commit d7046947e5f775070b4b44f60c17c6e878e3af8e · pyrox.dev/nixpkgs

+14

nixos/doc/manual/release-notes/rl-2009.xml

···

       395
       395
        
            </para>

     

       396
       396
        
          </listitem>

     

       397
       397
        
          <listitem>

     

       398
       398
       +
           <para>

     

       399
       399
       +
            The ACME module has been overhauled for simplicity and maintainability.

     

       400
       400
       +
            Cert generation now implicitly uses the <literal>acme</literal>

     

       401
       401
       +
            user, and the <literal>security.acme.certs._name_.user</literal> option

     

       402
       402
       +
            has been removed. Instead, certificate access from other services is now

     

       403
       403
       +
            managed through group permissions. The module no longer runs lego

     

       404
       404
       +
            twice under certain conditions, and will correctly renew certificates if

     

       405
       405
       +
            their configuration is changed. Services which reload nginx and httpd after

     

       406
       406
       +
            certificate renewal are now properly configured too so you no longer have

     

       407
       407
       +
            to do this manually if you are using HTTPS enabled virtual hosts. A mechanism

     

       408
       408
       +
            for regenerating certs on demand has also been added and documented.

     

       409
       409
       +
           </para>

     

       410
       410
       +
          </listitem>

     

       411
       411
       +
          <listitem>

     

       398
       412
        
            <para>

     

       399
       413
        
             Gollum received a major update to version 5.x and you may have to change

     

       400
       414
        
             some links in your wiki when migrating from gollum 4.x. More information

+408 -229

nixos/modules/security/acme.nix

···

       1
       1
       -
       { config, lib, pkgs, ... }:

     

       1
       1
       +
       { config, lib, pkgs, options, ... }:

     

       2
       2
        
       with lib;

     

       3
       3
        
       let

     

       4
       4
       +
         cfg = config.security.acme;

     

       4
       5
        
       

     

       5
       5
       -
         cfg = config.security.acme;

     

       6
       6
       +
         # Used to calculate timer accuracy for coalescing

     

       7
       7
       +
         numCerts = length (builtins.attrNames cfg.certs);

     

       8
       8
       +
         _24hSecs = 60 * 60 * 24;

     

       9
       9
       +
       

     

       10
       10
       +
         # There are many services required to make cert renewals work.

     

       11
       11
       +
         # They all follow a common structure:

     

       12
       12
       +
         #   - They inherit this commonServiceConfig

     

       13
       13
       +
         #   - They all run as the acme user

     

       14
       14
       +
         #   - They all use BindPath and StateDirectory where possible

     

       15
       15
       +
         #     to set up a sort of build environment in /tmp

     

       16
       16
       +
         # The Group can vary depending on what the user has specified in

     

       17
       17
       +
         # security.acme.certs.<cert>.group on some of the services.

     

       18
       18
       +
         commonServiceConfig = {

     

       19
       19
       +
             Type = "oneshot";

     

       20
       20
       +
             User = "acme";

     

       21
       21
       +
             Group = mkDefault "acme";

     

       22
       22
       +
             UMask = 0027;

     

       23
       23
       +
             StateDirectoryMode = 750;

     

       24
       24
       +
             ProtectSystem = "full";

     

       25
       25
       +
             PrivateTmp = true;

     

       26
       26
       +
       

     

       27
       27
       +
             WorkingDirectory = "/tmp";

     

       28
       28
       +
         };

     

       29
       29
       +
       

     

       30
       30
       +
         # In order to avoid race conditions creating the CA for selfsigned certs,

     

       31
       31
       +
         # we have a separate service which will create the necessary files.

     

       32
       32
       +
         selfsignCAService = {

     

       33
       33
       +
           description = "Generate self-signed certificate authority";

     

       34
       34
       +
       

     

       35
       35
       +
           path = with pkgs; [ minica ];

     

       36
       36
       +
       

     

       37
       37
       +
           unitConfig = {

     

       38
       38
       +
             ConditionPathExists = "!/var/lib/acme/.minica/key.pem";

     

       39
       39
       +
           };

     

       40
       40
       +
       

     

       41
       41
       +
           serviceConfig = commonServiceConfig // {

     

       42
       42
       +
             StateDirectory = "acme/.minica";

     

       43
       43
       +
             BindPaths = "/var/lib/acme/.minica:/tmp/ca";

     

       44
       44
       +
           };

     

       45
       45
       +
       

     

       46
       46
       +
           # Working directory will be /tmp

     

       47
       47
       +
           script = ''

     

       48
       48
       +
             minica \

     

       49
       49
       +
               --ca-key ca/key.pem \

     

       50
       50
       +
               --ca-cert ca/cert.pem \

     

       51
       51
       +
               --domains selfsigned.local

     

       52
       52
       +
       

     

       53
       53
       +
             chmod 600 ca/*

     

       54
       54
       +
           '';

     

       55
       55
       +
         };

     

       56
       56
       +
       

     

       57
       57
       +
         # Previously, all certs were owned by whatever user was configured in

     

       58
       58
       +
         # config.security.acme.certs.<cert>.user. Now everything is owned by and

     

       59
       59
       +
         # run by the acme user.

     

       60
       60
       +
         userMigrationService = {

     

       61
       61
       +
           description = "Fix owner and group of all ACME certificates";

     

       62
       62
       +
       

     

       63
       63
       +
           script = with builtins; concatStringsSep "\n" (mapAttrsToList (cert: data: ''

     

       64
       64
       +
             for fixpath in /var/lib/acme/${escapeShellArg cert} /var/lib/acme/.lego/${escapeShellArg cert}; do

     

       65
       65
       +
               if [ -d "$fixpath" ]; then

     

       66
       66
       +
                 chmod -R 750 "$fixpath"

     

       67
       67
       +
                 chown -R acme:${data.group} "$fixpath"

     

       68
       68
       +
               fi

     

       69
       69
       +
             done

     

       70
       70
       +
           '') certConfigs);

     

       71
       71
       +
       

     

       72
       72
       +
           # We don't want this to run every time a renewal happens

     

       73
       73
       +
           serviceConfig.RemainAfterExit = true;

     

       74
       74
       +
         };

     

       75
       75
       +
       

     

       76
       76
       +
         certToConfig = cert: data: let

     

       77
       77
       +
           acmeServer = if data.server != null then data.server else cfg.server;

     

       78
       78
       +
           useDns = data.dnsProvider != null;

     

       79
       79
       +
           destPath = "/var/lib/acme/${cert}";

     

       80
       80
       +
           selfsignedDeps = optionals (cfg.preliminarySelfsigned) [ "acme-selfsigned-${cert}.service" ];

     

       81
       81
       +
       

     

       82
       82
       +
           # Minica and lego have a "feature" which replaces * with _. We need

     

       83
       83
       +
           # to make this substitution to reference the output files from both programs.

     

       84
       84
       +
           # End users never see this since we rename the certs.

     

       85
       85
       +
           keyName = builtins.replaceStrings ["*"] ["_"] data.domain;

     

       86
       86
       +
       

     

       87
       87
       +
           # FIXME when mkChangedOptionModule supports submodules, change to that.

     

       88
       88
       +
           # This is a workaround

     

       89
       89
       +
           extraDomains = data.extraDomainNames ++ (

     

       90
       90
       +
             optionals

     

       91
       91
       +
             (data.extraDomains != "_mkMergedOptionModule")

     

       92
       92
       +
             (builtins.attrNames data.extraDomains)

     

       93
       93
       +
           );

     

       94
       94
       +
       

     

       95
       95
       +
           # Create hashes for cert data directories based on configuration

     

       96
       96
       +
           # Flags are separated to avoid collisions

     

       97
       97
       +
           hashData = with builtins; ''

     

       98
       98
       +
             ${concatStringsSep " " data.extraLegoFlags} -

     

       99
       99
       +
             ${concatStringsSep " " data.extraLegoRunFlags} -

     

       100
       100
       +
             ${concatStringsSep " " data.extraLegoRenewFlags} -

     

       101
       101
       +
             ${toString acmeServer} ${toString data.dnsProvider}

     

       102
       102
       +
             ${toString data.ocspMustStaple} ${data.keyType}

     

       103
       103
       +
           '';

     

       104
       104
       +
           mkHash = with builtins; val: substring 0 20 (hashString "sha256" val);

     

       105
       105
       +
           certDir = mkHash hashData;

     

       106
       106
       +
           domainHash = mkHash "${concatStringsSep " " extraDomains} ${data.domain}";

     

       107
       107
       +
           othersHash = mkHash "${toString acmeServer} ${data.keyType}";

     

       108
       108
       +
           accountDir = "/var/lib/acme/.lego/accounts/" + othersHash;

     

       109
       109
       +
       

     

       110
       110
       +
           protocolOpts = if useDns then (

     

       111
       111
       +
             [ "--dns" data.dnsProvider ]

     

       112
       112
       +
             ++ optionals (!data.dnsPropagationCheck) [ "--dns.disable-cp" ]

     

       113
       113
       +
           ) else (

     

       114
       114
       +
             [ "--http" "--http.webroot" data.webroot ]

     

       115
       115
       +
           );

     

       116
       116
       +
       

     

       117
       117
       +
           commonOpts = [

     

       118
       118
       +
             "--accept-tos" # Checking the option is covered by the assertions

     

       119
       119
       +
             "--path" "."

     

       120
       120
       +
             "-d" data.domain

     

       121
       121
       +
             "--email" data.email

     

       122
       122
       +
             "--key-type" data.keyType

     

       123
       123
       +
           ] ++ protocolOpts

     

       124
       124
       +
             ++ optionals data.ocspMustStaple [ "--must-staple" ]

     

       125
       125
       +
             ++ optionals (acmeServer != null) [ "--server" acmeServer ]

     

       126
       126
       +
             ++ concatMap (name: [ "-d" name ]) extraDomains

     

       127
       127
       +
             ++ data.extraLegoFlags;

     

       128
       128
       +
       

     

       129
       129
       +
           runOpts = escapeShellArgs (

     

       130
       130
       +
             commonOpts

     

       131
       131
       +
             ++ [ "run" ]

     

       132
       132
       +
             ++ data.extraLegoRunFlags

     

       133
       133
       +
           );

     

       134
       134
       +
           renewOpts = escapeShellArgs (

     

       135
       135
       +
             commonOpts

     

       136
       136
       +
             ++ [ "renew" "--reuse-key" ]

     

       137
       137
       +
             ++ data.extraLegoRenewFlags

     

       138
       138
       +
           );

     

       139
       139
       +
       

     

       140
       140
       +
         in {

     

       141
       141
       +
           inherit accountDir selfsignedDeps;

     

       142
       142
       +
       

     

       143
       143
       +
           webroot = data.webroot;

     

       144
       144
       +
           group = data.group;

     

       145
       145
       +
       

     

       146
       146
       +
           renewTimer = {

     

       147
       147
       +
             description = "Renew ACME Certificate for ${cert}";

     

       148
       148
       +
             wantedBy = [ "timers.target" ];

     

       149
       149
       +
             timerConfig = {

     

       150
       150
       +
               OnCalendar = cfg.renewInterval;

     

       151
       151
       +
               Unit = "acme-${cert}.service";

     

       152
       152
       +
               Persistent = "yes";

     

       153
       153
       +
       

     

       154
       154
       +
               # Allow systemd to pick a convenient time within the day

     

       155
       155
       +
               # to run the check.

     

       156
       156
       +
               # This allows the coalescing of multiple timer jobs.

     

       157
       157
       +
               # We divide by the number of certificates so that if you

     

       158
       158
       +
               # have many certificates, the renewals are distributed over

     

       159
       159
       +
               # the course of the day to avoid rate limits.

     

       160
       160
       +
               AccuracySec = "${toString (_24hSecs / numCerts)}s";

     

       161
       161
       +
       

     

       162
       162
       +
               # Skew randomly within the day, per https://letsencrypt.org/docs/integration-guide/.

     

       163
       163
       +
               RandomizedDelaySec = "24h";

     

       164
       164
       +
             };

     

       165
       165
       +
           };

     

       166
       166
       +
       

     

       167
       167
       +
           selfsignService = {

     

       168
       168
       +
             description = "Generate self-signed certificate for ${cert}";

     

       169
       169
       +
             after = [ "acme-selfsigned-ca.service" "acme-fixperms.service" ];

     

       170
       170
       +
             requires = [ "acme-selfsigned-ca.service" "acme-fixperms.service" ];

     

       171
       171
       +
       

     

       172
       172
       +
             path = with pkgs; [ minica ];

     

       173
       173
       +
       

     

       174
       174
       +
             unitConfig = {

     

       175
       175
       +
               ConditionPathExists = "!/var/lib/acme/${cert}/key.pem";

     

       176
       176
       +
             };

     

       177
       177
       +
       

     

       178
       178
       +
             serviceConfig = commonServiceConfig // {

     

       179
       179
       +
               Group = data.group;

     

       180
       180
       +
       

     

       181
       181
       +
               StateDirectory = "acme/${cert}";

     

       182
       182
       +
       

     

       183
       183
       +
               BindPaths = "/var/lib/acme/.minica:/tmp/ca /var/lib/acme/${cert}:/tmp/${keyName}";

     

       184
       184
       +
             };

     

       185
       185
       +
       

     

       186
       186
       +
             # Working directory will be /tmp

     

       187
       187
       +
             # minica will output to a folder sharing the name of the first domain

     

       188
       188
       +
             # in the list, which will be ${data.domain}

     

       189
       189
       +
             script = ''

     

       190
       190
       +
               minica \

     

       191
       191
       +
                 --ca-key ca/key.pem \

     

       192
       192
       +
                 --ca-cert ca/cert.pem \

     

       193
       193
       +
                 --domains ${escapeShellArg (builtins.concatStringsSep "," ([ data.domain ] ++ extraDomains))}

     

       194
       194
       +
       

     

       195
       195
       +
               # Create files to match directory layout for real certificates

     

       196
       196
       +
               cd '${keyName}'

     

       197
       197
       +
               cp ../ca/cert.pem chain.pem

     

       198
       198
       +
               cat cert.pem chain.pem > fullchain.pem

     

       199
       199
       +
               cat key.pem fullchain.pem > full.pem

     

       200
       200
       +
       

     

       201
       201
       +
               chmod 640 *

     

       202
       202
       +
       

     

       203
       203
       +
               # Group might change between runs, re-apply it

     

       204
       204
       +
               chown 'acme:${data.group}' *

     

       205
       205
       +
             '';

     

       206
       206
       +
           };

     

       207
       207
       +
       

     

       208
       208
       +
           renewService = {

     

       209
       209
       +
             description = "Renew ACME certificate for ${cert}";

     

       210
       210
       +
             after = [ "network.target" "network-online.target" "acme-fixperms.service" ] ++ selfsignedDeps;

     

       211
       211
       +
             wants = [ "network-online.target" "acme-fixperms.service" ] ++ selfsignedDeps;

     

       212
       212
       +
       

     

       213
       213
       +
             # https://github.com/NixOS/nixpkgs/pull/81371#issuecomment-605526099

     

       214
       214
       +
             wantedBy = optionals (!config.boot.isContainer) [ "multi-user.target" ];

     

       215
       215
       +
       

     

       216
       216
       +
             path = with pkgs; [ lego coreutils diffutils ];

     

       217
       217
       +
       

     

       218
       218
       +
             serviceConfig = commonServiceConfig // {

     

       219
       219
       +
               Group = data.group;

     

       220
       220
       +
       

     

       221
       221
       +
               # AccountDir dir will be created by tmpfiles to ensure correct permissions

     

       222
       222
       +
               # And to avoid deletion during systemctl clean

     

       223
       223
       +
               # acme/.lego/${cert} is listed so that it is deleted during systemctl clean

     

       224
       224
       +
               StateDirectory = "acme/${cert} acme/.lego/${cert} acme/.lego/${cert}/${certDir}";

     

       225
       225
       +
       

     

       226
       226
       +
               # Needs to be space separated, but can't use a multiline string because that'll include newlines

     

       227
       227
       +
               BindPaths =

     

       228
       228
       +
                 "${accountDir}:/tmp/accounts " +

     

       229
       229
       +
                 "/var/lib/acme/${cert}:/tmp/out " +

     

       230
       230
       +
                 "/var/lib/acme/.lego/${cert}/${certDir}:/tmp/certificates ";

     

       231
       231
       +
       

     

       232
       232
       +
               # Only try loading the credentialsFile if the dns challenge is enabled

     

       233
       233
       +
               EnvironmentFile = mkIf useDns data.credentialsFile;

     

       234
       234
       +
       

     

       235
       235
       +
               # Run as root (Prefixed with +)

     

       236
       236
       +
               ExecStartPost = "+" + (pkgs.writeShellScript "acme-postrun" ''

     

       237
       237
       +
                 cd /var/lib/acme/${escapeShellArg cert}

     

       238
       238
       +
                 if [ -e renewed ]; then

     

       239
       239
       +
                   rm renewed

     

       240
       240
       +
                   ${data.postRun}

     

       241
       241
       +
                 fi

     

       242
       242
       +
               '');

     

       243
       243
       +
             };

     

       244
       244
       +
       

     

       245
       245
       +
             # Working directory will be /tmp

     

       246
       246
       +
             script = ''

     

       247
       247
       +
               set -euo pipefail

     

       248
       248
       +
       

     

       249
       249
       +
               echo '${domainHash}' > domainhash.txt

     

       250
       250
       +
       

     

       251
       251
       +
               # Check if we can renew

     

       252
       252
       +
               if [ -e 'certificates/${keyName}.key' -a -e 'certificates/${keyName}.crt' ]; then

     

       253
       253
       +
       

     

       254
       254
       +
                 # When domains are updated, there's no need to do a full

     

       255
       255
       +
                 # Lego run, but it's likely renew won't work if days is too low.

