           runOpts = escapeShellArgs (

     

       131
        
             commonOpts

     

       132
        
             ++ [ "run" ]

     

       0
        
       
     

       133
        
             ++ data.extraLegoRunFlags

     

       134
        
           );

     

       135
        
           renewOpts = escapeShellArgs (

     

       136
        
             commonOpts

     

       137
        
             ++ [ "renew" "--reuse-key" ]

     

       0
        
       
     

       138
        
             ++ data.extraLegoRenewFlags

     

       139
        
           );

     

       140

···

       122
        
             "--email" data.email

     

       123
        
             "--key-type" data.keyType

     

       124
        
           ] ++ protocolOpts

     

       0
        
       
     

       125
        
             ++ optionals (acmeServer != null) [ "--server" acmeServer ]

     

       126
        
             ++ concatMap (name: [ "-d" name ]) extraDomains

     

       127
        
             ++ data.extraLegoFlags;

     

       128
        
       

     

       129
       +
           # Although --must-staple is common to both modes, it is not declared as a

     

       130
       +
           # mode-agnostic argument in lego and thus must come after the mode.

     

       131
        
           runOpts = escapeShellArgs (

     

       132
        
             commonOpts

     

       133
        
             ++ [ "run" ]

     

       134
       +
             ++ optionals data.ocspMustStaple [ "--must-staple" ]

     

       135
        
             ++ data.extraLegoRunFlags

     

       136
        
           );

     

       137
        
           renewOpts = escapeShellArgs (

     

       138
        
             commonOpts

     

       139
        
             ++ [ "renew" "--reuse-key" ]

     

       140
       +
             ++ optionals data.ocspMustStaple [ "--must-staple" ]

     

       141
        
             ++ data.extraLegoRenewFlags

     

       142
        
           );

     

       143

+38 -3

nixos/tests/acme.nix

···

       97
        
               };

     

       98
        
             };

     

       99
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       100
        
             # Test using Apache HTTPD

     

       101
        
             specialisation.httpd-aliases.configuration = { pkgs, config, lib, ... }: {

     

       102
        
               services.nginx.enable = lib.mkForce false;

     
···

       163
        
       

     

       164
        
         testScript = {nodes, ...}:

     

       165
        
           let

     

       0
        
       
     

       166
        
             newServerSystem = nodes.webserver.config.system.build.toplevel;

     

       167
        
             switchToNewServer = "${newServerSystem}/bin/switch-to-configuration test";

     

       168
        
           in

     
···

       246
        
                     return check_connection_key_bits(node, domain, bits, retries - 1)

     

       247
        
       

     

       248
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       249
        
             client.start()

     

       250
        
             dnsserver.start()

     

       251
        
       

     
···

       253
        
             client.wait_for_unit("default.target")

     

       254
        
       

     

       255
        
             client.succeed(

     

       256
       -
                 'curl --data \'{"host": "acme.test", "addresses": ["${nodes.acme.config.networking.primaryIPAddress}"]}\' http://${dnsServerIP nodes}:8055/add-a'

     

       257
        
             )

     

       258
        
       

     

       259
        
             acme.start()

     
···

       262
        
             acme.wait_for_unit("default.target")

     

       263
        
             acme.wait_for_unit("pebble.service")

     

       264
        
       

     

       265
       -
             client.succeed("curl https://acme.test:15000/roots/0 > /tmp/ca.crt")

     

       266
       -
             client.succeed("curl https://acme.test:15000/intermediate-keys/0 >> /tmp/ca.crt")

     

       267
        
       

     

       268
        
             with subtest("Can request certificate with HTTPS-01 challenge"):

     

       269
        
                 webserver.wait_for_unit("acme-finished-a.example.test.target")

     
···

       289
        
                 webserver.wait_for_unit("acme-finished-a.example.test.target")

     

       290
        
                 check_connection_key_bits(client, "a.example.test", "384")

     

       291
        
                 webserver.succeed("grep testing /var/lib/acme/a.example.test/test")

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       292
        
       

     

       293
        
             with subtest("Can request certificate with HTTPS-01 when nginx startup is delayed"):

     

       294
        
                 switch_to(webserver, "slow-startup")

···

       97
        
               };

     

       98
        
             };

     

       99
        
       

     

       100
       +
             # Test OCSP Stapling

     

       101
       +
             specialisation.ocsp-stapling.configuration = { pkgs, ... }: {

     

       102
       +
               security.acme.certs."a.example.test" = {

     

       103
       +
                 ocspMustStaple = true;

     

       104
       +
               };

     

       105
       +
               services.nginx.virtualHosts."a.example.com" = {

     