     

       256
       256
       +
                 if [ -e certificates/domainhash.txt ] && cmp -s domainhash.txt certificates/domainhash.txt; then

     

       257
       257
       +
                   lego ${renewOpts} --days ${toString cfg.validMinDays}

     

       258
       258
       +
                 else

     

       259
       259
       +
                   # Any number > 90 works, but this one is over 9000 ;-)

     

       260
       260
       +
                   lego ${renewOpts} --days 9001

     

       261
       261
       +
                 fi

     

       262
       262
       +
       

     

       263
       263
       +
               # Otherwise do a full run

     

       264
       264
       +
               else

     

       265
       265
       +
                 lego ${runOpts}

     

       266
       266
       +
               fi

     

       267
       267
       +
       

     

       268
       268
       +
               mv domainhash.txt certificates/

     

       269
       269
       +
               chmod 640 certificates/*

     

       270
       270
       +
               chmod -R 700 accounts/*

     

       271
       271
       +
       

     

       272
       272
       +
               # Group might change between runs, re-apply it

     

       273
       273
       +
               chown 'acme:${data.group}' certificates/*

     

       274
       274
       +
       

     

       275
       275
       +
               # Copy all certs to the "real" certs directory

     

       276
       276
       +
               CERT='certificates/${keyName}.crt'

     

       277
       277
       +
               if [ -e "$CERT" ] && ! cmp -s "$CERT" out/fullchain.pem; then

     

       278
       278
       +
                 touch out/renewed

     

       279
       279
       +
                 echo Installing new certificate

     

       280
       280
       +
                 cp -vp 'certificates/${keyName}.crt' out/fullchain.pem

     

       281
       281
       +
                 cp -vp 'certificates/${keyName}.key' out/key.pem

     

       282
       282
       +
                 cp -vp 'certificates/${keyName}.issuer.crt' out/chain.pem

     

       283
       283
       +
                 ln -sf fullchain.pem out/cert.pem

     

       284
       284
       +
                 cat out/key.pem out/fullchain.pem > out/full.pem

     

       285
       285
       +
               fi

     

       286
       286
       +
             '';

     

       287
       287
       +
           };

     

       288
       288
       +
         };

     

       289
       289
       +
       

     

       290
       290
       +
         certConfigs = mapAttrs certToConfig cfg.certs;

     

       6
       291
        
       

     

       7
       292
        
         certOpts = { name, ... }: {

     

       8
       293
        
           options = {

     

       294
       294
       +
             # user option has been removed

     

       295
       295
       +
             user = mkOption {

     

       296
       296
       +
               visible = false;

     

       297
       297
       +
               default = "_mkRemovedOptionModule";

     

       298
       298
       +
             };

     

       299
       299
       +
       

     

       300
       300
       +
             # allowKeysForGroup option has been removed

     

       301
       301
       +
             allowKeysForGroup = mkOption {

     

       302
       302
       +
               visible = false;

     

       303
       303
       +
               default = "_mkRemovedOptionModule";

     

       304
       304
       +
             };

     

       305
       305
       +
       

     

       306
       306
       +
             # extraDomains was replaced with extraDomainNames

     

       307
       307
       +
             extraDomains = mkOption {

     

       308
       308
       +
               visible = false;

     

       309
       309
       +
               default = "_mkMergedOptionModule";

     

       310
       310
       +
             };

     

       311
       311
       +
       

     

       9
       312
        
             webroot = mkOption {

     

       10
       313
        
               type = types.nullOr types.str;

     

       11
       314
        
               default = null;

     
···

       41
       344
        
               description = "Contact email address for the CA to be able to reach you.";

     

       42
       345
        
             };

     

       43
       346
        
       

     

       44
       44
       -
             user = mkOption {

     

       45
       45
       -
               type = types.str;

     

       46
       46
       -
               default = "root";

     

       47
       47
       -
               description = "User running the ACME client.";

     

       48
       48
       -
             };

     

       49
       49
       -
       

     

       50
       347
        
             group = mkOption {

     

       51
       348
        
               type = types.str;

     

       52
       52
       -
               default = "root";

     

       349
       349
       +
               default = "acme";

     

       53
       350
        
               description = "Group running the ACME client.";

     

       54
       351
        
             };

     

       55
       352
        
       

     

       56
       56
       -
             allowKeysForGroup = mkOption {

     

       57
       57
       -
               type = types.bool;

     

       58
       58
       -
               default = false;

     

       59
       59
       -
               description = ''

     

       60
       60
       -
                 Give read permissions to the specified group

     

       61
       61
       -
                 (<option>security.acme.cert.&lt;name&gt;.group</option>) to read SSL private certificates.

     

       62
       62
       -
               '';

     

       63
       63
       -
             };

     

       64
       64
       -
       

     

       65
       353
        
             postRun = mkOption {

     

       66
       354
        
               type = types.lines;

     

       67
       355
        
               default = "";

     

       68
       68
       -
               example = "systemctl reload nginx.service";

     

       356
       356
       +
               example = "cp full.pem backup.pem";

     

       69
       357
        
               description = ''

     

       70
       70
       -
                 Commands to run after new certificates go live. Typically

     

       71
       71
       -
                 the web server and other servers using certificates need to

     

       72
       72
       -
                 be reloaded.

     

       358
       358
       +
                 Commands to run after new certificates go live. Note that

     

       359
       359
       +
                 these commands run as the root user.

     

       73
       360
        
       

     

       74
       361
        
                 Executed in the same directory with the new certificate.

     

       75
       362
        
               '';

     
···

       82
       369
        
               description = "Directory where certificate and other state is stored.";

     

       83
       370
        
             };

     

       84
       371
        
       

     

       85
       85
       -
             extraDomains = mkOption {

     

       86
       86
       -
               type = types.attrsOf (types.nullOr types.str);

     

       87
       87
       -
               default = {};

     

       372
       372
       +
             extraDomainNames = mkOption {

     

       373
       373
       +
               type = types.listOf types.str;

     

       374
       374
       +
               default = [];

     

       88
       375
        
               example = literalExample ''

     

       89
       89
       -
                 {

     

       90
       90
       -
                   "example.org" = null;

     

       91
       91
       -
                   "mydomain.org" = null;

     

       92
       92
       -
                 }

     

       376
       376
       +
                 [

     

       377
       377
       +
                   "example.org"

     

       378
       378
       +
                   "mydomain.org"

     

       379
       379
       +
                 ]

     

       93
       380
        
               '';

     

       94
       381
        
               description = ''

     

       95
       382
        
                 A list of extra domain names, which are included in the one certificate to be issued.

     

       96
       96
       -
                 Setting a distinct server root is deprecated and not functional in 20.03+

     

       97
       383
        
               '';

     

       98
       384
        
             };

     

       99
       385
        
       

     
···

       176
       462
        
           };

     

       177
       463
        
         };

     

       178
       464
        
       

     

       179
       179
       -
       in

     

       180
       180
       -
       

     

       181
       181
       -
       {

     

       465
       465
       +
       in {

     

       182
       466
        
       

     

       183
       183
       -
         ###### interface

     

       184
       184
       -
         imports = [

     

       185
       185
       -
           (mkRemovedOptionModule [ "security" "acme" "production" ] ''

     

       186
       186
       -
             Use security.acme.server to define your staging ACME server URL instead.

     

       187
       187
       -
       

     

       188
       188
       -
             To use Let's Encrypt's staging server, use security.acme.server =

     

       189
       189
       -
             "https://acme-staging-v02.api.letsencrypt.org/directory".

     

       190
       190
       -
           ''

     

       191
       191
       -
           )

     

       192
       192
       -
           (mkRemovedOptionModule [ "security" "acme" "directory"] "ACME Directory is now hardcoded to /var/lib/acme and its permisisons are managed by systemd. See https://github.com/NixOS/nixpkgs/issues/53852 for more info.")

     

       193
       193
       -
           (mkRemovedOptionModule [ "security" "acme" "preDelay"] "This option has been removed. If you want to make sure that something executes before certificates are provisioned, add a RequiredBy=acme-\${cert}.service to the service you want to execute before the cert renewal")

     

       194
       194
       -
           (mkRemovedOptionModule [ "security" "acme" "activationDelay"] "This option has been removed. If you want to make sure that something executes before certificates are provisioned, add a RequiredBy=acme-\${cert}.service to the service you want to execute before the cert renewal")

     

       195
       195
       -
           (mkChangedOptionModule [ "security" "acme" "validMin"] [ "security" "acme" "validMinDays"] (config: config.security.acme.validMin / (24 * 3600)))

     

       196
       196
       -
         ];

     

       197
       467
        
         options = {

     

       198
       468
        
           security.acme = {

     

       199
       469
        
       

     
···

       266
       536
        
                   "example.com" = {

     

       267
       537
        
                     webroot = "/var/www/challenges/";

     

       268
       538
        
                     email = "foo@example.com";

     

       269
       269
       -
                     extraDomains = { "www.example.com" = null; "foo.example.com" = null; };

     

       539
       539
       +
                     extraDomainNames = [ "www.example.com" "foo.example.com" ];

     

       270
       540
        
                   };

     

       271
       541
        
                   "bar.example.com" = {

     

       272
       542
        
                     webroot = "/var/www/challenges/";

     
···

       278
       548
        
           };

     

       279
       549
        
         };

     

       280
       550
        
       

     

       281
       281
       -
         ###### implementation

     

       551
       551
       +
         imports = [

     

       552
       552
       +
           (mkRemovedOptionModule [ "security" "acme" "production" ] ''

     

       553
       553
       +
             Use security.acme.server to define your staging ACME server URL instead.

     

       554
       554
       +
       

     

       555
       555
       +
             To use the let's encrypt staging server, use security.acme.server =

     

       556
       556
       +
             "https://acme-staging-v02.api.letsencrypt.org/directory".

     

       557
       557
       +
           ''

     

       558
       558
       +
           )

     

       559
       559
       +
           (mkRemovedOptionModule [ "security" "acme" "directory" ] "ACME Directory is now hardcoded to /var/lib/acme and its permisisons are managed by systemd. See https://github.com/NixOS/nixpkgs/issues/53852 for more info.")

     

       560
       560
       +
           (mkRemovedOptionModule [ "security" "acme" "preDelay" ] "This option has been removed. If you want to make sure that something executes before certificates are provisioned, add a RequiredBy=acme-\${cert}.service to the service you want to execute before the cert renewal")

     

       561
       561
       +
           (mkRemovedOptionModule [ "security" "acme" "activationDelay" ] "This option has been removed. If you want to make sure that something executes before certificates are provisioned, add a RequiredBy=acme-\${cert}.service to the service you want to execute before the cert renewal")

     

       562
       562
       +
           (mkChangedOptionModule [ "security" "acme" "validMin" ] [ "security" "acme" "validMinDays" ] (config: config.security.acme.validMin / (24 * 3600)))

     

       563
       563
       +
         ];

     

       564
       564
       +
       

     

       282
       565
        
         config = mkMerge [

     

       283
       566
        
           (mkIf (cfg.certs != { }) {

     

       284
       567
        
       

     

       568
       568
       +
             # FIXME Most of these custom warnings and filters for security.acme.certs.* are required

     

       569
       569
       +
             # because using mkRemovedOptionModule/mkChangedOptionModule with attrsets isn't possible.

     

       570
       570
       +
             warnings = filter (w: w != "") (mapAttrsToList (cert: data: if data.extraDomains != "_mkMergedOptionModule" then ''

     

       571
       571
       +
               The option definition `security.acme.certs.${cert}.extraDomains` has changed

     

       572
       572
       +
               to `security.acme.certs.${cert}.extraDomainNames` and is now a list of strings.

     

       573
       573
       +
               Setting a custom webroot for extra domains is not possible, instead use separate certs.

     

       574
       574
       +
             '' else "") cfg.certs);

     

       575
       575
       +
       

     

       285
       576
        
             assertions = let

     

       286
       286
       -
               certs = (mapAttrsToList (k: v: v) cfg.certs);

     

       577
       577
       +
               certs = attrValues cfg.certs;

     

       287
       578
        
             in [

     

       288
       579
        
               {

     

       289
       289
       -
                 assertion = all (certOpts: certOpts.dnsProvider == null || certOpts.webroot == null) certs;

     

       290
       290
       -
                 message = ''

     

       291
       291
       -
                   Options `security.acme.certs.<name>.dnsProvider` and

     

       292
       292
       -
                   `security.acme.certs.<name>.webroot` are mutually exclusive.

     

       293
       293
       -
                 '';

     

       294
       294
       -
               }

     

       295
       295
       -
               {

     

       296
       580
        
                 assertion = cfg.email != null || all (certOpts: certOpts.email != null) certs;

     

       297
       581
        
                 message = ''

     

       298
       582
        
                   You must define `security.acme.certs.<name>.email` or

     

       299
       299
       -
                   `security.acme.email` to register with the CA.

     

       583
       583
       +
                   `security.acme.email` to register with the CA. Note that using

     

       584
       584
       +
                   many different addresses for certs may trigger account rate limits.

     

       300
       585
        
                 '';

     

       301
       586
        
               }

     

       302
       587
        
               {

     
···

       307
       592
        
                   to `true`. For Let's Encrypt's ToS see https://letsencrypt.org/repository/

     

       308
       593
        
                 '';

     

       309
       594
        
               }

     

       310
       310
       -
             ];

     

       311
       311
       -
       

     

       312
       312
       -
             systemd.services = let

     

       313
       313
       -
                 services = concatLists servicesLists;

     

       314
       314
       -
                 servicesLists = mapAttrsToList certToServices cfg.certs;

     

       315
       315
       -
                 certToServices = cert: data:

     

       316
       316
       -
                     let

     

       317
       317
       -
                       # StateDirectory must be relative, and will be created under /var/lib by systemd

     

       318
       318
       -
                       lpath = "acme/${cert}";

     

       319
       319
       -
                       apath = "/var/lib/${lpath}";

     

       320
       320
       -
                       spath = "/var/lib/acme/.lego/${cert}";

     

       321
       321
       -
                       keyName = builtins.replaceStrings ["*"] ["_"] data.domain;

     

       322
       322
       -
                       requestedDomains = pipe ([ data.domain ] ++ (attrNames data.extraDomains)) [

     

       323
       323
       -
                         (domains: sort builtins.lessThan domains)

     

       324
       324
       -
                         (domains: concatStringsSep "," domains)

     

       325
       325
       -
                       ];

     

       326
       326
       -
                       fileMode = if data.allowKeysForGroup then "640" else "600";

     

       327
       327
       -
                       globalOpts = [ "-d" data.domain "--email" data.email "--path" "." "--key-type" data.keyType ]

     

       328
       328
       -
                                 ++ optionals (cfg.acceptTerms) [ "--accept-tos" ]

     

       329
       329
       -
                                 ++ optionals (data.dnsProvider != null && !data.dnsPropagationCheck) [ "--dns.disable-cp" ]

     

       330
       330
       -
                                 ++ concatLists (mapAttrsToList (name: root: [ "-d" name ]) data.extraDomains)

     

       331
       331
       -
                                 ++ (if data.dnsProvider != null then [ "--dns" data.dnsProvider ] else [ "--http" "--http.webroot" data.webroot ])

     

       332
       332
       -
                                 ++ optionals (cfg.server != null || data.server != null) ["--server" (if data.server == null then cfg.server else data.server)]

     

       333
       333
       -
                                 ++ data.extraLegoFlags;

     

       334
       334
       -
                       certOpts = optionals data.ocspMustStaple [ "--must-staple" ];

     

       335
       335
       -
                       runOpts = escapeShellArgs (globalOpts ++ [ "run" ] ++ certOpts ++ data.extraLegoRunFlags);

     

       336
       336
       -
                       renewOpts = escapeShellArgs (globalOpts ++

     

       337
       337
       -
                         [ "renew" "--days" (toString cfg.validMinDays) ] ++

     

       338
       338
       -
                         certOpts ++ data.extraLegoRenewFlags);

     

       339
       339
       -
                       acmeService = {

     

       340
       340
       -
                         description = "Renew ACME Certificate for ${cert}";

     

       341
       341
       -
                         path = with pkgs; [ openssl ];

     

       342
       342
       -
                         after = [ "network.target" "network-online.target" ];

     

       343
       343
       -
                         wants = [ "network-online.target" ];

     

       344
       344
       -
                         wantedBy = mkIf (!config.boot.isContainer) [ "multi-user.target" ];

     

       345
       345
       -
                         serviceConfig = {

     

       346
       346
       -
                           Type = "oneshot";

     

       347
       347
       -
                           User = data.user;

     

       348
       348
       -
                           Group = data.group;

     

       349
       349
       -
                           PrivateTmp = true;

     

       350
       350
       -
                           StateDirectory = "acme/.lego/${cert} acme/.lego/accounts ${lpath}";

     

       351
       351
       -
                           StateDirectoryMode = if data.allowKeysForGroup then "750" else "700";

     

       352
       352
       -
                           WorkingDirectory = spath;

     

       353
       353
       -
                           # Only try loading the credentialsFile if the dns challenge is enabled

     

       354
       354
       -
                           EnvironmentFile = if data.dnsProvider != null then data.credentialsFile else null;

     

       355
       355
       -
                           ExecStart = pkgs.writeScript "acme-start" ''

     

       356
       356
       -
                             #!${pkgs.runtimeShell} -e

     

       357
       357
       -
                             test -L ${spath}/accounts -o -d ${spath}/accounts || ln -s ../accounts ${spath}/accounts

     

       358
       358
       -
                             LEGO_ARGS=(${runOpts})

     

       359
       359
       -
                             if [ -e ${spath}/certificates/${keyName}.crt ]; then

     

       360
       360
       -
                               REQUESTED_DOMAINS="${requestedDomains}"

     

       361
       361
       -
                               EXISTING_DOMAINS="$(openssl x509 -in ${spath}/certificates/${keyName}.crt -noout -ext subjectAltName | tail -n1 | sed -e 's/ *DNS://g')"

     

       362
       362
       -
                               if [ "''${REQUESTED_DOMAINS}" == "''${EXISTING_DOMAINS}" ]; then

     

       363
       363
       -
                                 LEGO_ARGS=(${renewOpts})

     

       364
       364
       -
                               fi

     

       365
       365
       -
                             fi

     

       366
       366
       -
                             ${pkgs.lego}/bin/lego ''${LEGO_ARGS[@]}

     

       367
       367
       -
                           '';

     

       368
       368
       -
                           ExecStartPost =

     

       369
       369
       -
                             let

     

       370
       370
       -
                               script = pkgs.writeScript "acme-post-start" ''

     

       371
       371
       -
                                 #!${pkgs.runtimeShell} -e

     

       372
       372
       -
                                 cd ${apath}

     

       373
       373
       -
       

     

       374
       374
       -
                                 # Test that existing cert is older than new cert

     

       375
       375
       -
                                 KEY=${spath}/certificates/${keyName}.key

     

       376
       376
       -
                                 KEY_CHANGED=no

     

       377
       377
       -
                                 if [ -e $KEY -a $KEY -nt key.pem ]; then

     

       378
       378
       -
                                   KEY_CHANGED=yes

     

       379
       379
       -
                                   cp -p ${spath}/certificates/${keyName}.key key.pem

     

       380
       380
       -
                                   cp -p ${spath}/certificates/${keyName}.crt fullchain.pem

     

       381
       381
       -
                                   cp -p ${spath}/certificates/${keyName}.issuer.crt chain.pem

     

       382
       382
       -
                                   ln -sf fullchain.pem cert.pem

     

       383
       383
       -
                                   cat key.pem fullchain.pem > full.pem

     

       384
       384
       -
                                 fi

     

       385
       385
       -
       

     

       386
       386
       -
                                 chmod ${fileMode} *.pem

     

       387
       387
       -
                                 chown '${data.user}:${data.group}' *.pem

     

       595
       595
       +
             ] ++ (builtins.concatLists (mapAttrsToList (cert: data: [

     

       596
       596
       +
               {

     

       597
       597
       +
                 assertion = data.user == "_mkRemovedOptionModule";

     

       598
       598
       +
                 message = ''

     

       599
       599
       +
                   The option definition `security.acme.certs.${cert}.user' no longer has any effect; Please remove it.

     

       600
       600
       +
                   Certificate user is now hard coded to the "acme" user. If you would

     

       601
       601
       +
                   like another user to have access, consider adding them to the

     

       602
       602
       +
                   "acme" group or changing security.acme.certs.${cert}.group.

     

       603
       603
       +
                 '';

     

       604
       604
       +
               }

     

       605
       605
       +
               {

     

       606
       606
       +
                 assertion = data.allowKeysForGroup == "_mkRemovedOptionModule";

     

       607
       607
       +
                 message = ''

     

       608
       608
       +
                   The option definition `security.acme.certs.${cert}.allowKeysForGroup' no longer has any effect; Please remove it.

     

       609
       609
       +
                   All certs are readable by the configured group. If this is undesired,

     

       610
       610
       +
                   consider changing security.acme.certs.${cert}.group to an unused group.

     

       611
       611
       +
                 '';

     

       612
       612
       +
               }

     

       613
       613
       +
               # * in the cert value breaks building of systemd services, and makes

     

       614
       614
       +
               # referencing them as a user quite weird too. Best practice is to use

     

       615
       615
       +
               # the domain option.

     

       616
       616
       +
               {

     

       617
       617
       +
                 assertion = ! hasInfix "*" cert;

     

       618
       618
       +
                 message = ''

     

       619
       619
       +
                   The cert option path `security.acme.certs.${cert}.dnsProvider`

     

       620
       620
       +
                   cannot contain a * character.

     

       621
       621
       +
                   Instead, set `security.acme.certs.${cert}.domain = "${cert}";`

     

       622
       622
       +
                   and remove the wildcard from the path.

     

       623
       623
       +
                 '';

     

       624
       624
       +
               }

     

       625
       625
       +
               {

     

       626
       626
       +
                 assertion = data.dnsProvider == null || data.webroot == null;

     

       627
       627
       +
                 message = ''

     

       628
       628
       +
                   Options `security.acme.certs.${cert}.dnsProvider` and

     

       629
       629
       +
                   `security.acme.certs.${cert}.webroot` are mutually exclusive.

     

       630
       630
       +
                 '';

     

       631
       631
       +
               }

     

       632
       632
       +
             ]) cfg.certs));

     

       388
       633
        
       

     

       389
       389
       -
                                 if [ "$KEY_CHANGED" = "yes" ]; then

     

       390
       390
       -
                                   : # noop in case postRun is empty

     

       391
       391
       -
                                   ${data.postRun}

     

       392
       392
       -
                                 fi

     

       393
       393
       -
                               '';

     

       394
       394
       -
                             in

     

       395
       395
       -
                               "+${script}";

     

       396
       396
       -
                         };

     

       634
       634
       +
             users.users.acme = {

     

       635
       635
       +
               home = "/var/lib/acme";

     

       636
       636
       +
               group = "acme";

     

       637
       637
       +
               isSystemUser = true;

     

       638
       638
       +
             };

     

       397
       639
        
       

     

       398
       398
       -
                       };

     

       399
       399
       -
                       selfsignedService = {

     

       400
       400
       -
                         description = "Create preliminary self-signed certificate for ${cert}";

     

       401
       401
       -
                         path = [ pkgs.openssl ];

     

       402
       402
       -
                         script =

     

       403
       403
       -
                           ''

     

       404
       404
       -
                             workdir="$(mktemp -d)"

     

       640
       640
       +
             users.groups.acme = {};

     

       405
       641
        
       

     

       406
       406
       -
                             # Create CA

     

       407
       407
       -
                             openssl genrsa -des3 -passout pass:xxxx -out $workdir/ca.pass.key 2048

     

       408
       408
       -
                             openssl rsa -passin pass:xxxx -in $workdir/ca.pass.key -out $workdir/ca.key

     

       409
       409
       -
                             openssl req -new -key $workdir/ca.key -out $workdir/ca.csr \

     

       410
       410
       -
                               -subj "/C=UK/ST=Warwickshire/L=Leamington/O=OrgName/OU=Security Department/CN=example.com"

     

       411
       411
       -
                             openssl x509 -req -days 1 -in $workdir/ca.csr -signkey $workdir/ca.key -out $workdir/ca.crt

     

       642
       642
       +
             systemd.services = {

     

       643
       643
       +
               "acme-fixperms" = userMigrationService;

     

       644
       644
       +
             } // (mapAttrs' (cert: conf: nameValuePair "acme-${cert}" conf.renewService) certConfigs)

     

       645
       645
       +
               // (optionalAttrs (cfg.preliminarySelfsigned) ({

     

       646
       646
       +
               "acme-selfsigned-ca" = selfsignCAService;

     

       647
       647
       +
             } // (mapAttrs' (cert: conf: nameValuePair "acme-selfsigned-${cert}" conf.selfsignService) certConfigs)));

     

       412
       648
        
       

     

       413
       413
       -
                             # Create key

     

       414
       414
       -
                             openssl genrsa -des3 -passout pass:xxxx -out $workdir/server.pass.key 2048

     

       415
       415
       -
                             openssl rsa -passin pass:xxxx -in $workdir/server.pass.key -out $workdir/server.key

     

       416
       416
       -
                             openssl req -new -key $workdir/server.key -out $workdir/server.csr \

     

       417
       417
       -
                               -subj "/C=UK/ST=Warwickshire/L=Leamington/O=OrgName/OU=IT Department/CN=example.com"

     

       418
       418
       -
                             openssl x509 -req -days 1 -in $workdir/server.csr -CA $workdir/ca.crt \

     

       419
       419
       -
                               -CAkey $workdir/ca.key -CAserial $workdir/ca.srl -CAcreateserial \

     

       420
       420
       -
                               -out $workdir/server.crt

     

       649
       649
       +
             systemd.timers = mapAttrs' (cert: conf: nameValuePair "acme-${cert}" conf.renewTimer) certConfigs;

     

       421
       650
        
       

     

       422
       422
       -
                             # Copy key to destination

     

       423
       423
       -
                             cp $workdir/server.key ${apath}/key.pem

     

       424
       424
       -
       

     

       425
       425
       -
                             # Create fullchain.pem (same format as "simp_le ... -f fullchain.pem" creates)

     

       426
       426
       -
                             cat $workdir/{server.crt,ca.crt} > "${apath}/fullchain.pem"

     

       427
       427
       -
       

     

       428
       428
       -
                             # Create full.pem for e.g. lighttpd

     

       429
       429
       -
                             cat $workdir/{server.key,server.crt,ca.crt} > "${apath}/full.pem"

     

       651
       651
       +
             # .lego and .lego/accounts specified to fix any incorrect permissions

     

       652
       652
       +
             systemd.tmpfiles.rules = [

     

       653
       653
       +
               "d /var/lib/acme/.lego - acme acme"

     

       654
       654
       +
               "d /var/lib/acme/.lego/accounts - acme acme"

     

       655
       655
       +
             ] ++ (unique (concatMap (conf: [

     

       656
       656
       +
                 "d ${conf.accountDir} - acme acme"

     

       657
       657
       +
               ] ++ (optional (conf.webroot != null) "d ${conf.webroot}/.well-known/acme-challenge - acme ${conf.group}")

     

       658
       658
       +
             ) (attrValues certConfigs)));

     

       430
       659
        
       

     

       431
       431
       -
                             # Give key acme permissions

     

       432
       432
       -
                             chown '${data.user}:${data.group}' "${apath}/"{key,fullchain,full}.pem

     

       433
       433
       -
                             chmod ${fileMode} "${apath}/"{key,fullchain,full}.pem

     

       434
       434
       -
                           '';

     

       435
       435
       -
                         serviceConfig = {

     

       436
       436
       -
                           Type = "oneshot";

     

       437
       437
       -
                           PrivateTmp = true;

     

       438
       438
       -
                           StateDirectory = lpath;

     

       439
       439
       -
                           User = data.user;

     

       440
       440
       -
                           Group = data.group;

     

       441
       441
       -
                         };

     

       442
       442
       -
                         unitConfig = {

     

       443
       443
       -
                           # Do not create self-signed key when key already exists

     

       444
       444
       -
                           ConditionPathExists = "!${apath}/key.pem";

     

       445
       445
       -
                         };

     

       446
       446
       -
                       };

     

       447
       447
       -
                     in (

     

       448
       448
       -
                       [ { name = "acme-${cert}"; value = acmeService; } ]

     

       449
       449
       -
                       ++ optional cfg.preliminarySelfsigned { name = "acme-selfsigned-${cert}"; value = selfsignedService; }

     

       450
       450
       -
                     );

     

       451
       451
       -
                 servicesAttr = listToAttrs services;

     

       452
       452
       -
               in

     

       453
       453
       -
                 servicesAttr;

     

       454
       454
       -
       

     

       455
       455
       -
             systemd.tmpfiles.rules =

     

       456
       456
       -
               map (data: "d ${data.webroot}/.well-known/acme-challenge - ${data.user} ${data.group}") (filter (data: data.webroot != null) (attrValues cfg.certs));

     

       457
       457
       -
       

     

       458
       458
       -
             systemd.timers = let

     

       459
       459
       -
               # Allow systemd to pick a convenient time within the day

     

       460
       460
       -
               # to run the check.

     

       461
       461
       -
               # This allows the coalescing of multiple timer jobs.

     

       462
       462
       -
               # We divide by the number of certificates so that if you

     

       463
       463
       -
               # have many certificates, the renewals are distributed over

     

       464
       464
       -
               # the course of the day to avoid rate limits.

     

       465
       465
       -
               numCerts = length (attrNames cfg.certs);

     

       466
       466
       -
               _24hSecs = 60 * 60 * 24;

     

       467
       467
       -
               AccuracySec = "${toString (_24hSecs / numCerts)}s";

     

       468
       468
       -
             in flip mapAttrs' cfg.certs (cert: data: nameValuePair

     

       469
       469
       -
               ("acme-${cert}")

     

       470
       470
       -
               ({

     

       471
       471
       -
                 description = "Renew ACME Certificate for ${cert}";

     

       472
       472
       -
                 wantedBy = [ "timers.target" ];

     

       473
       473
       -
                 timerConfig = {

     

       474
       474
       -
                   OnCalendar = cfg.renewInterval;

     

       475
       475
       -
                   Unit = "acme-${cert}.service";

     

       476
       476
       -
                   Persistent = "yes";

     

       477
       477
       -
                   inherit AccuracySec;

     

       478
       478
       -
                   # Skew randomly within the day, per https://letsencrypt.org/docs/integration-guide/.

     

       479
       479
       -
                   RandomizedDelaySec = "24h";

     

       480
       480
       -
                 };

     

       481
       481
       -
               })

     

       482
       482
       -
             );

     

       483
       483
       -
       

     

       484
       484
       -
             systemd.targets.acme-selfsigned-certificates = mkIf cfg.preliminarySelfsigned {};

     

       485
       485
       -
             systemd.targets.acme-certificates = {};

     

       660
       660
       +
             # Create some targets which can be depended on to be "active" after cert renewals

     

       661
       661
       +
             systemd.targets = mapAttrs' (cert: conf: nameValuePair "acme-finished-${cert}" {

     

       662
       662
       +
               wantedBy = [ "default.target" ];

     

       663
       663
       +
               requires = [ "acme-${cert}.service" ] ++ conf.selfsignedDeps;

     

       664
       664
       +
               after = [ "acme-${cert}.service" ] ++ conf.selfsignedDeps;

     

       665
       665
       +
             }) certConfigs;

     

       486
       666
        
           })

     

       487
       487
       -
       

     

       488
       667
        
         ];

     

       489
       668
        
       

     

       490
       669
        
         meta = {

+16 -4

nixos/modules/security/acme.xml

···

       72
       72
        
           "foo.example.com" = {

     

       73
       73
        
             <link linkend="opt-services.nginx.virtualHosts._name_.forceSSL">forceSSL</link> = true;

     

       74
       74
        
             <link linkend="opt-services.nginx.virtualHosts._name_.enableACME">enableACME</link> = true;

     

       75
       75
       -
             # All serverAliases will be added as <link linkend="opt-security.acme.certs._name_.extraDomains">extra domains</link> on the certificate.

     

       75
       75
       +
             # All serverAliases will be added as <link linkend="opt-security.acme.certs._name_.extraDomainNames">extra domain names</link> on the certificate.

     

       76
       76
        
             <link linkend="opt-services.nginx.virtualHosts._name_.serverAliases">serverAliases</link> = [ "bar.example.com" ];

     

       77
       77
        
             locations."/" = {

     

       78
       78
        
               <link linkend="opt-services.nginx.virtualHosts._name_.locations._name_.root">root</link> = "/var/www";

     
···

       80
       80
        
           };

     

       81
       81
        
       

     

       82
       82
        
           # We can also add a different vhost and reuse the same certificate

     

       83
       83
       -
           # but we have to append extraDomains manually.

     

       84
       84
       -
           <link linkend="opt-security.acme.certs._name_.extraDomains">security.acme.certs."foo.example.com".extraDomains."baz.example.com"</link> = null;

     

       83
       83
       +
           # but we have to append extraDomainNames manually.

     

       84
       84
       +
           <link linkend="opt-security.acme.certs._name_.extraDomainNames">security.acme.certs."foo.example.com".extraDomainNames</link> = [ "baz.example.com" ];

     

       85
       85
        
           "baz.example.com" = {

     

       86
       86
        
             <link linkend="opt-services.nginx.virtualHosts._name_.forceSSL">forceSSL</link> = true;

     

       87
       87
        
             <link linkend="opt-services.nginx.virtualHosts._name_.useACMEHost">useACMEHost</link> = "foo.example.com";

     
···

       165
       165
        
         # Since we have a wildcard vhost to handle port 80,

     

       166
       166
        
         # we can generate certs for anything!

     

       167
       167
        
         # Just make sure your DNS resolves them.

     

       168
       168
       -
         <link linkend="opt-security.acme.certs._name_.extraDomains">extraDomains</link> = [ "mail.example.com" ];

     

       168
       168
       +
         <link linkend="opt-security.acme.certs._name_.extraDomainNames">extraDomainNames</link> = [ "mail.example.com" ];

     

       169
       169
        
       };

     

       170
       170
        
       </programlisting>

     

       171
       171
        
       

     
···

       249
       249
        
          Now you're all set to generate certs! You should monitor the first invokation

     

       250
       250
        
          by running <literal>systemctl start acme-example.com.service &amp;

     

       251
       251
        
          journalctl -fu acme-example.com.service</literal> and watching its log output.

     

       252
       252
       +
         </para>

     

       253
       253
       +
        </section>

     

       254
       254
       +
        <section xml:id="module-security-acme-regenerate">

     

       255
       255
       +
         <title>Regenerating certificates</title>

     

       256
       256
       +
       

     

       257
       257
       +
         <para>

     

       258
       258
       +
          Should you need to regenerate a particular certificate in a hurry, such

     

       259
       259
       +
          as when a vulnerability is found in Let's Encrypt, there is now a convenient

     

       260
       260
       +
          mechanism for doing so. Running <literal>systemctl clean acme-example.com.service</literal>

     

       261
       261
       +
          will remove all certificate files for the given domain, allowing you to then

     

       262
       262
       +
          <literal>systemctl start acme-example.com.service</literal> to generate fresh

     

       263
       263
       +
          ones.

     

       252
       264
        
         </para>

     

       253
       265
        
        </section>

     

       254
       266
        
       </chapter>

+2 -3

nixos/modules/services/networking/prosody.xml

···

       65
       65
        
          you'll need a single TLS certificate covering your main endpoint,

     

       66
       66
        
          the MUC one as well as the HTTP Upload one. We can generate such a

     

       67
       67
        
          certificate by leveraging the ACME

     

       68
       68
       -
          <link linkend="opt-security.acme.certs._name_.extraDomains">extraDomains</link> module option.

     

       68
       68
       +
          <link linkend="opt-security.acme.certs._name_.extraDomainNames">extraDomainNames</link> module option.

     

       69
       69
        
        </para>

     

       70
       70
        
        <para>

     

       71
       71
        
          Provided the setup detailed in the previous section, you'll need the following acme configuration to generate

     
···

       78
       78
        
           "example.org" = {

     

       79
       79
        
             <link linkend="opt-security.acme.certs._name_.webroot">webroot</link> = "/var/www/example.org";

     

       80
       80
        
             <link linkend="opt-security.acme.certs._name_.email">email</link> = "root@example.org";

     

       81
       81
       -
             <link linkend="opt-security.acme.certs._name_.extraDomains">extraDomains."conference.example.org"</link> = null;

     

       82
       82
       -
             <link linkend="opt-security.acme.certs._name_.extraDomains">extraDomains."upload.example.org"</link> = null;

     

       81
       81
       +
             <link linkend="opt-security.acme.certs._name_.extraDomainNames">extraDomainNames</link> = [ "conference.example.org" "upload.example.org" ];

     

       83
       82
        
           };

     

       84
       83
        
         };

     

       85
       84
        
       };</programlisting>

+55 -22

nixos/modules/services/web-servers/apache-httpd/default.nix

···

       6
       6
        
       

     

       7
       7
        
         cfg = config.services.httpd;

     

       8
       8
        
       

     

       9
       9
       +
         certs = config.security.acme.certs;

     

       10
       10
       +
       

     

       9
       11
        
         runtimeDir = "/run/httpd";

     

       10
       12
        
       

     

       11
       13
        
         pkg = cfg.package.out;

     
···

       25
       27
        
         mod_perl = pkgs.apacheHttpdPackages.mod_perl.override { apacheHttpd = pkg; };

     

       26
       28
        
       

     

       27
       29
        
         vhosts = attrValues cfg.virtualHosts;

     

       30
       30
       +
       

     

       31
       31
       +
         # certName is used later on to determine systemd service names.

     

       32
       32
       +
         acmeEnabledVhosts = map (hostOpts: hostOpts // {

     

       33
       33
       +
           certName = if hostOpts.useACMEHost != null then hostOpts.useACMEHost else hostOpts.hostName;

     

       34
       34
       +
         }) (filter (hostOpts: hostOpts.enableACME || hostOpts.useACMEHost != null) vhosts);

     

       35
       35
       +
       

     

       36
       36
       +
         dependentCertNames = unique (map (hostOpts: hostOpts.certName) acmeEnabledVhosts);

     

       28
       37
        
       

     

       29
       38
        
         mkListenInfo = hostOpts:

     

       30
       39
        
           if hostOpts.listen != [] then hostOpts.listen

     
···

       125
       134
        
       

     

       126
       135
        
             useACME = hostOpts.enableACME || hostOpts.useACMEHost != null;

     

       127
       136
        
             sslCertDir =

     

       128
       128
       -
               if hostOpts.enableACME then config.security.acme.certs.${hostOpts.hostName}.directory

     

       129
       129
       -
               else if hostOpts.useACMEHost != null then config.security.acme.certs.${hostOpts.useACMEHost}.directory

     

       137
       137
       +
               if hostOpts.enableACME then certs.${hostOpts.hostName}.directory

     

       138
       138
       +
               else if hostOpts.useACMEHost != null then certs.${hostOpts.useACMEHost}.directory

     

       130
       139
        
               else abort "This case should never happen.";

     

       131
       140
        
       

     

       132
       132
       -
             sslServerCert = if useACME then "${sslCertDir}/full.pem" else hostOpts.sslServerCert;

     

       141
       141
       +
             sslServerCert = if useACME then "${sslCertDir}/fullchain.pem" else hostOpts.sslServerCert;

     

       133
       142
        
             sslServerKey = if useACME then "${sslCertDir}/key.pem" else hostOpts.sslServerKey;

     

       134
       134
       -
             sslServerChain = if useACME then "${sslCertDir}/fullchain.pem" else hostOpts.sslServerChain;

     

       143
       143
       +
             sslServerChain = if useACME then "${sslCertDir}/chain.pem" else hostOpts.sslServerChain;

     

       135
       144
        
       

     

       136
       145
        
             acmeChallenge = optionalString useACME ''

     

       137
       146
        
               Alias /.well-known/acme-challenge/ "${hostOpts.acmeRoot}/.well-known/acme-challenge/"

     
···

       347
       356
        
             cat ${php.phpIni} > $out

     

       348
       357
        
             echo "$options" >> $out

     

       349
       358
        
           '';

     

       350
       350
       -
       

     

       351
       359
        
       in

     

       352
       360
        
       

     

       353
       361
        
       

     
···

       647
       655
        
             wwwrun.gid = config.ids.gids.wwwrun;

     

       648
       656
        
           };

     

       649
       657
        
       

     

       650
       650
       -
           security.acme.certs = mapAttrs (name: hostOpts: {

     

       651
       651
       -
             user = cfg.user;

     

       652
       652
       -
             group = mkDefault cfg.group;

     

       653
       653
       -
             email = if hostOpts.adminAddr != null then hostOpts.adminAddr else cfg.adminAddr;

     

       654
       654
       -
             webroot = hostOpts.acmeRoot;

     

       655
       655
       -
             extraDomains = genAttrs hostOpts.serverAliases (alias: null);

     

       656
       656
       -
             postRun = "systemctl reload httpd.service";

     

       657
       657
       -
           }) (filterAttrs (name: hostOpts: hostOpts.enableACME) cfg.virtualHosts);

     

       658
       658
       +
           security.acme.certs = let

     

       659
       659
       +
             acmePairs = map (hostOpts: nameValuePair hostOpts.hostName {

     

       660
       660
       +
               group = mkDefault cfg.group;

     

       661
       661
       +
               webroot = hostOpts.acmeRoot;

     

       662
       662
       +
               extraDomainNames = hostOpts.serverAliases;

     

       663
       663
       +
               # Use the vhost-specific email address if provided, otherwise let

     

       664
       664
       +
               # security.acme.email or security.acme.certs.<cert>.email be used.