       106
       +
                 extraConfig = ''

     

       107
       +
                   ssl_stapling on;

     

       108
       +
                   ssl_stapling_verify on;

     

       109
       +
                 '';

     

       110
       +
               };

     

       111
       +
             };

     

       112
       +
       

     

       113
        
             # Test using Apache HTTPD

     

       114
        
             specialisation.httpd-aliases.configuration = { pkgs, config, lib, ... }: {

     

       115
        
               services.nginx.enable = lib.mkForce false;

     
···

       176
        
       

     

       177
        
         testScript = {nodes, ...}:

     

       178
        
           let

     

       179
       +
             caDomain = nodes.acme.config.test-support.acme.caDomain;

     

       180
        
             newServerSystem = nodes.webserver.config.system.build.toplevel;

     

       181
        
             switchToNewServer = "${newServerSystem}/bin/switch-to-configuration test";

     

       182
        
           in

     
···

       260
        
                     return check_connection_key_bits(node, domain, bits, retries - 1)

     

       261
        
       

     

       262
        
       

     

       263
       +
             def check_stapling(node, domain, retries=3):

     

       264
       +
                 assert retries >= 0

     

       265
       +
       

     

       266
       +
                 # Pebble doesn't provide a full OCSP responder, so just check the URL

     

       267
       +
                 result = node.succeed(

     

       268
       +
                     "openssl s_client -CAfile /tmp/ca.crt"

     

       269
       +
                     f" -servername {domain} -connect {domain}:443 < /dev/null"

     

       270
       +
                     " | openssl x509 -noout -ocsp_uri"

     

       271
       +
                 )

     

       272
       +
                 print("OCSP Responder URL:", result)

     

       273
       +
       

     

       274
       +
                 if "${caDomain}:4002" not in result.lower():

     

       275
       +
                     time.sleep(1)

     

       276
       +
                     return check_stapling(node, domain, retries - 1)

     

       277
       +
       

     

       278
       +
       

     

       279
        
             client.start()

     

       280
        
             dnsserver.start()

     

       281
        
       

     
···

       283
        
             client.wait_for_unit("default.target")

     

       284
        
       

     

       285
        
             client.succeed(

     

       286
       +
                 'curl --data \'{"host": "${caDomain}", "addresses": ["${nodes.acme.config.networking.primaryIPAddress}"]}\' http://${dnsServerIP nodes}:8055/add-a'

     

       287
        
             )

     

       288
        
       

     

       289
        
             acme.start()

     
···

       292
        
             acme.wait_for_unit("default.target")

     

       293
        
             acme.wait_for_unit("pebble.service")

     

       294
        
       

     

       295
       +
             client.succeed("curl https://${caDomain}:15000/roots/0 > /tmp/ca.crt")

     

       296
       +
             client.succeed("curl https://${caDomain}:15000/intermediate-keys/0 >> /tmp/ca.crt")

     

       297
        
       

     

       298
        
             with subtest("Can request certificate with HTTPS-01 challenge"):

     

       299
        
                 webserver.wait_for_unit("acme-finished-a.example.test.target")

     
···

       319
        
                 webserver.wait_for_unit("acme-finished-a.example.test.target")

     

       320
        
                 check_connection_key_bits(client, "a.example.test", "384")

     

       321
        
                 webserver.succeed("grep testing /var/lib/acme/a.example.test/test")

     

       322
       +
       

     

       323
       +
             with subtest("Correctly implements OCSP stapling"):

     

       324
       +
                 switch_to(webserver, "ocsp-stapling")

     

       325
       +
                 webserver.wait_for_unit("acme-finished-a.example.test.target")

     

       326
       +
                 check_stapling(client, "a.example.test")

     

       327
        
       

     

       328
        
             with subtest("Can request certificate with HTTPS-01 when nginx startup is delayed"):

     

       329
        
                 switch_to(webserver, "slow-startup")

+1 -1

nixos/tests/common/acme/server/default.nix

···

       70
        
           privateKey = testCerts.${domain}.key;

     

       71
        
           httpPort = 80;

     

       72
        
           tlsPort = 443;

     

       73
       -
           ocspResponderURL = "http://0.0.0.0:4002";

     

       74
        
           strict = true;

     

       75
        
         };

     

       76

···

       70
        
           privateKey = testCerts.${domain}.key;

     

       71
        
           httpPort = 80;

     

       72
        
           tlsPort = 443;

     

       73
       +
           ocspResponderURL = "http://${domain}:4002";

     

       74
        
           strict = true;

     

       75
        
         };

     

       76