     

       665
       665
       +
               email = mkOverride 2000 (if hostOpts.adminAddr != null then hostOpts.adminAddr else cfg.adminAddr);

     

       666
       666
       +
             # Filter for enableACME-only vhosts. Don't want to create dud certs

     

       667
       667
       +
             }) (filter (hostOpts: hostOpts.useACMEHost == null) acmeEnabledVhosts);

     

       668
       668
       +
           in listToAttrs acmePairs;

     

       658
       669
        
       

     

       659
       670
        
           environment.systemPackages = [

     

       660
       671
        
             apachectl

     
···

       724
       735
        
                 "Z '${cfg.logDir}' - ${svc.User} ${svc.Group}"

     

       725
       736
        
               ];

     

       726
       737
        
       

     

       727
       727
       -
           systemd.services.httpd =

     

       728
       728
       -
             let

     

       729
       729
       -
               vhostsACME = filter (hostOpts: hostOpts.enableACME) vhosts;

     

       730
       730
       -
             in

     

       731
       731
       -
             { description = "Apache HTTPD";

     

       732
       732
       -
       

     

       738
       738
       +
           systemd.services.httpd = {

     

       739
       739
       +
               description = "Apache HTTPD";

     

       733
       740
        
               wantedBy = [ "multi-user.target" ];

     

       734
       734
       -
               wants = concatLists (map (hostOpts: [ "acme-${hostOpts.hostName}.service" "acme-selfsigned-${hostOpts.hostName}.service" ]) vhostsACME);

     

       735
       735
       -
               after = [ "network.target" "fs.target" ] ++ map (hostOpts: "acme-selfsigned-${hostOpts.hostName}.service") vhostsACME;

     

       736
       736
       -
               before = map (hostOpts: "acme-${hostOpts.hostName}.service") vhostsACME;

     

       741
       741
       +
               wants = concatLists (map (certName: [ "acme-finished-${certName}.target" ]) dependentCertNames);

     

       742
       742
       +
               after = [ "network.target" ] ++ map (certName: "acme-selfsigned-${certName}.service") dependentCertNames;

     

       743
       743
       +
               before = map (certName: "acme-${certName}.service") dependentCertNames;

     

       737
       744
        
       

     

       738
       745
        
               path = [ pkg pkgs.coreutils pkgs.gnugrep ];

     

       739
       746
        
       

     
···

       766
       773
        
                 AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];

     

       767
       774
        
               };

     

       768
       775
        
             };

     

       776
       776
       +
       

     

       777
       777
       +
           # postRun hooks on cert renew can't be used to restart Apache since renewal

     

       778
       778
       +
           # runs as the unprivileged acme user. sslTargets are added to wantedBy + before

     

       779
       779
       +
           # which allows the acme-finished-$cert.target to signify the successful updating

     

       780
       780
       +
           # of certs end-to-end.

     

       781
       781
       +
           systemd.services.httpd-config-reload = let

     

       782
       782
       +
             sslServices = map (certName: "acme-${certName}.service") dependentCertNames;

     

       783
       783
       +
             sslTargets = map (certName: "acme-finished-${certName}.target") dependentCertNames;

     

       784
       784
       +
           in mkIf (sslServices != []) {

     

       785
       785
       +
             wantedBy = sslServices ++ [ "multi-user.target" ];

     

       786
       786
       +
             # Before the finished targets, after the renew services.

     

       787
       787
       +
             # This service might be needed for HTTP-01 challenges, but we only want to confirm

     

       788
       788
       +
             # certs are updated _after_ config has been reloaded.

     

       789
       789
       +
             before = sslTargets;

     

       790
       790
       +
             after = sslServices;

     

       791
       791
       +
             # Block reloading if not all certs exist yet.

     

       792
       792
       +
             # Happens when config changes add new vhosts/certs.

     

       793
       793
       +
             unitConfig.ConditionPathExists = map (certName: certs.${certName}.directory + "/fullchain.pem") dependentCertNames;

     

       794
       794
       +
             serviceConfig = {

     

       795
       795
       +
               Type = "oneshot";

     

       796
       796
       +
               TimeoutSec = 60;

     

       797
       797
       +
               ExecCondition = "/run/current-system/systemd/bin/systemctl -q is-active httpd.service";

     

       798
       798
       +
               ExecStartPre = "${pkg}/bin/httpd -f ${httpdConf} -t";

     

       799
       799
       +
               ExecStart = "/run/current-system/systemd/bin/systemctl reload httpd.service";

     

       800
       800
       +
             };

     

       801
       801
       +
           };

     

       769
       802
        
       

     

       770
       803
        
         };

     

       771
       804
        
       }

+46 -42

nixos/modules/services/web-servers/nginx/default.nix

···

       6
       6
        
         cfg = config.services.nginx;

     

       7
       7
        
         certs = config.security.acme.certs;

     

       8
       8
        
         vhostsConfigs = mapAttrsToList (vhostName: vhostConfig: vhostConfig) virtualHosts;

     

       9
       9
       -
         acmeEnabledVhosts = filter (vhostConfig: vhostConfig.enableACME && vhostConfig.useACMEHost == null) vhostsConfigs;

     

       9
       9
       +
         acmeEnabledVhosts = filter (vhostConfig: vhostConfig.enableACME || vhostConfig.useACMEHost != null) vhostsConfigs;

     

       10
       10
       +
         dependentCertNames = unique (map (hostOpts: hostOpts.certName) acmeEnabledVhosts);

     

       10
       11
        
         virtualHosts = mapAttrs (vhostName: vhostConfig:

     

       11
       12
        
           let

     

       12
       13
        
             serverName = if vhostConfig.serverName != null

     

       13
       14
        
               then vhostConfig.serverName

     

       14
       15
        
               else vhostName;

     

       16
       16
       +
             certName = if vhostConfig.useACMEHost != null

     

       17
       17
       +
               then vhostConfig.useACMEHost

     

       18
       18
       +
               else serverName;

     

       15
       19
        
           in

     

       16
       20
        
           vhostConfig // {

     

       17
       17
       -
             inherit serverName;

     

       18
       18
       -
           } // (optionalAttrs vhostConfig.enableACME {

     

       19
       19
       -
             sslCertificate = "${certs.${serverName}.directory}/fullchain.pem";

     

       20
       20
       -
             sslCertificateKey = "${certs.${serverName}.directory}/key.pem";

     

       21
       21
       -
             sslTrustedCertificate = "${certs.${serverName}.directory}/full.pem";

     

       22
       22
       -
           }) // (optionalAttrs (vhostConfig.useACMEHost != null) {

     

       23
       23
       -
             sslCertificate = "${certs.${vhostConfig.useACMEHost}.directory}/fullchain.pem";

     

       24
       24
       -
             sslCertificateKey = "${certs.${vhostConfig.useACMEHost}.directory}/key.pem";

     

       25
       25
       -
             sslTrustedCertificate = "${certs.${vhostConfig.useACMEHost}.directory}/fullchain.pem";

     

       21
       21
       +
             inherit serverName certName;

     

       22
       22
       +
           } // (optionalAttrs (vhostConfig.enableACME || vhostConfig.useACMEHost != null) {

     

       23
       23
       +
             sslCertificate = "${certs.${certName}.directory}/fullchain.pem";

     

       24
       24
       +
             sslCertificateKey = "${certs.${certName}.directory}/key.pem";

     

       25
       25
       +
             sslTrustedCertificate = "${certs.${certName}.directory}/chain.pem";

     

       26
       26
        
           })

     

       27
       27
        
         ) cfg.virtualHosts;

     

       28
       28
        
         enableIPv6 = config.networking.enableIPv6;

     
···

       691
       691
        
           systemd.services.nginx = {

     

       692
       692
        
             description = "Nginx Web Server";

     

       693
       693
        
             wantedBy = [ "multi-user.target" ];

     

       694
       694
       -
             wants = concatLists (map (vhostConfig: ["acme-${vhostConfig.serverName}.service" "acme-selfsigned-${vhostConfig.serverName}.service"]) acmeEnabledVhosts);

     

       695
       695
       -
             after = [ "network.target" ] ++ map (vhostConfig: "acme-selfsigned-${vhostConfig.serverName}.service") acmeEnabledVhosts;

     

       694
       694
       +
             wants = concatLists (map (certName: [ "acme-finished-${certName}.target" ]) dependentCertNames);

     

       695
       695
       +
             after = [ "network.target" ] ++ map (certName: "acme-selfsigned-${certName}.service") dependentCertNames;

     

       696
       696
        
             # Nginx needs to be started in order to be able to request certificates

     

       697
       697
        
             # (it's hosting the acme challenge after all)

     

       698
       698
        
             # This fixes https://github.com/NixOS/nixpkgs/issues/81842

     

       699
       699
       -
             before = map (vhostConfig: "acme-${vhostConfig.serverName}.service") acmeEnabledVhosts;

     

       699
       699
       +
             before = map (certName: "acme-${certName}.service") dependentCertNames;

     

       700
       700
        
             stopIfChanged = false;

     

       701
       701
        
             preStart = ''

     

       702
       702
        
               ${cfg.preStart}

     
···

       753
       753
        
             source = configFile;

     

       754
       754
        
           };

     

       755
       755
        
       

     

       756
       756
       -
           systemd.services.nginx-config-reload = mkIf cfg.enableReload {

     

       757
       757
       -
             wants = [ "nginx.service" ];

     

       758
       758
       -
             wantedBy = [ "multi-user.target" ];

     

       759
       759
       -
             restartTriggers = [ configFile ];

     

       760
       760
       -
             # commented, because can cause extra delays during activate for this config:

     

       761
       761
       -
             #      services.nginx.virtualHosts."_".locations."/".proxyPass = "http://blabla:3000";

     

       762
       762
       -
             # stopIfChanged = false;

     

       763
       763
       -
             serviceConfig.Type = "oneshot";

     

       764
       764
       -
             serviceConfig.TimeoutSec = 60;

     

       765
       765
       -
             script = ''

     

       766
       766
       -
               if /run/current-system/systemd/bin/systemctl -q is-active nginx.service ; then

     

       767
       767
       -
                 /run/current-system/systemd/bin/systemctl reload nginx.service

     

       768
       768
       -
               fi

     

       769
       769
       -
             '';

     

       770
       770
       -
             serviceConfig.RemainAfterExit = true;

     

       756
       756
       +
           # postRun hooks on cert renew can't be used to restart Nginx since renewal

     

       757
       757
       +
           # runs as the unprivileged acme user. sslTargets are added to wantedBy + before

     

       758
       758
       +
           # which allows the acme-finished-$cert.target to signify the successful updating

     

       759
       759
       +
           # of certs end-to-end.

     

       760
       760
       +
           systemd.services.nginx-config-reload = let

     

       761
       761
       +
             sslServices = map (certName: "acme-${certName}.service") dependentCertNames;

     

       762
       762
       +
             sslTargets = map (certName: "acme-finished-${certName}.target") dependentCertNames;

     

       763
       763
       +
           in mkIf (cfg.enableReload || sslServices != []) {

     

       764
       764
       +
             wants = optionals (cfg.enableReload) [ "nginx.service" ];

     

       765
       765
       +
             wantedBy = sslServices ++ [ "multi-user.target" ];

     

       766
       766
       +
             # Before the finished targets, after the renew services.

     

       767
       767
       +
             # This service might be needed for HTTP-01 challenges, but we only want to confirm

     

       768
       768
       +
             # certs are updated _after_ config has been reloaded.

     

       769
       769
       +
             before = sslTargets;

     

       770
       770
       +
             after = sslServices;

     

       771
       771
       +
             restartTriggers = optionals (cfg.enableReload) [ configFile ];

     

       772
       772
       +
             # Block reloading if not all certs exist yet.

     

       773
       773
       +
             # Happens when config changes add new vhosts/certs.

     

       774
       774
       +
             unitConfig.ConditionPathExists = optionals (sslServices != []) (map (certName: certs.${certName}.directory + "/fullchain.pem") dependentCertNames);

     

       775
       775
       +
             serviceConfig = {

     

       776
       776
       +
               Type = "oneshot";

     

       777
       777
       +
               TimeoutSec = 60;

     

       778
       778
       +
               ExecCondition = "/run/current-system/systemd/bin/systemctl -q is-active nginx.service";

     

       779
       779
       +
               ExecStart = "/run/current-system/systemd/bin/systemctl reload nginx.service";

     

       780
       780
       +
             };

     

       771
       781
        
           };

     

       772
       782
        
       

     

       773
       773
       -
           security.acme.certs = filterAttrs (n: v: v != {}) (

     

       774
       774
       -
             let

     

       775
       775
       -
               acmePairs = map (vhostConfig: { name = vhostConfig.serverName; value = {

     

       776
       776
       -
                   user = cfg.user;

     

       777
       777
       -
                   group = lib.mkDefault cfg.group;

     

       778
       778
       -
                   webroot = vhostConfig.acmeRoot;

     

       779
       779
       -
                   extraDomains = genAttrs vhostConfig.serverAliases (alias: null);

     

       780
       780
       -
                   postRun = ''

     

       781
       781
       -
                     /run/current-system/systemd/bin/systemctl reload nginx

     

       782
       782
       -
                   '';

     

       783
       783
       -
                 }; }) acmeEnabledVhosts;

     

       784
       784
       -
             in

     

       785
       785
       -
               listToAttrs acmePairs

     

       786
       786
       -
           );

     

       783
       783
       +
           security.acme.certs = let

     

       784
       784
       +
             acmePairs = map (vhostConfig: nameValuePair vhostConfig.serverName {

     

       785
       785
       +
               group = mkDefault cfg.group;

     

       786
       786
       +
               webroot = vhostConfig.acmeRoot;

     

       787
       787
       +
               extraDomainNames = vhostConfig.serverAliases;

     

       788
       788
       +
             # Filter for enableACME-only vhosts. Don't want to create dud certs

     

       789
       789
       +
             }) (filter (vhostConfig: vhostConfig.useACMEHost == null) acmeEnabledVhosts);

     

       790
       790
       +
           in listToAttrs acmePairs;

     

       787
       791
        
       

     

       788
       792
        
           users.users = optionalAttrs (cfg.user == "nginx") {

     

       789
       793
        
             nginx = {

+231 -135

nixos/tests/acme.nix

···

       1
       1
        
       let

     

       2
       2
        
         commonConfig = ./common/acme/client;

     

       3
       3
        
       

     

       4
       4
       -
         dnsScript = {writeScript, dnsAddress, bash, curl}: writeScript "dns-hook.sh" ''

     

       5
       5
       -
           #!${bash}/bin/bash

     

       4
       4
       +
         dnsServerIP = nodes: nodes.dnsserver.config.networking.primaryIPAddress;

     

       5
       5
       +
       

     

       6
       6
       +
         dnsScript = {pkgs, nodes}: let

     

       7
       7
       +
           dnsAddress = dnsServerIP nodes;

     

       8
       8
       +
         in pkgs.writeShellScript "dns-hook.sh" ''

     

       6
       9
        
           set -euo pipefail

     

       7
       10
        
           echo '[INFO]' "[$2]" 'dns-hook.sh' $*

     

       8
       11
        
           if [ "$1" = "present" ]; then

     

       9
       9
       -
             ${curl}/bin/curl --data '{"host": "'"$2"'", "value": "'"$3"'"}' http://${dnsAddress}:8055/set-txt

     

       12
       12
       +
             ${pkgs.curl}/bin/curl --data '{"host": "'"$2"'", "value": "'"$3"'"}' http://${dnsAddress}:8055/set-txt

     

       10
       13
        
           else

     

       11
       11
       -
             ${curl}/bin/curl --data '{"host": "'"$2"'"}' http://${dnsAddress}:8055/clear-txt

     

       14
       14
       +
             ${pkgs.curl}/bin/curl --data '{"host": "'"$2"'"}' http://${dnsAddress}:8055/clear-txt

     

       12
       15
        
           fi

     

       13
       16
        
         '';

     

       14
       17
        
       

     

       18
       18
       +
         documentRoot = pkgs: pkgs.runCommand "docroot" {} ''

     

       19
       19
       +
           mkdir -p "$out"

     

       20
       20
       +
           echo hello world > "$out/index.html"

     

       21
       21
       +
         '';

     

       22
       22
       +
       

     

       23
       23
       +
         vhostBase = pkgs: {

     

       24
       24
       +
           forceSSL = true;

     

       25
       25
       +
           locations."/".root = documentRoot pkgs;

     

       26
       26
       +
         };

     

       27
       27
       +
       

     

       15
       28
        
       in import ./make-test-python.nix ({ lib, ... }: {

     

       16
       29
        
         name = "acme";

     

       17
       30
        
         meta.maintainers = lib.teams.acme.members;

     

       18
       31
        
       

     

       19
       19
       -
         nodes = rec {

     

       32
       32
       +
         nodes = {

     

       33
       33
       +
           # The fake ACME server which will respond to client requests

     

       20
       34
        
           acme = { nodes, lib, ... }: {

     

       21
       35
        
             imports = [ ./common/acme/server ];

     

       22
       22
       -
             networking.nameservers = lib.mkForce [

     

       23
       23
       -
               nodes.dnsserver.config.networking.primaryIPAddress

     

       24
       24
       -
             ];

     

       36
       36
       +
             networking.nameservers = lib.mkForce [ (dnsServerIP nodes) ];

     

       25
       37
        
           };

     

       26
       38
        
       

     

       39
       39
       +
           # A fake DNS server which can be configured with records as desired

     

       40
       40
       +
           # Used to test DNS-01 challenge

     

       27
       41
        
           dnsserver = { nodes, pkgs, ... }: {

     

       28
       42
        
             networking.firewall.allowedTCPPorts = [ 8055 53 ];

     

       29
       43
        
             networking.firewall.allowedUDPPorts = [ 53 ];

     
···

       39
       53
        
             };

     

       40
       54
        
           };

     

       41
       55
        
       

     

       42
       42
       -
           acmeStandalone = { nodes, lib, config, pkgs, ... }: {

     

       43
       43
       -
             imports = [ commonConfig ];

     

       44
       44
       -
             networking.nameservers = lib.mkForce [

     

       45
       45
       -
               nodes.dnsserver.config.networking.primaryIPAddress

     

       46
       46
       -
             ];

     

       47
       47
       -
             networking.firewall.allowedTCPPorts = [ 80 ];

     

       48
       48
       -
             security.acme.certs."standalone.test" = {

     

       49
       49
       -
               webroot = "/var/lib/acme/acme-challenges";

     

       50
       50
       -
             };

     

       51
       51
       -
             systemd.targets."acme-finished-standalone.test" = {

     

       52
       52
       -
               after = [ "acme-standalone.test.service" ];

     

       53
       53
       -
               wantedBy = [ "acme-standalone.test.service" ];

     

       54
       54
       -
             };

     

       55
       55
       -
             services.nginx.enable = true;

     

       56
       56
       -
             services.nginx.virtualHosts."standalone.test" = {

     

       57
       57
       -
               locations."/.well-known/acme-challenge".root = "/var/lib/acme/acme-challenges";

     

       58
       58
       -
             };

     

       59
       59
       -
           };

     

       60
       60
       -
       

     

       61
       61
       -
           webserver = { nodes, config, pkgs, lib, ... }: {

     

       56
       56
       +
           # A web server which will be the node requesting certs

     

       57
       57
       +
           webserver = { pkgs, nodes, lib, config, ... }: {

     

       62
       58
        
             imports = [ commonConfig ];

     

       59
       59
       +
             networking.nameservers = lib.mkForce [ (dnsServerIP nodes) ];

     

       63
       60
        
             networking.firewall.allowedTCPPorts = [ 80 443 ];

     

       64
       64
       -
             networking.nameservers = lib.mkForce [

     

       65
       65
       -
               nodes.dnsserver.config.networking.primaryIPAddress

     

       66
       66
       -
             ];

     

       67
       61
        
       

     

       68
       68
       -
             # A target remains active. Use this to probe the fact that

     

       69
       69
       -
             # a service fired eventhough it is not RemainAfterExit

     

       70
       70
       -
             systemd.targets."acme-finished-a.example.test" = {

     

       71
       71
       -
               after = [ "acme-a.example.test.service" ];

     

       72
       72
       -
               wantedBy = [ "acme-a.example.test.service" ];

     

       73
       73
       -
             };

     

       62
       62
       +
             # OpenSSL will be used for more thorough certificate validation

     

       63
       63
       +
             environment.systemPackages = [ pkgs.openssl ];

     

       74
       64
        
       

     

       65
       65
       +
             # Set log level to info so that we can see when the service is reloaded

     

       75
       66
        
             services.nginx.enable = true;

     

       67
       67
       +
             services.nginx.logError = "stderr info";

     

       76
       68
        
       

     

       77
       77
       -
             services.nginx.virtualHosts."a.example.test" = {

     

       69
       69
       +
             # First tests configure a basic cert and run a bunch of openssl checks

     

       70
       70
       +
             services.nginx.virtualHosts."a.example.test" = (vhostBase pkgs) // {

     

       78
       71
        
               enableACME = true;

     

       79
       79
       -
               forceSSL = true;

     

       80
       80
       -
               locations."/".root = pkgs.runCommand "docroot" {} ''

     

       81
       81
       -
                 mkdir -p "$out"

     

       82
       82
       -
                 echo hello world > "$out/index.html"

     

       72
       72
       +
             };

     

       73
       73
       +
       

     

       74
       74
       +
             # Used to determine if service reload was triggered

     

       75
       75
       +
             systemd.targets.test-renew-nginx = {

     

       76
       76
       +
               wants = [ "acme-a.example.test.service" ];

     

       77
       77
       +
               after = [ "acme-a.example.test.service" "nginx-config-reload.service" ];

     

       78
       78
       +
             };

     

       79
       79
       +
       

     

       80
       80
       +
             # Cert config changes will not cause the nginx configuration to change.

     

       81
       81
       +
             # This tests that the reload service is correctly triggered.

     

       82
       82
       +
             # It also tests that postRun is exec'd as root

     

       83
       83
       +
             specialisation.cert-change.configuration = { pkgs, ... }: {

     

       84
       84
       +
               security.acme.certs."a.example.test".keyType = "ec384";

     

       85
       85
       +
               security.acme.certs."a.example.test".postRun = ''

     

       86
       86
       +
                 set -euo pipefail

     

       87
       87
       +
                 touch test

     

       88
       88
       +
                 chown root:root test

     

       89
       89
       +
                 echo testing > test

     

       83
       90
        
               '';

     

       84
       91
        
             };

     

       85
       92
        
       

     

       86
       86
       -
             security.acme.server = "https://acme.test/dir";

     

       93
       93
       +
             # Now adding an alias to ensure that the certs are updated

     

       94
       94
       +
             specialisation.nginx-aliases.configuration = { pkgs, ... }: {

     

       95
       95
       +
               services.nginx.virtualHosts."a.example.test" = {

     

       96
       96
       +
                 serverAliases = [ "b.example.test" ];

     

       97
       97
       +
               };

     

       98
       98
       +
             };

     

       87
       99
        
       

     

       88
       88
       -
             specialisation.second-cert.configuration = {pkgs, ...}: {

     

       89
       89
       -
               systemd.targets."acme-finished-b.example.test" = {

     

       90
       90
       -
                 after = [ "acme-b.example.test.service" ];

     

       91
       91
       -
                 wantedBy = [ "acme-b.example.test.service" ];

     

       92
       92
       -
               };

     

       93
       93
       -
               services.nginx.virtualHosts."b.example.test" = {

     

       94
       94
       -
                 enableACME = true;

     

       100
       100
       +
             # Test using Apache HTTPD

     

       101
       101
       +
             specialisation.httpd-aliases.configuration = { pkgs, config, lib, ... }: {

     

       102
       102
       +
               services.nginx.enable = lib.mkForce false;

     

       103
       103
       +
               services.httpd.enable = true;

     

       104
       104
       +
               services.httpd.adminAddr = config.security.acme.email;

     

       105
       105
       +
               services.httpd.virtualHosts."c.example.test" = {

     

       106
       106
       +
                 serverAliases = [ "d.example.test" ];

     

       95
       107
        
                 forceSSL = true;

     

       96
       96
       -
                 locations."/".root = pkgs.runCommand "docroot" {} ''

     

       97
       97
       -
                   mkdir -p "$out"

     

       98
       98
       -
                   echo hello world > "$out/index.html"

     

       99
       99
       -
                 '';

     

       108
       108
       +
                 enableACME = true;

     

       109
       109
       +
                 documentRoot = documentRoot pkgs;

     

       110
       110
       +
               };

     

       111
       111
       +
       

     

       112
       112
       +
               # Used to determine if service reload was triggered

     

       113
       113
       +
               systemd.targets.test-renew-httpd = {

     

       114
       114
       +
                 wants = [ "acme-c.example.test.service" ];

     

       115
       115
       +
                 after = [ "acme-c.example.test.service" "httpd-config-reload.service" ];

     

       100
       116
        
               };

     

       101
       117
        
             };

     

       102
       118
        
       

     

       103
       103
       -
             specialisation.dns-01.configuration = {pkgs, config, nodes, lib, ...}: {

     

       119
       119
       +
             # Validation via DNS-01 challenge

     

       120
       120
       +
             specialisation.dns-01.configuration = { pkgs, config, nodes, ... }: {

     

       104
       121
        
               security.acme.certs."example.test" = {

     

       105
       122
        
                 domain = "*.example.test";

     

       123
       123
       +
                 group = config.services.nginx.group;

     

       106
       124
        
                 dnsProvider = "exec";

     

       107
       125
        
                 dnsPropagationCheck = false;

     

       108
       108
       -
                 credentialsFile = with pkgs; writeText "wildcard.env" ''

     

       109
       109
       -
                   EXEC_PATH=${dnsScript { inherit writeScript bash curl; dnsAddress = nodes.dnsserver.config.networking.primaryIPAddress; }}

     

       126
       126
       +
                 credentialsFile = pkgs.writeText "wildcard.env" ''

     

       127
       127
       +
                   EXEC_PATH=${dnsScript { inherit pkgs nodes; }}

     

       110
       128
        
                 '';

     

       111
       111
       -
                 user = config.services.nginx.user;

     

       112
       112
       -
                 group = config.services.nginx.group;

     

       113
       129
        
               };

     

       114
       114
       -
               systemd.targets."acme-finished-example.test" = {

     

       115
       115
       -
                 after = [ "acme-example.test.service" ];

     

       116
       116
       -
                 wantedBy = [ "acme-example.test.service" ];

     

       117
       117
       -
               };

     

       118
       118
       -
               systemd.services."acme-example.test" = {

     

       119
       119
       -
                 before = [ "nginx.service" ];

     

       120
       120
       -
                 wantedBy = [ "nginx.service" ];

     

       121
       121
       -
               };

     

       122
       122
       -
               services.nginx.virtualHosts."c.example.test" = {

     

       123
       123
       -
                 forceSSL = true;

     

       124
       124
       -
                 sslCertificate = config.security.acme.certs."example.test".directory + "/cert.pem";

     

       125
       125
       -
                 sslTrustedCertificate = config.security.acme.certs."example.test".directory + "/full.pem";

     

       126
       126
       -
                 sslCertificateKey = config.security.acme.certs."example.test".directory + "/key.pem";

     

       127
       127
       -
                 locations."/".root = pkgs.runCommand "docroot" {} ''

     

       128
       128
       -
                   mkdir -p "$out"

     

       129
       129
       -
                   echo hello world > "$out/index.html"

     

       130
       130
       -
                 '';

     

       130
       130
       +
       

     

       131
       131
       +
               services.nginx.virtualHosts."dns.example.test" = (vhostBase pkgs) // {

     

       132
       132
       +
                 useACMEHost = "example.test";

     

       131
       133
        
               };

     

       132
       134
        
             };

     

       133
       135
        
       

     

       134
       134
       -
             # When nginx depends on a service that is slow to start up, requesting used to fail

     

       135
       135
       -
             # certificates fail.  Reproducer for https://github.com/NixOS/nixpkgs/issues/81842

     

       136
       136
       -
             specialisation.slow-startup.configuration = { pkgs, config, nodes, lib, ...}: {

     

       136
       136
       +
             # Validate service relationships by adding a slow start service to nginx' wants.

     

       137
       137
       +
             # Reproducer for https://github.com/NixOS/nixpkgs/issues/81842

     

       138
       138
       +
             specialisation.slow-startup.configuration = { pkgs, config, nodes, lib, ... }: {

     

       137
       139
        
               systemd.services.my-slow-service = {

     

       138
       140
        
                 wantedBy = [ "multi-user.target" "nginx.service" ];

     

       139
       141
        
                 before = [ "nginx.service" ];

     

       140
       142
        
                 preStart = "sleep 5";

     

       141
       143
        
                 script = "${pkgs.python3}/bin/python -m http.server";

     

       142
       144
        
               };

     

       143
       143
       -
               systemd.targets."acme-finished-d.example.com" = {

     

       144
       144
       -
                 after = [ "acme-d.example.com.service" ];

     

       145
       145
       -
                 wantedBy = [ "acme-d.example.com.service" ];

     

       146
       146
       -
               };

     

       147
       147
       -
               services.nginx.virtualHosts."d.example.com" = {

     

       145
       145
       +
       

     

       146
       146
       +
               services.nginx.virtualHosts."slow.example.com" = {

     

       148
       147
        
                 forceSSL = true;

     

       149
       148
        
                 enableACME = true;

     

       150
       149
        
                 locations."/".proxyPass = "http://localhost:8000";

     
···

       152
       151
        
             };

     

       153
       152
        
           };

     

       154
       153
        
       

     

       155
       155
       -
           client = {nodes, lib, ...}: {

     

       154
       154
       +
           # The client will be used to curl the webserver to validate configuration

     

       155
       155
       +
           client = {nodes, lib, pkgs, ...}: {

     

       156
       156
        
             imports = [ commonConfig ];

     

       157
       157
       -
             networking.nameservers = lib.mkForce [

     

       158
       158
       -
               nodes.dnsserver.config.networking.primaryIPAddress

     

       159
       159
       -
             ];

     

       157
       157
       +
             networking.nameservers = lib.mkForce [ (dnsServerIP nodes) ];

     

       158
       158
       +
       

     

       159
       159
       +
             # OpenSSL will be used for more thorough certificate validation

     

       160
       160
       +
             environment.systemPackages = [ pkgs.openssl ];

     

       160
       161
        
           };

     

       161
       162
        
         };

     

       162
       163
        
       

     
···

       167
       168
        
           in

     

       168
       169
        
           # Note, wait_for_unit does not work for oneshot services that do not have RemainAfterExit=true,

     

       169
       170
        
           # this is because a oneshot goes from inactive => activating => inactive, and never

     

       170
       170
       -
           # reaches the active state. To work around this, we create some mock target units which

     

       171
       171
       -
           # get pulled in by the oneshot units. The target units linger after activation, and hence we

     

       172
       172
       -
           # can use them to probe that a oneshot fired. It is a bit ugly, but it is the best we can do

     

       171
       171
       +
           # reaches the active state. Targets do not have this issue.

     

       172
       172
       +
       

     

       173
       173
        
           ''

     

       174
       174
       +
             import time

     

       175
       175
       +
       

     

       176
       176
       +
       

     

       177
       177
       +
             has_switched = False

     

       178
       178
       +
       

     

       179
       179
       +
       

     

       180
       180
       +
             def switch_to(node, name):

     

       181
       181
       +
                 global has_switched

     

       182
       182
       +
                 if has_switched:

     

       183
       183
       +
                     node.succeed(

     

       184
       184
       +
                         "${switchToNewServer}"

     

       185
       185
       +
                     )

     

       186
       186
       +
                 has_switched = True

     

       187
       187
       +
                 node.succeed(

     

       188
       188
       +
                     f"/run/current-system/specialisation/{name}/bin/switch-to-configuration test"

     

       189
       189
       +
                 )

     

       190
       190
       +
       

     

       191
       191
       +
       

     

       192
       192
       +
             # Ensures the issuer of our cert matches the chain

     

       193
       193
       +
             # and matches the issuer we expect it to be.

     

       194
       194
       +
             # It's a good validation to ensure the cert.pem and fullchain.pem

     

       195
       195
       +
             # are not still selfsigned afer verification

     

       196
       196
       +
             def check_issuer(node, cert_name, issuer):

     

       197
       197
       +
                 for fname in ("cert.pem", "fullchain.pem"):

     

       198
       198
       +
                     actual_issuer = node.succeed(

     

       199
       199
       +
                         f"openssl x509 -noout -issuer -in /var/lib/acme/{cert_name}/{fname}"

     

       200
       200
       +
                     ).partition("=")[2]

     

       201
       201
       +
                     print(f"{fname} issuer: {actual_issuer}")

     

       202
       202
       +
                     assert issuer.lower() in actual_issuer.lower()

     

       203
       203
       +
       

     

       204
       204
       +
       

     

       205
       205
       +
             # Ensure cert comes before chain in fullchain.pem

     

       206
       206
       +
             def check_fullchain(node, cert_name):

     

       207
       207
       +
                 subject_data = node.succeed(

     

       208
       208
       +
                     f"openssl crl2pkcs7 -nocrl -certfile /var/lib/acme/{cert_name}/fullchain.pem"

     

       209
       209
       +
                     " | openssl pkcs7 -print_certs -noout"

     

       210
       210
       +
                 )

     

       211
       211
       +
                 for line in subject_data.lower().split("\n"):

     

       212
       212
       +
                     if "subject" in line:

     

       213
       213
       +
                         print(f"First subject in fullchain.pem: ", line)

     

       214
       214
       +
                         assert cert_name.lower() in line

     

       215
       215
       +
                         return

     

       216
       216
       +
       

     

       217
       217
       +
                 assert False

     

       218
       218
       +
       

     

       219
       219
       +
       

     

       220
       220
       +
             def check_connection(node, domain, retries=3):

     

       221
       221
       +
                 assert retries >= 0

     

       222
       222
       +
       

     

       223
       223
       +
                 result = node.succeed(

     

       224
       224
       +
                     "openssl s_client -brief -verify 2 -CAfile /tmp/ca.crt"

     

       225
       225
       +
                     f" -servername {domain} -connect {domain}:443 < /dev/null 2>&1"

     

       226
       226
       +
                 )

     

       227
       227
       +
       

     

       228
       228
       +
                 for line in result.lower().split("\n"):

     

       229
       229
       +
                     if "verification" in line and "error" in line:

     

       230
       230
       +
                         time.sleep(1)

     

       231
       231
       +
                         return check_connection(node, domain, retries - 1)

     

       232
       232
       +
       

     

       233
       233
       +
       

     

       234
       234
       +
             def check_connection_key_bits(node, domain, bits, retries=3):

     

       235
       235
       +
                 assert retries >= 0

     

       236
       236
       +
       

     

       237
       237
       +
                 result = node.succeed(

     

       238
       238
       +
                     "openssl s_client -CAfile /tmp/ca.crt"

     

       239
       239
       +
                     f" -servername {domain} -connect {domain}:443 < /dev/null"

     

       240
       240
       +
                     " | openssl x509 -noout -text | grep -i Public-Key"

     

       241
       241
       +
                 )

     

       242
       242
       +
                 print("Key type:", result)

     

       243
       243
       +
       

     

       244
       244
       +
                 if bits not in result:

     

       245
       245
       +
                     time.sleep(1)

     

       246
       246
       +
                     return check_connection_key_bits(node, domain, bits, retries - 1)

     

       247
       247
       +
       

     

       248
       248
       +
       

     

       174
       249
        
             client.start()

     

       175
       250
        
             dnsserver.start()

     

       176
       251
        
       

     

       177
       177
       -
             acme.wait_for_unit("default.target")

     

       178
       252
        
             dnsserver.wait_for_unit("pebble-challtestsrv.service")

     

       253
       253
       +
             client.wait_for_unit("default.target")

     

       254
       254
       +
       

     

       179
       255
        
             client.succeed(

     

       180
       180
       -
                 'curl --data \'{"host": "acme.test", "addresses": ["${nodes.acme.config.networking.primaryIPAddress}"]}\' http://${nodes.dnsserver.config.networking.primaryIPAddress}:8055/add-a'

     

       181
       181
       -
             )

     

       182
       182
       -
             client.succeed(

     

       183
       183
       -
                 'curl --data \'{"host": "standalone.test", "addresses": ["${nodes.acmeStandalone.config.networking.primaryIPAddress}"]}\' http://${nodes.dnsserver.config.networking.primaryIPAddress}:8055/add-a'

     

       256
       256
       +
                 'curl --data \'{"host": "acme.test", "addresses": ["${nodes.acme.config.networking.primaryIPAddress}"]}\' http://${dnsServerIP nodes}:8055/add-a'

     

       184
       257
        
             )

     

       185
       258
        
       

     

       186
       259
        
             acme.start()

     

       187
       187
       -
             acmeStandalone.start()

     

       260
       260
       +
             webserver.start()

     

       188
       261
        
       

     

       189
       262
        
             acme.wait_for_unit("default.target")

     

       190
       263
        
             acme.wait_for_unit("pebble.service")

     

       191
       264
        
       

     

       192
       192
       -
             with subtest("can request certificate with HTTPS-01 challenge"):

     

       193
       193
       -
                 acmeStandalone.wait_for_unit("default.target")

     

       194
       194
       -
                 acmeStandalone.succeed("systemctl start acme-standalone.test.service")

     

       195
       195
       -
                 acmeStandalone.wait_for_unit("acme-finished-standalone.test.target")

     

       265
       265
       +
             client.succeed("curl https://acme.test:15000/roots/0 > /tmp/ca.crt")

     

       266
       266
       +
             client.succeed("curl https://acme.test:15000/intermediate-keys/0 >> /tmp/ca.crt")

     

       267
       267
       +
       

     

       268
       268
       +
             with subtest("Can request certificate with HTTPS-01 challenge"):

     

       269
       269
       +
                 webserver.wait_for_unit("acme-finished-a.example.test.target")

     

       270
       270
       +
                 check_fullchain(webserver, "a.example.test")

     

       271
       271
       +
                 check_issuer(webserver, "a.example.test", "pebble")

     

       272
       272
       +
                 check_connection(client, "a.example.test")

     

       196
       273
        
       

     

       197
       197
       -
             client.wait_for_unit("default.target")

     

       274
       274
       +
             with subtest("Can generate valid selfsigned certs"):

     

       275
       275
       +
                 webserver.succeed("systemctl clean acme-a.example.test.service --what=state")

     

       276
       276
       +
                 webserver.succeed("systemctl start acme-selfsigned-a.example.test.service")

     

       277
       277
       +
                 check_fullchain(webserver, "a.example.test")

     

       278
       278
       +
                 check_issuer(webserver, "a.example.test", "minica")

     

       279
       279
       +
                 # Will succeed if nginx can load the certs

     

       280
       280
       +
                 webserver.succeed("systemctl start nginx-config-reload.service")

     

       198
       281
        
       

     

       199
       199
       -
             client.succeed("curl https://acme.test:15000/roots/0 > /tmp/ca.crt")

     

       200
       200
       -
             client.succeed("curl https://acme.test:15000/intermediate-keys/0 >> /tmp/ca.crt")

     

       282
       282
       +
             with subtest("Can reload nginx when timer triggers renewal"):

     

       283
       283
       +
                 webserver.succeed("systemctl start test-renew-nginx.target")

     

       284
       284
       +
                 check_issuer(webserver, "a.example.test", "pebble")

     

       285
       285
       +
                 check_connection(client, "a.example.test")

     

       201
       286
        
       

     

       202
       202
       -
             with subtest("Can request certificate for nginx service"):

     

       287
       287
       +
             with subtest("Can reload web server when cert configuration changes"):

     

       288
       288
       +
                 switch_to(webserver, "cert-change")

     

       203
       289
        
                 webserver.wait_for_unit("acme-finished-a.example.test.target")

     

       204
       204
       -
                 client.succeed(

     

       205
       205
       -
                     "curl --cacert /tmp/ca.crt https://a.example.test/ | grep -qF 'hello world'"

     

       206
       206
       -
                 )

     

       290
       290
       +
                 check_connection_key_bits(client, "a.example.test", "384")

     

       291
       291
       +
                 webserver.succeed("grep testing /var/lib/acme/a.example.test/test")

     

       292
       292
       +
       

     

       293
       293
       +
             with subtest("Can request certificate with HTTPS-01 when nginx startup is delayed"):

     

       294
       294
       +
                 switch_to(webserver, "slow-startup")

     

       295
       295
       +
                 webserver.wait_for_unit("acme-finished-slow.example.com.target")

     

       296
       296
       +
                 check_issuer(webserver, "slow.example.com", "pebble")

     

       297
       297
       +
                 check_connection(client, "slow.example.com")

     

       298
       298
       +
       

     

       299
       299
       +
             with subtest("Can request certificate for vhost + aliases (nginx)"):

     

       300
       300
       +
                 # Check the key hash before and after adding an alias. It should not change.

     

       301
       301
       +
                 # The previous test reverts the ed384 change

     

       302
       302
       +
                 webserver.wait_for_unit("acme-finished-a.example.test.target")

     

       303
       303
       +
                 keyhash_old = webserver.succeed("md5sum /var/lib/acme/a.example.test/key.pem")

     

       304
       304
       +
                 switch_to(webserver, "nginx-aliases")

     

       305
       305
       +
                 webserver.wait_for_unit("acme-finished-a.example.test.target")

     

       306
       306
       +
                 check_issuer(webserver, "a.example.test", "pebble")

     

       307
       307
       +
                 check_connection(client, "a.example.test")

     

       308
       308
       +
                 check_connection(client, "b.example.test")

     

       309
       309
       +
                 keyhash_new = webserver.succeed("md5sum /var/lib/acme/a.example.test/key.pem")

     

       310
       310
       +
                 assert keyhash_old == keyhash_new

     

       311
       311
       +
       

     

       312
       312
       +
             with subtest("Can request certificates for vhost + aliases (apache-httpd)"):

     

       313
       313
       +
                 switch_to(webserver, "httpd-aliases")

     

       314
       314
       +
                 webserver.wait_for_unit("acme-finished-c.example.test.target")

     

       315
       315
       +
                 check_issuer(webserver, "c.example.test", "pebble")

     

       316
       316
       +
                 check_connection(client, "c.example.test")

     

       317
       317
       +
                 check_connection(client, "d.example.test")

     

       207
       318
        
       

     

       208
       208
       -
             with subtest("Can add another certificate for nginx service"):

     

       209
       209
       -
                 webserver.succeed(

     

       210
       210
       -
                     "/run/current-system/specialisation/second-cert/bin/switch-to-configuration test"

     

       211
       211
       -
                 )

     

       212
       212
       -
                 webserver.wait_for_unit("acme-finished-b.example.test.target")

     

       213
       213
       -
                 client.succeed(

     

       214
       214
       -
                     "curl --cacert /tmp/ca.crt https://b.example.test/ | grep -qF 'hello world'"

     

       215
       215
       -
                 )

     

       319
       319
       +
             with subtest("Can reload httpd when timer triggers renewal"):

     

       320
       320
       +
                 # Switch to selfsigned first

     

       321
       321
       +
                 webserver.succeed("systemctl clean acme-c.example.test.service --what=state")

     

       322
       322
       +
                 webserver.succeed("systemctl start acme-selfsigned-c.example.test.service")

     

       323
       323
       +
                 check_issuer(webserver, "c.example.test", "minica")

     

       324
       324
       +
                 webserver.succeed("systemctl start httpd-config-reload.service")

     

       325
       325
       +
                 webserver.succeed("systemctl start test-renew-httpd.target")

     

       326
       326
       +
                 check_issuer(webserver, "c.example.test", "pebble")

     

       327
       327
       +
                 check_connection(client, "c.example.test")

     

       216
       328
        
       

     

       217
       329
        
             with subtest("Can request wildcard certificates using DNS-01 challenge"):

     

       218
       218
       -
                 webserver.succeed(

     

       219
       219
       -
                     "${switchToNewServer}"

     

       220
       220
       -
                 )

     

       221
       221
       -
                 webserver.succeed(

     

       222
       222
       -
                     "/run/current-system/specialisation/dns-01/bin/switch-to-configuration test"

     

       223
       223
       -
                 )

     

       330
       330
       +
                 switch_to(webserver, "dns-01")

     

       224
       331
        
                 webserver.wait_for_unit("acme-finished-example.test.target")

     

       225
       225
       -
                 client.succeed(

     

       226
       226
       -
                     "curl --cacert /tmp/ca.crt https://c.example.test/ | grep -qF 'hello world'"

     

       227
       227
       -
                 )

     

       228
       228
       -
       

     

       229
       229
       -
             with subtest("Can request certificate of nginx when startup is delayed"):

     

       230
       230
       -
                 webserver.succeed(

     

       231
       231
       -
                     "${switchToNewServer}"

     

       232
       232
       -
                 )

     

       233
       233
       -
                 webserver.succeed(

     

       234
       234
       -
                     "/run/current-system/specialisation/slow-startup/bin/switch-to-configuration test"

     

       235
       235
       -
                 )

     

       236
       236
       -
                 webserver.wait_for_unit("acme-finished-d.example.com.target")

     

       237
       237
       -
                 client.succeed("curl --cacert /tmp/ca.crt https://d.example.com/")

     

       332
       332
       +
                 check_issuer(webserver, "example.test", "pebble")

     

       333
       333
       +
                 check_connection(client, "dns.example.test")

     

       238
       334
        
           '';

     

       239
       335
        
       })

+5 -6

nixos/tests/common/acme/client/default.nix

···

       1
       1
        
       { lib, nodes, pkgs, ... }:

     

       2
       2
       -
       

     

       3
       2
        
       let

     

       4
       4
       -
         acme-ca = nodes.acme.config.test-support.acme.caCert;

     

       5
       5
       -
       in

     

       3
       3
       +
         caCert = nodes.acme.config.test-support.acme.caCert;

     

       4
       4
       +
         caDomain = nodes.acme.config.test-support.acme.caDomain;

     

       6
       5
        
       

     

       7
       7
       -
       {

     

       6
       6
       +
       in {

     

       8
       7
        
         security.acme = {

     

       9
       9
       -
           server = "https://acme.test/dir";

     

       8
       8
       +
           server = "https://${caDomain}/dir";

     

       10
       9
        
           email = "hostmaster@example.test";

     

       11
       10
        
           acceptTerms = true;

     

       12
       11
        
         };

     

       13
       12
        
       

     

       14
       14
       -
         security.pki.certificateFiles = [ acme-ca ];

     

       13
       13
       +
         security.pki.certificateFiles = [ caCert ];

     

       15
       14
        
       }

+38 -34

nixos/tests/common/acme/server/default.nix

···

       3
       3
        
       #   config.test-support.acme.caCert

     

       4
       4
        
       #

     

       5
       5
        
       # This value can be used inside the configuration of other test nodes to inject

     

       6
       6
       -
       # the snakeoil certificate into security.pki.certificateFiles or into package

     

       6
       6
       +
       # the test certificate into security.pki.certificateFiles or into package

     

       7
       7
        
       # overlays.

     

       8
       8
        
       #

     

       9
       9
        
       # Another value that's needed if you don't use a custom resolver (see below for

     
···

       50
       50
        
       # Also make sure that whenever you use a resolver from a different test node

     

       51
       51
        
       # that it has to be started _before_ the ACME service.

     

       52
       52
        
       { config, pkgs, lib, ... }:

     

       53
       53
       -
       

     

       54
       54
       -
       

     

       55
       53
        
       let

     

       56
       56
       -
         snakeOilCerts = import ./snakeoil-certs.nix;

     

       54
       54
       +
         testCerts = import ./snakeoil-certs.nix {

     

       55
       55
       +
           minica = pkgs.minica;

     

       56
       56
       +
           mkDerivation = pkgs.stdenv.mkDerivation;

     

       57
       57
       +
         };

     

       58
       58
       +
         domain = testCerts.domain;

     

       57
       59
        
       

     

       58
       58
       -
         wfeDomain = "acme.test";

     

       59
       59
       -
         wfeCertFile = snakeOilCerts.${wfeDomain}.cert;

     

       60
       60
       -
         wfeKeyFile = snakeOilCerts.${wfeDomain}.key;

     

       61
       61
       -
       

     

       62
       62
       -
         siteDomain = "acme.test";

     

       63
       63
       -
         siteCertFile = snakeOilCerts.${siteDomain}.cert;

     

       64
       64
       -
         siteKeyFile = snakeOilCerts.${siteDomain}.key;

     

       65
       65
       -
         pebble = pkgs.pebble;

     

       66
       60
        
         resolver = let

     

       67
       61
        
           message = "You need to define a resolver for the acme test module.";

     

       68
       62
        
           firstNS = lib.head config.networking.nameservers;

     
···

       71
       65
        
         pebbleConf.pebble = {

     

       72
       66
        
           listenAddress = "0.0.0.0:443";

     

       73
       67
        
           managementListenAddress = "0.0.0.0:15000";

     

       74
       74
       -
           certificate = snakeOilCerts.${wfeDomain}.cert;

     

       75
       75
       -
           privateKey = snakeOilCerts.${wfeDomain}.key;

     

       68
       68
       +
           # These certs and keys are used for the Web Front End (WFE)

     

       69
       69
       +
           certificate = testCerts.${domain}.cert;

     

       70
       70
       +
           privateKey = testCerts.${domain}.key;

     

       76
       71
        
           httpPort = 80;

     

       77
       72
        
           tlsPort = 443;

     

       78
       73
        
           ocspResponderURL = "http://0.0.0.0:4002";

     
···

       80
       75
        
         };

     

       81
       76
        
       

     

       82
       77
        
         pebbleConfFile = pkgs.writeText "pebble.conf" (builtins.toJSON pebbleConf);

     

       83
       83
       -
         pebbleDataDir = "/root/pebble";

     

       84
       78
        
       

     

       85
       79
        
       in {

     

       86
       80
        
         imports = [ ../../resolver.nix ];

     

       87
       81
        
       

     

       88
       88
       -
         options.test-support.acme.caCert = lib.mkOption {

     

       89
       89
       -
           type = lib.types.path;

     

       90
       90
       -
           description = ''

     

       91
       91
       -
             A certificate file to use with the <literal>nodes</literal> attribute to

     

       92
       92
       -
             inject the snakeoil CA certificate used in the ACME server into

     

       93
       93
       -
             <option>security.pki.certificateFiles</option>.

     

       94
       94
       -
           '';

     

       82
       82
       +
         options.test-support.acme = with lib; {

     

       83
       83
       +
           caDomain = mkOption {

     

       84
       84
       +
             type = types.str;

     

       85
       85
       +
             readOnly = true;

     

       86
       86
       +
             default = domain;

     

       87
       87
       +
             description = ''

     

       88
       88
       +
               A domain name to use with the <literal>nodes</literal> attribute to

     

       89
       89
       +
               identify the CA server.

     

       90
       90
       +
             '';

     

       91
       91
       +
           };

     

       92
       92
       +
           caCert = mkOption {

     

       93
       93
       +
             type = types.path;

     

       94
       94
       +
             readOnly = true;

     

       95
       95
       +
             default = testCerts.ca.cert;

     

       96
       96
       +
             description = ''

     

       97
       97
       +
               A certificate file to use with the <literal>nodes</literal> attribute to

     

       98
       98
       +
               inject the test CA certificate used in the ACME server into

     

       99
       99
       +
               <option>security.pki.certificateFiles</option>.

     

       100
       100
       +
             '';

     

       101
       101
       +
           };

     

       95
       102
        
         };

     

       96
       103
        
       

     

       97
       104
        
         config = {

     
···

       99
       106
        
             resolver.enable = let

     

       100
       107
        
               isLocalResolver = config.networking.nameservers == [ "127.0.0.1" ];

     

       101
       108
        
             in lib.mkOverride 900 isLocalResolver;

     

       102
       102
       -
             acme.caCert = snakeOilCerts.ca.cert;

     

       103
       109
        
           };

     

       104
       110
        
       

     

       105
       111
        
           # This has priority 140, because modules/testing/test-instrumentation.nix

     

       106
       112
        
           # already overrides this with priority 150.

     

       107
       113
        
           networking.nameservers = lib.mkOverride 140 [ "127.0.0.1" ];

     

       108
       108
       -
           networking.firewall.enable = false;

     

       114
       114
       +
           networking.firewall.allowedTCPPorts = [ 80 443 15000 4002 ];

     

       109
       115
        
       

     

       110
       116
        
           networking.extraHosts = ''

     

       111
       111
       -
             127.0.0.1 ${wfeDomain}

     

       112
       112
       -
             ${config.networking.primaryIPAddress} ${wfeDomain} ${siteDomain}

     

       117
       117
       +
             127.0.0.1 ${domain}

     

       118
       118
       +
             ${config.networking.primaryIPAddress} ${domain}

     

       113
       119
        
           '';

     

       114
       120
        
       

     

       115
       121
        
           systemd.services = {

     

       116
       122
        
             pebble = {

     

       117
       123
        
               enable = true;

     

       118
       124
        
               description = "Pebble ACME server";

     

       119
       119
       -
               requires = [ ];

     

       120
       125
        
               wantedBy = [ "network.target" ];

     

       121
       121
       -
               preStart = ''

     

       122
       122
       -
                 mkdir ${pebbleDataDir}

     

       123
       123
       -
               '';

     

       124
       124
       -
               script = ''

     

       125
       125
       -
                 cd ${pebbleDataDir}

     

       126
       126
       -
                 ${pebble}/bin/pebble -config ${pebbleConfFile}

     

       127
       127
       -
               '';

     

       126
       126
       +
       

     

       128
       127
        
               serviceConfig = {

     

       128
       128
       +
                 RuntimeDirectory = "pebble";

     

       129
       129
       +
                 WorkingDirectory = "/run/pebble";

     

       130
       130
       +
       

     

       129
       131
        
                 # Required to bind on privileged ports.

     

       130
       132
        
                 AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];

     

       133
       133
       +
       

     

       134
       134
       +
                 ExecStart = "${pkgs.pebble}/bin/pebble -config ${pebbleConfFile}";

     

       131
       135
        
               };

     

       132
       136
        
             };

     

       133
       137
        
           };

-69

nixos/tests/common/acme/server/mkcerts.nix

···

       1
       1
       -
       { pkgs ? import <nixpkgs> {}

     

       2
       2
       -
       , lib ? pkgs.lib

     

       3
       3
       -
       , domains ? [ "acme.test" ]

     

       4
       4
       -
       }:

     

       5
       5
       -
       

     

       6
       6
       -
       pkgs.runCommand "acme-snakeoil-ca" {

     

       7
       7
       -
         nativeBuildInputs = [ pkgs.openssl ];

     

       8
       8
       -
       } ''

     

       9
       9
       -
         addpem() {

     

       10
       10
       -
           local file="$1"; shift

     

       11
       11
       -
           local storeFileName="$(IFS=.; echo "$*")"

     

       12
       12
       -
       

     

       13
       13
       -
           echo -n "  " >> "$out"

     

       14
       14
       -
       

     

       15
       15
       -
           # Every following argument is an attribute, so let's recurse and check

     

       16
       16
       -
           # every attribute whether it must be quoted and write it into $out.

     

       17
       17
       -
           while [ -n "$1" ]; do

     

       18
       18
       -
             if expr match "$1" '^[a-zA-Z][a-zA-Z0-9]*$' > /dev/null; then

     

       19
       19
       -
               echo -n "$1" >> "$out"

     

       20
       20
       -
             else

     

       21
       21
       -
               echo -n '"' >> "$out"

     

       22
       22
       -
               echo -n "$1" | sed -e 's/["$]/\\&/g' >> "$out"

     

       23
       23
       -
               echo -n '"' >> "$out"

     

       24
       24
       -
             fi

     

       25
       25
       -
             shift

     

       26
       26
       -
             [ -z "$1" ] || echo -n . >> "$out"

     

       27
       27
       -
           done

     

       28
       28
       -
       

     

       29
       29
       -
           echo " = builtins.toFile \"$storeFileName\" '''" >> "$out"

     

       30
       30
       -
           sed -e 's/^/    /' "$file" >> "$out"

     

       31
       31
       -
       

     

       32
       32
       -
           echo "  ''';" >> "$out"

     

       33
       33
       -
         }

     

       34
       34
       -
       

     

       35
       35
       -
         echo '# Generated via mkcert.sh in the same directory.' > "$out"

     

       36
       36
       -
         echo '{' >> "$out"

     

       37
       37
       -
       

     

       38
       38
       -
         openssl req -newkey rsa:4096 -x509 -sha256 -days 36500 \

     

       39
       39
       -
           -subj '/CN=Snakeoil CA' -nodes -out ca.pem -keyout ca.key

     

       40
       40
       -
       

     

       41
       41
       -
         addpem ca.key ca key

     

       42
       42
       -
         addpem ca.pem ca cert

     

       43
       43
       -
       

     

       44
       44
       -
         ${lib.concatMapStrings (fqdn: let

     

       45
       45
       -
           opensslConfig = pkgs.writeText "snakeoil.cnf" ''

     

       46
       46
       -
             [req]

     

       47
       47
       -
             default_bits = 4096

     

       48
       48
       -
             prompt = no

     

       49
       49
       -
             default_md = sha256

     

       50
       50
       -
             req_extensions = req_ext

     

       51
       51
       -
             distinguished_name = dn

     

       52
       52
       -
             [dn]

     

       53
       53
       -
             CN = ${fqdn}

     

       54
       54
       -
             [req_ext]

     

       55
       55
       -
             subjectAltName = DNS:${fqdn}

     

       56
       56
       -
           '';

     

       57
       57
       -
         in ''

     

       58
       58
       -
           export OPENSSL_CONF=${lib.escapeShellArg opensslConfig}

     

       59
       59
       -
           openssl genrsa -out snakeoil.key 4096

     

       60
       60
       -
           openssl req -new -key snakeoil.key -out snakeoil.csr

     

       61
       61
       -
           openssl x509 -req -in snakeoil.csr -sha256 -set_serial 666 \

     

       62
       62
       -
             -CA ca.pem -CAkey ca.key -out snakeoil.pem -days 36500 \

     

       63
       63
       -
             -extfile "$OPENSSL_CONF" -extensions req_ext

     

       64
       64
       -
           addpem snakeoil.key ${lib.escapeShellArg fqdn} key

     

       65
       65
       -
           addpem snakeoil.pem ${lib.escapeShellArg fqdn} cert

     

       66
       66
       -
         '') domains}

     

       67
       67
       -
       

     

       68
       68
       -
         echo '}' >> "$out"

     

       69
       69
       -
       ''

-6

nixos/tests/common/acme/server/mkcerts.sh

···

       1
       1
       -
       #!/usr/bin/env nix-shell

     

       2
       2
       -
       #!nix-shell -p nix bash -i bash

     

       3
       3
       -
       set -e

     

       4
       4
       -
       cd "$(dirname "$0")"

     

       5
       5
       -
       storepath="$(nix-build --no-out-link mkcerts.nix)"

     

       6
       6
       -
       cat "$storepath" > snakeoil-certs.nix

+36 -171

nixos/tests/common/acme/server/snakeoil-certs.nix

···

       1
       1
       -
       # Generated via mkcert.sh in the same directory.

     

       2
       2
       -
       {

     

       3
       3
       -
         ca.key = builtins.toFile "ca.key" ''

     

       4
       4
       -
           -----BEGIN PRIVATE KEY-----

     

       5
       5
       -
           MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQDd1G7OFpXIoHnr

     

       6
       6
       -
           rxdw+hiJVDY6nQDDKFt9FBKwlv7x2hCvX7bnyvHaL7H61c+80McGPISrQn3+MjuR

     

       7
       7
       -
           Zuqwax49DddNXbGt4WqGlx4LAeI37OgNUUz9foNr2rDDV744vwp14/PD1f3nqpWf

     

       8
       8
       -
           Ogzzsh8rxac0mZ5Se9HxOIpI7NRNuHJjj7HWZ4YxeOvi289rmpu0JPcp25njw7h6

     

       9
       9
       -
           FNfHu8GGp34Uj6wAxubdRyfViV8z9FMfbglLuA9i1OiSy3NQpq8VwBG+u/0iC7PQ

     

       10
       10
       -
           sQjxSragQu25sfATYIrFJQ4ZCvh0nxqKMeyPPBi6dAcMpa2AZAqtqv+CwWdo36Bt

     

       11
       11
       -
           S5XiC7rApgYn+yteKQHSbnCiG2W/boSbfg9lRk3w41dESENCADVajLb3Eovvp0tB

     

       12
       12
       -
           O/BALudvWjzAPbpXleVNr6ngWtGlsZTC7LXDgBqdW2KlzpZGcz+PW3ATlwip/ZFR

     

       13
       13
       -
           t7A15u5dVkWPVoPuQ0w1Tw+g9dxWFTNk3h+2d7K87IxQbcvqxeIDSEVFMrxo0e4C

     

       14
       14
       -
           G2udMcelZwARl6iNTAETa2zJW0XtAdGVM+HY1S/kU6U9J3nubDttAkAMABjPwyjL

     

       15
       15
       -
           G7hfyWqUHf9yPs49GsftAVvIy8XIeu0shD1BG11/VzvwpUCiRc+btuWi2erZ4ZfP

     

       16
       16
       -
           oQ5YoS9gt4S+Ipz7TPGBl+AUk9HO2QIDAQABAoICAGW+aLAXxc2GZUVHQp4r55Md

     

       17
       17
       -
           T94kYtQgL4435bafGwH8vchiQzcfazxiweRFqwl0TMS8fzE5xyYPDilLpfsStoTU

     

       18
       18
       -
           U1sFzVfuWviuWTY9P+/ctjZdgs2F+GtAm/CMzw+h9/9IdWbuQI3APO4SJxyjJw7h

     

       19
       19
       -
           kiZbCzXT2uAjybFXBq07GyQ1JSEszGzmhHLB1OoKuL2wcrj9IyFHhNZhtvLCWCoV

     

       20
       20
       -
           qotttjuI/xyg5VFYt5TRzEpPIu5a1pvDAYVK0XI9cXKtbLYp7RlveqMOgAaD+S2a

     

       21
       21
       -
           ZQTV60JH9n4j18p+sKR00SxvZ4vuyXzDePRBDUolGIy9MIJdiLueTiuzDmTmclnM

     

       22
       22
       -
           8Yy7oliawW2Bn+1gaWpqmgzEUw9bXRSqIp2zGZ7HaQ+5c/MhS002+/i8WQyssfeg

     

       23
       23
       -
           9EfI+Vl0D2avTxCECmsfjUxtkhzMYPVNbRPjt0QBEM+s8lDoNsP2zhMO441+TKpe

     

       24
       24
       -
           /5KZHIW+Y0US6GMIUs1o1byKfNz8Nj5HjEKO9CMyK6SBMJnCMroPD4H6opqk3lw9

     

       25
       25
       -
           4mk04BdN556EzyJDT0a5/VpXG2DUYwFaNwE1ZPMu3Yx6IBoM1xx8mR80vHQCddmF

     

       26
       26
       -
           NP+BzkpUiHf0Txyy0YQWECZ/anTt0Bo0XqY5tirIM2dkG0ngNl9tGlw6gVAY1ky8

     

       27
       27
       -
           +cr7qKmhhwMWojaX/L+9AoIBAQD/BZAeF3l9I5RBh6ktWA+opzVyd6ejdLpc2Q1z

     

       28
       28
       -
           fmSmtUKRsEe51sWaIf6Sez408UaCMT2IQuppPgMnV8xfMM1/og75Cs8aPyAohwKo

     

       29
       29
       -
           IbOenXhLfFZiYB4y/Pac3F+FzNKsTT6n+fsE+82UHafY5ZI2FlPb2L0lfyx09zXv

     

       30
       30
       -
           fBYhcXgwSx5ymJLJSl8zFaEGn9qi3UB5ss44SaNM0n8SFGUQUk3PR7SFWSWgNxtl

     

       31
       31
       -
           CP7LWTsjXYoC/qBMe7b8JieK5aFk1EkkG1EkJvdiMnulMcMJzl+kj6LqVPmVDoZS

     

       32
       32
       -
           mMGvgKGJPpFgrbJ5wlA7uOhucGmMpFWP9RCav66DY4GHrLJPAoIBAQDerkZQ03AN

     

       33
       33
       -
           i2iJVjtL97TvDjrE8vtNFS/Auh8JyDIW4GGK3Y/ZoMedQpuu3e6NYM9aMjh+QJoA

     

       34
       34
       -
           kqhaiZ/tMXjEXJByglpc3a43g2ceWtJg5yLgexGgRtegbA57PRCo35Vhc6WycD1l

     

       35
       35
       -
           6FZNxpTkd2BXX/69KWZ6PpSiLYPvdzxP5ZkYqoWRQIa4ee4orHfz/lUXJm1XwmyG

     

       36
       36
       -
           mx3hN9Z9m8Q/PGMGfwrorcp4DK53lmmhTZyPh+X5T5/KkVmrw/v5HEEB3JsknStR

     

       37
       37
       -
           3DAqp2XZcRHsGQef9R7H+PINJm9nebjCraataaE4gr76znXKT23P80Ce5Lw6OQUW

     

       38
       38
       -
           XHhoL16gS+pXAoIBADTuz6ofTz01PFmZsfjSdXWZN1PKGEaqPOB2wP7+9h9QMkAR

     

       39
       39
       -
           KeId/Sfv9GotII1Woz70v4Pf983ebEMnSyla9NyQI7F3l+MnxSIEW/3P+PtsTgLF

     

       40
       40
       -
           DR0gPERzEzEd4Mnh6LyQz/eHwJ2ZMmOTADrZ8848Ni3EwAXfbrfcdBqAVAufBMZp

     

       41
       41
       -
           YSmCF72mLTpqO+EnHvd9GxvnjDxMtJOGgY+cIhoQK0xh4stm5JNrvMjs5A4LOGYv

     

       42
       42
       -
           zSyv80/Mwf92X/DJlwVZttDCxsXNPL3qIpX4TTZk2p9KnRMsjh1tRV4xjMpD1cOp

     

       43
       43
       -
           8/zwMMJrHcI3sC70MERb+9KEmGy2ap+k8MbbhqsCggEAUAqqocDupR+4Kq2BUPQv

     

       44
       44
       -
           6EHgJA0HAZUc/hSotXZtcsWiqiyr2Vkuhzt7BGcnqU/kGJK2tcL42D3fH/QaNUM0

     

       45
       45
       -
           Grj+/voWCw1v4uprtYCF4GkUo0X5dvgf570Pk4LGqzz6z/Wm2LX5i9jwtLItsNWs

     

       46
       46
       -
           HpwVz97CxCwcdxMPOpNMbZek6TXaHvTnuAWz8pDT6TNBWLnqUcJECjpVii/s/Gdy

     

       47
       47
       -
           KhzFp38g57QYdABy8e9x9pYUMY9yvaO+VyzZ46DlwIxEXavzZDzOZnVUJvDW7krz

     

       48
       48
       -
           Wz8/+2I7dzvnnYx0POiG3gtXPzwZxFtS1IpD0r2sRjQ0xSiI9BCs4HXKngBw7gN7

     

       49
       49
       -
           rwKCAQEAloJOFw4bafVXZVXuQVnLDm0/MNTfqxUzFE6V2WkMVkJqcpKt+ndApM8P

     

       50
       50
       -
           MJvojHWw1fmxDzIAwqZ9rXgnwWKydjSZBDYNjhGFUACVywHe5AjC4PPMUdltGptU

     

       51
       51
       -
           lY0BjC7qtwkVugr65goQkEzU61y9JgTqKpYsr3D+qXcoiDvWRuqk5Q0WfYJrUlE0

     

       52
       52
       -
           APWaqbxmkqUVDRrXXrifiluupk+BCV7cFSnnknSYbd9FZd9DuKaoNBlkp2J9LZE+

     

       53
       53
       -
           Ux74Cfro8SHINHmvqL+YLFUPVDWNeuXh5Kl6AaJ7yclCLXLxAIix3/rIf6mJeIGc

     

       54
       54
       -
           s9o9Sr49cibZ3CbMjCSNE3AOeVE1/Q==

     

       55
       55
       -
           -----END PRIVATE KEY-----

     

       56
       56
       -
         '';

     

       57
       57
       -
         ca.cert = builtins.toFile "ca.cert" ''

     

       58
       58
       -
           -----BEGIN CERTIFICATE-----

     

       59
       59
       -
           MIIFDzCCAvegAwIBAgIUX0P6NfX4gRUpFz+TNV/f26GHokgwDQYJKoZIhvcNAQEL

     

       60
       60
       -
           BQAwFjEUMBIGA1UEAwwLU25ha2VvaWwgQ0EwIBcNMjAwODI0MDc0MjEyWhgPMjEy

     

       61
       61
       -
           MDA3MzEwNzQyMTJaMBYxFDASBgNVBAMMC1NuYWtlb2lsIENBMIICIjANBgkqhkiG

     

       62
       62
       -
           9w0BAQEFAAOCAg8AMIICCgKCAgEA3dRuzhaVyKB5668XcPoYiVQ2Op0AwyhbfRQS

     

       63
       63
       -
           sJb+8doQr1+258rx2i+x+tXPvNDHBjyEq0J9/jI7kWbqsGsePQ3XTV2xreFqhpce

     

       64
       64
       -
           CwHiN+zoDVFM/X6Da9qww1e+OL8KdePzw9X956qVnzoM87IfK8WnNJmeUnvR8TiK

     

       65
       65
       -
           SOzUTbhyY4+x1meGMXjr4tvPa5qbtCT3KduZ48O4ehTXx7vBhqd+FI+sAMbm3Ucn

     

       66
       66
       -
           1YlfM/RTH24JS7gPYtTokstzUKavFcARvrv9Iguz0LEI8Uq2oELtubHwE2CKxSUO

     

       67
       67
       -
           GQr4dJ8aijHsjzwYunQHDKWtgGQKrar/gsFnaN+gbUuV4gu6wKYGJ/srXikB0m5w

     

       68
       68
       -
           ohtlv26Em34PZUZN8ONXREhDQgA1Woy29xKL76dLQTvwQC7nb1o8wD26V5XlTa+p

     

       69
       69
       -
           4FrRpbGUwuy1w4AanVtipc6WRnM/j1twE5cIqf2RUbewNebuXVZFj1aD7kNMNU8P

     

       70
       70
       -
           oPXcVhUzZN4ftneyvOyMUG3L6sXiA0hFRTK8aNHuAhtrnTHHpWcAEZeojUwBE2ts

     

       71
       71
       -
           yVtF7QHRlTPh2NUv5FOlPSd57mw7bQJADAAYz8Moyxu4X8lqlB3/cj7OPRrH7QFb

     

       72
       72
       -
           yMvFyHrtLIQ9QRtdf1c78KVAokXPm7blotnq2eGXz6EOWKEvYLeEviKc+0zxgZfg

     

       73
       73
       -
           FJPRztkCAwEAAaNTMFEwHQYDVR0OBBYEFNhBZxryvykCjfPO85xB3wof2enAMB8G

     

       74
       74
       -
           A1UdIwQYMBaAFNhBZxryvykCjfPO85xB3wof2enAMA8GA1UdEwEB/wQFMAMBAf8w

     

       75
       75
       -
           DQYJKoZIhvcNAQELBQADggIBAEZwlsQ+3yd1MVxLRy9RjoA8hI7iWBNmvPUyNjlb

     

       76
       76
       -
           l/L9N+dZgdx9G5h/KPRUyzvUc/uk/ZxTWVPIOp13WI65qwsBKrwvYKiXiwzjt+9V

     

       77
       77
       -
           CKDRc1sOghTSXk4FD3L5UcKvTQ2lRcFsqxbkopEwQWhoCuhe4vFyt3Nx8ZGLCBUD

     

       78
       78
       -
           3I5zMHtO8FtpZWKJPw46Yc1kasv0nlfly/vUbnErYfgjWX1hgWUcRgYdKwO4sOZ7

     

       79
       79
       -
           KbNma0WUsX5mWhXo4Kk7D15wATHO+j9s+j8m86duBL3A4HzpTo1DhHvBi0dkg0CO

     

       80
       80
       -
           XuSdByIzVLIPh3yhCHN1loRCP2rbzKM8IQeU/X5Q4UJeC/x9ew8Kk+RKXoHc8Y2C

     

       81
       81
       -
           JQO1DxuidyDJRhbb98wZo2YfIsdWQGjYZBe1XQRwBD28JnB+Rb9shml6lORWQn9y

     

       82
       82
       -
           P/STo9uWm5zvOCfqwbnCoetljDweItINx622G9SafBwPZc3o79oL7QSl8DgCtN6g

     

       83
       83
       -
           p0wGIlIBx+25w/96PqZcrYb8B7/uBHJviiKjBXDoIJWNiNRhW5HaFjeJdSKq7KIL

     

       84
       84
       -
           I/PO9KuHafif36ksG69X02Rio2/cTjgjEW1hGHcDRyyJWWaj7bd2eWuouh6FF22b

     

       85
       85
       -
           PA6FGY4vewDPnbLKLaix2ZIKxtedUDOH/qru3Mv58IFXmQ4iyM8oC8aOxYSQLZDn

     

       86
       86
       -
           1yJD

     

       87
       87
       -
           -----END CERTIFICATE-----

     

       88
       88
       -
         '';

     

       89
       89
       -
         "acme.test".key = builtins.toFile "acme.test.key" ''

     

       90
       90
       -
           -----BEGIN RSA PRIVATE KEY-----

     

       91
       91
       -
           MIIJKgIBAAKCAgEA3dJl4ByHHRcqbZzblszHIS5eEW3TcXTvllqC1nedGLGU9dnA

     

       92
       92
       -
           YbdpDUYhvWz/y9AfRZ1d8jYz01jZtt5xWYG0QoQUdkCc9QPPh0Axrl38cGliB6IZ

     

       93
       93
       -
           IY0qftW9zrLSgCOUnXL/45JqSpD57DHMSSiJl3hoOo4keBaMRN/UK6F3DxD/nZEs

     

       94
       94
       -
           h+yBBh2js3qxleExqkX8InmjK9pG8j7qa4Be5Lh4iILBHbGAMaxM7ViNAg4KgWyg

     

       95
       95
       -
           d5+4qB86JFtE/cJ+r3D62ARjVaxU6ePOL0AwS/vx5ls6DFQC7+1CpGCNemgLPzcc

     

       96
       96
       -
           70s0V0SAnF73xHYqRWjJFtumyvyTkiQWLg0zDQOugWd3B9ADuaIEx2nviPyphAtj

     

       97
       97
       -
           M3ZKrL2zN1aIfqzbxJ/L8TQFa2WPsPU2+iza/m9kMfLXZ4XPF/SJxQ+5yVH+rxx5

     

       98
       98
       -
           OWrXZ13nCMyeVoaXQofmG7oZvOQbtuT9r5DQZd9WN0P3G3sy0/dNnlNVn8uCBvXJ

     

       99
       99
       -
           TQhRKsy1FESZdgcFNtpJEG7BRG9Gc6i0V39aSRzShZyKJSBQhlc0FMTlX445EYsh

     

       100
       100
       -
           PKjEC/+Suq9wy/LuLjIkkqBbVg4617IlibLz0fDY/yrZqkfSqhCVsWnra21Ty3Mp

     

       101
       101
       -
           vD+wnskTzuGrvCVTe3KcWp+wkeH0xvhr8FXX6nn492YCfvZSITO3FF+qWt8CAwEA

     

       102
       102
       -
           AQKCAgEAk2xV0NCk66yNwjPRrTOD1IWgdyzqrijtYpvdAPSWL+c1/P8vYMIoy22k

     

       103
       103
       -
           1uQuTSKQ5g9kdKmZYAlZCLRl2Pre9qYZg04GAsD5mAYN/rjwITWotTICSc4sRAeC

     

       104
       104
       -
           EnG+fPMovkvDzVdt1QjtURD3mFeculKH0wLNMhKqPswTkrvJCPZfLDVjxyJjzdC9

     

       105
       105
       -
           D3enttjnzSaeH7t/upFjPXSbD79NUe1YDkH4XuetL1Y3+jYz4P279bBgJaC9dN7s

     

       106
       106
       -
           IWWXQJ+W2rrXu+GOs03JUXjZe4XJk3ZqmpJezfq3yQWCmQSigovLjcPvMwpkSut4

     

       107
       107
       -
           HnTvbl6qUV8G5m4tOBMNcL8TDqAvIGY8Q2NAT0iKJN187FbHpjSwQL/Ckgqz/taJ

     

       108
       108
       -
           Q82LfIA1+IjwW372gY2Wge8tM/s3+2vOEn2k91sYfiKtrRFfrHBurehVQSpJb2gL

     

       109
       109
       -
           YPoUhUGu4C1nx44sQw+DgugOBp1BTKA1ZOBIk6NyS/J9sU3jSgMr88n10TyepP6w

     

       110
       110
       -
           OVk9kcNomnm/QIOyTDW4m76uoaxslg7kwOJ4j6wycddS8JtvEO4ZPk/fHZCbvlMv

     

       111
       111
       -
           /dAKsC3gigO2zW6IYYb7mSXI07Ew/rFH1NfSILiGw8GofJHDq3plGHZo9ycB6JC+

     

       112
       112
       -
           9C8n9IWjn8ahwbulCoQQhdHwXvf61t+RzNFuFiyAT0PF2FtD/eECggEBAPYBNSEY

     

       113
       113
       -
           DSQc/Wh+UlnwQsevxfzatohgQgQJRU1ZpbHQrl2uxk1ISEwrfqZwFmFotdjjzSYe

     

       114
       114
       -
           e1WQ0uFYtdm1V/QeQK+8W0u7E7/fof4dR6XxrzJ2QmtWEmCnLOBUKCfPc7/4p4IU

     

       115
       115
       -
           7Q8PDwuwvXgaASZDaEsyTxL9bBrNMLFx9hIScQ9CaygpKvufilCHG79maoKArLwX

     

       116
       116
       -
           s7G16qlT4YeEdiNuLGv0Ce0txJuFYp7cGClWQhruw+jIbr+Sn9pL9cn8GboCiUAq

     

       117
       117
       -
           VgZKsofhEkKIEbP1uFypX2JnyRSE/h0qDDcH1sEXjR9zYYpQjVpk3Jiipgw4PXis

     

       118
       118
       -
           79uat5/QzUqVc1sCggEBAObVp686K9NpxYNoEliMijIdzFnK5J/TvoX9BBMz0dXc

     

       119
       119
       -
           CgQW40tBcroU5nRl3oCjT1Agn8mxWLXH3czx6cPlSA8fnMTJmev8FaLnEcM15pGI

     

       120
       120
       -
           8/VCBbTegdezJ8vPRS/T9c4CViXo7d0qDMkjNyn22ojPPFYh8M1KVNhibDTEpXMQ

     

       121
       121
       -
           vJxBJgvHePj+5pMOIKwAvQicqD07fNp6jVPmB/GnprBkjcCQZtshNJzWrW3jk7Fr

     

       122
       122
       -
           xWpQJ8nam8wHdMvfKhpzvD6azahwmfKKaQmh/RwmH4xdtIKdh4j+u+Ax+Bxi0g7V

     

       123
       123
       -
           GQfusIFB1MO48yS6E56WZMmsPy+jhTcIB4prIbfu4c0CggEBALgqqUKwRc4+Ybvj

     

       124
       124
       -
           rfUk+GmT/s3QUwx/u4xYAGjq7y/SgWcjG9PphC559WPWz/p2sITB7ehWs5CYTjdj

     

       125
       125
       -
           +SgWKdVY/KZThamJUTy4yAZ8lxH1gGpvvEOs+S8gmGkMt88t8ILMPWMWFW7LoEDp

     

       126
       126
       -
           PL74ANpLZn29GROnY1IhQQ3mughHhBqfZ6d2QnaDtsGYlD5TBvPSLv7VY7Jr9VR0

     

       127
       127
       -
           toeEtAjMRzc+SFwmgmTHk9BIB1KTAAQ3sbTIsJh8xW1gpo5jTEND+Mpvp10oeMVe

     

       128
       128
       -
           yxPB2Db4gt/j8MOz3QaelbrxqplcJfsCjaT49RHeQiRlE/y070iApgx8s0idaFCd

     

       129
       129
       -
           ucLXZbcCggEBANkcsdg9RYVWoeCj3UWOAll6736xN/IgDb4mqVOKVN3qVT1dbbGV

     

       130
       130
       -
           wFvHVq66NdoWQH4kAUaKWN65OyQNkQqgt/MJj8EDwZNVCeCrp2hNZS0TfCn9TDK/

     

       131
       131
       -
           aa7AojivHesLWNHIHtEPUdLIPzhbuAHvXcJ58M0upTfhpwXTJOVI5Dji0BPDrw47

     

       132
       132
       -
           Msw3rBU6n35IP4Q/HHpjXl58EDuOS4B+aGjWWwF4kFWg2MR/oqWN/JdOv2LsO1A/

     

       133
       133
       -
           HnR7ut4aa5ZvrunPXooERrf6eSsHQnLcZKX4aNTFZ/pxZbJMLYo9ZEdxJVbxqPAa

     

       134
       134
       -
           RA1HAuJTZiquV+Pb755WFfEZy0Xk19URiS0CggEAPT1e+9sdNC15z79SxvJQ4pmT

     

       135
       135
       -
           xiXat+1pq9pxp5HEOre2sSAd7CF5lu/1VQd6p0gtLZY+Aw4BXOyMtzYWgIap+u9j

     

       136
       136
       -
           ThFl9qrTFppG5KlFKKpQ8dQQ8ofO1akS8cK8nQeSdvrqEC/kGT2rmVdeevhBlfGy

     

       137
       137
       -
           BZi2ikhEQrz5jsLgIdT7sN2aLFYtmzLU9THTvlfm4ckQ7jOTxvVahb+WRe/iMCwP

     

       138
       138
       -
           Exrb83JDo31jHvAoYqUFrZkmPA+DUWFlrqb21pCzmC/0iQSuDcayRRjZkY/s5iAh

     

       139
       139
       -
           gtI6YyAsSL8hKvFVCC+VJf1QvFOpgUfsZjrIZuSc3puBWtN2dirHf7EfyxgEOg==

     

       140
       140
       -
           -----END RSA PRIVATE KEY-----

     

       141
       141
       -
         '';

     

       142
       142
       -
         "acme.test".cert = builtins.toFile "acme.test.cert" ''

     

       143
       143
       -
           -----BEGIN CERTIFICATE-----

     

       144
       144
       -
           MIIEwDCCAqigAwIBAgICApowDQYJKoZIhvcNAQELBQAwFjEUMBIGA1UEAwwLU25h

     

       145
       145
       -
           a2VvaWwgQ0EwIBcNMjAwODI0MDc0MjEzWhgPMjEyMDA3MzEwNzQyMTNaMBQxEjAQ

     

       146
       146
       -
           BgNVBAMMCWFjbWUudGVzdDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB

     

       147
       147
       -
           AN3SZeAchx0XKm2c25bMxyEuXhFt03F075ZagtZ3nRixlPXZwGG3aQ1GIb1s/8vQ

     

       148
       148
       -
           H0WdXfI2M9NY2bbecVmBtEKEFHZAnPUDz4dAMa5d/HBpYgeiGSGNKn7Vvc6y0oAj

     

       149
       149
       -
           lJ1y/+OSakqQ+ewxzEkoiZd4aDqOJHgWjETf1Cuhdw8Q/52RLIfsgQYdo7N6sZXh

     

       150
       150
       -
           MapF/CJ5oyvaRvI+6muAXuS4eIiCwR2xgDGsTO1YjQIOCoFsoHefuKgfOiRbRP3C

     

       151
       151
       -
           fq9w+tgEY1WsVOnjzi9AMEv78eZbOgxUAu/tQqRgjXpoCz83HO9LNFdEgJxe98R2

     

       152
       152
       -
           KkVoyRbbpsr8k5IkFi4NMw0DroFndwfQA7miBMdp74j8qYQLYzN2Sqy9szdWiH6s

     

       153
       153
       -
           28Sfy/E0BWtlj7D1Nvos2v5vZDHy12eFzxf0icUPuclR/q8ceTlq12dd5wjMnlaG

     

       154
       154
       -
           l0KH5hu6GbzkG7bk/a+Q0GXfVjdD9xt7MtP3TZ5TVZ/Lggb1yU0IUSrMtRREmXYH

     

       155
       155
       -
           BTbaSRBuwURvRnOotFd/Wkkc0oWciiUgUIZXNBTE5V+OORGLITyoxAv/krqvcMvy

     

       156
       156
       -
           7i4yJJKgW1YOOteyJYmy89Hw2P8q2apH0qoQlbFp62ttU8tzKbw/sJ7JE87hq7wl

     

       157
       157
       -
           U3tynFqfsJHh9Mb4a/BV1+p5+PdmAn72UiEztxRfqlrfAgMBAAGjGDAWMBQGA1Ud

     

       158
       158
       -
           EQQNMAuCCWFjbWUudGVzdDANBgkqhkiG9w0BAQsFAAOCAgEAM5WrCpBOmLrZ1QX8

     

       159
       159
       -
           l6vxVXwoI8pnqyy3cbAm3aLRPbw4gb0Ot90Pv/LoMhP0fkrNOKwH/FGRjSXyti0X

     

       160
       160
       -
           TheKrP7aEf6XL2/Xnb8rK2jYMQo6YJU9T+wBJA6Q+GBrc8SE75KfOi5NWJr8T4Ju

     

       161
       161
       -
           Etb+G05hXClrN19VFzIoz3L4kRV+xNMialcOT3xQfHtXCQUgwAWpPlwcJA/Jf60m

     

       162
       162
       -
           XsfwQwk2Ir16wq+Lc3y+mQ7d/dbG+FVrngFk4qN2B9M/Zyv4N9ZBbqeDUn3mYtJE

     

       163
       163
       -
           FeJrwHgmwH6slf1gBN3gxUKRW7Bvzxk548NdmLOyN+Y4StsqbOaYGtShUJA7f1Ng

     

       164
       164
       -
           qQqdgvxZ9MNwwMv9QVDZEnaaew3/oWOSmQGAai4hrc7gLMLJmIxzgfd5P6Dr06e4

     

       165
       165
       -
           2zwsMuI8Qh/IDqu/CfmFYvaua0FEeyAtpoID9Y/KPM7fu9bJuxjZ6kqLVFkEi9nF

     

       166
       166
       -
           /rCMchcSA8N2z/vLPabpNotO7OYH3VD7aQGTfCL82dMlp1vwZ39S3Z1TFLLh3MZ+

     

       167
       167
       -
           BYcAv8kUvCV6kIdPAXvJRSQOJUlJRV7XiI2mwugdDzMx69wQ0Zc1e4WyGfiSiVYm

     

       168
       168
       -
           ckSJ/EkxuwT/ZYLqCAKSFGMlFhad9g1Zyvd67XgfZq5p0pJTtGxtn5j8QHy6PM6m

     

       169
       169
       -
           NbjvWnP8lDU8j2l3eSG58S14iGs=

     

       170
       170
       -
           -----END CERTIFICATE-----

     

       171
       171
       -
         '';

     

       1
       1
       +
       # Minica can provide a CA key and cert, plus a key

     

       2
       2
       +
       # and cert for our fake CA server's Web Front End (WFE).

     

       3
       3
       +
       { minica, mkDerivation }:

     

       4
       4
       +
       let

     

       5
       5
       +
         domain = "acme.test";

     

       6
       6
       +
       

     

       7
       7
       +
         selfSignedCertData = mkDerivation {

     

       8
       8
       +
           name = "test-certs";

     

       9
       9
       +
           buildInputs = [ minica ];

     

       10
       10
       +
           phases = [ "buildPhase" "installPhase" ];

     

       11
       11
       +
       

     

       12
       12
       +
           buildPhase = ''

     

       13
       13
       +
             mkdir ca

     

       14
       14
       +
             minica \

     

       15
       15
       +
               --ca-key ca/key.pem \

     

       16
       16
       +
               --ca-cert ca/cert.pem \

     

       17
       17
       +
               --domains ${domain}

     

       18
       18
       +
             chmod 600 ca/*

     

       19
       19
       +
             chmod 640 ${domain}/*.pem

     

       20
       20
       +
           '';

     

       21
       21
       +
       

     

       22
       22
       +
           installPhase = ''

     

       23
       23
       +
             mkdir -p $out

     

       24
       24
       +
             mv ${domain} ca $out/

     

       25
       25
       +
           '';

     

       26
       26
       +
         };

     

       27
       27
       +
       in {

     

       28
       28
       +
         inherit domain;

     

       29
       29
       +
         ca = {

     

       30
       30
       +
           cert = "${selfSignedCertData}/ca/cert.pem";

     

       31
       31
       +
           key = "${selfSignedCertData}/ca/key.pem";

     

       32
       32
       +
         };

     

       33
       33
       +
         "${domain}" = {

     

       34
       34
       +
           cert = "${selfSignedCertData}/${domain}/cert.pem";

     

       35
       35
       +
           key = "${selfSignedCertData}/${domain}/key.pem";

     

       36
       36
       +
         };

     

       172
       37
        
       }

-3

nixos/tests/postfix-raise-smtpd-tls-security-level.nix

···

       1
       1
       -
       let

     

       2
       2
       -
         certs = import ./common/acme/server/snakeoil-certs.nix;

     

       3
       3
       -
       in

     

       4
       1
        
       import ./make-test-python.nix {

     

       5
       2
        
         name = "postfix";

     

       6
       3

+7 -6

nixos/tests/postfix.nix

···

       1
       1
        
       let

     

       2
       2
        
         certs = import ./common/acme/server/snakeoil-certs.nix;

     

       3
       3
       +
         domain = certs.domain;

     

       3
       4
        
       in

     

       4
       5
        
       import ./make-test-python.nix {

     

       5
       6
        
         name = "postfix";

     
···

       11
       12
        
             enableSubmission = true;

     

       12
       13
        
             enableSubmissions = true;

     

       13
       14
        
             sslCACert = certs.ca.cert;

     

       14
       14
       -
             sslCert = certs."acme.test".cert;

     

       15
       15
       -
             sslKey = certs."acme.test".key;

     

       15
       15
       +
             sslCert = certs.${domain}.cert;

     

       16
       16
       +
             sslKey = certs.${domain}.key;

     

       16
       17
        
             submissionsOptions = {

     

       17
       18
        
                 smtpd_sasl_auth_enable = "yes";

     

       18
       19
        
                 smtpd_client_restrictions = "permit";

     
···

       25
       26
        
           ];

     

       26
       27
        
       

     

       27
       28
        
           networking.extraHosts = ''

     

       28
       28
       -
             127.0.0.1 acme.test

     

       29
       29
       +
             127.0.0.1 ${domain}

     

       29
       30
        
           '';

     

       30
       31
        
       

     

       31
       32
        
           environment.systemPackages = let

     
···

       33
       34
        
               #!${pkgs.python3.interpreter}

     

       34
       35
        
               import smtplib

     

       35
       36
        
       

     

       36
       36
       -
               with smtplib.SMTP('acme.test') as smtp:

     

       37
       37
       +
               with smtplib.SMTP('${domain}') as smtp:

     

       37
       38
        
                 smtp.sendmail('root@localhost', 'alice@localhost', 'Subject: Test\n\nTest data.')

     

       38
       39
        
                 smtp.quit()

     

       39
       40
        
             '';

     
···

       45
       46
        
       

     

       46
       47
        
               ctx = ssl.create_default_context()

     

       47
       48
        
       

     

       48
       48
       -
               with smtplib.SMTP('acme.test') as smtp:

     

       49
       49
       +
               with smtplib.SMTP('${domain}') as smtp:

     

       49
       50
        
                 smtp.ehlo()

     

       50
       51
        
                 smtp.starttls(context=ctx)

     

       51
       52
        
                 smtp.ehlo()

     
···

       60
       61
        
       

     

       61
       62
        
               ctx = ssl.create_default_context()

     

       62
       63
        
       

     

       63
       63
       -
               with smtplib.SMTP_SSL(host='acme.test', context=ctx) as smtp:

     

       64
       64
       +
               with smtplib.SMTP_SSL(host='${domain}', context=ctx) as smtp:

     

       64
       65
        
                 smtp.sendmail('root@localhost', 'alice@localhost', 'Subject: Test SMTPS\n\nTest data.')

     

       65
       66
        
                 smtp.quit()

     

       66
       67
        
             '';

+34

pkgs/tools/security/minica/default.nix

···

       1
       1
       +
       { lib, buildGoPackage, fetchFromGitHub }:

     

       2
       2
       +
       

     

       3
       3
       +
       buildGoPackage rec {

     

       4
       4
       +
         pname = "minica";

     

       5
       5
       +
         version = "1.0.2";

     

       6
       6
       +
       

     

       7
       7
       +
         goPackagePath = "github.com/jsha/minica";

     

       8
       8
       +
       

     

       9
       9
       +
         src = fetchFromGitHub {

     

       10
       10
       +
           owner = "jsha";

     

       11
       11
       +
           repo = "minica";

     

       12
       12
       +
           rev = "v${version}";

     

       13
       13
       +
           sha256 = "18518wp3dcjhf3mdkg5iwxqr3326n6jwcnqhyibphnb2a58ap7ny";

     

       14
       14
       +
         };

     

       15
       15
       +
       

     

       16
       16
       +
         buildFlagsArray = ''

     

       17
       17
       +
           -ldflags=

     

       18
       18
       +
             -X main.BuildVersion=${version}

     

       19
       19
       +
         '';

     

       20
       20
       +
       

     

       21
       21
       +
         meta = with lib; {

     

       22
       22
       +
           description = "A simple tool for generating self signed certificates.";

     

       23
       23
       +
           longDescription = ''

     

       24
       24
       +
             Minica is a simple CA intended for use in situations where the CA

     

       25
       25
       +
             operator also operates each host where a certificate will be used. It

     

       26
       26
       +
             automatically generates both a key and a certificate when asked to

     

       27
       27
       +
             produce a certificate.

     

       28
       28
       +
           '';

     

       29
       29
       +
           homepage = "https://github.com/jsha/minica/";

     

       30
       30
       +
           license = licenses.mit;

     

       31
       31
       +
           maintainers = with maintainers; [ m1cr0man ];

     

       32
       32
       +
           platforms = platforms.linux ++ platforms.darwin;

     

       33
       33
       +
         };

     

       34
       34
       +
       }

pkgs/top-level/all-packages.nix

···

       4959
       4959
        
       

     

       4960
       4960
        
         minergate-cli = callPackage ../applications/misc/minergate-cli { };

     

       4961
       4961
        
       

     

       4962
       4962
       +
         minica = callPackage ../tools/security/minica { };

     

       4963
       4963
       +
       

     

       4962
       4964
        
         minidlna = callPackage ../tools/networking/minidlna { };

     

       4963
       4965
        
       

     

       4964
       4966
        
         minisign = callPackage ../tools/security/minisign { };