commit dad06fb922cbfcd00bae255d3fec9d70138e419b · pyrox.dev/nixpkgs

+21

nixos/tests/common/acme/server/README.md

···

       1
       +
       # Fake Certificate Authority for ACME testing

     

       2
       +
       

     

       3
       +
       This will set up a test node running [pebble](https://github.com/letsencrypt/pebble)

     

       4
       +
       to serve ACME certificate requests.

     

       5
       +
       

     

       6
       +
       ## "Snake oil" certs

     

       7
       +
       

     

       8
       +
       The snake oil certs are hard coded into the repo for reasons explained [here](https://github.com/NixOS/nixpkgs/pull/91121#discussion_r505410235).

     

       9
       +
       The root of the issue is that Nix will hash the derivation based on the arguments

     

       10
       +
       to mkDerivation, not the output. [Minica](https://github.com/jsha/minica) will

     

       11
       +
       always generate a random certificate even if the arguments are unchanged. As a

     

       12
       +
       result, it's possible to end up in a situation where the cached and local

     

       13
       +
       generated certs mismatch and cause issues with testing.

     

       14
       +
       

     

       15
       +
       To generate new certificates, run the following commands:

     

       16
       +
       

     

       17
       +
       ```bash

     

       18
       +
       nix-build generate-certs.nix

     

       19
       +
       cp result/* .

     

       20
       +
       rm result

     

       21
       +
       ```

+19

nixos/tests/common/acme/server/acme.test.cert.pem

···

       1
       +
       -----BEGIN CERTIFICATE-----

     

       2
       +
       MIIDLDCCAhSgAwIBAgIIRDAN3FHH//IwDQYJKoZIhvcNAQELBQAwIDEeMBwGA1UE

     

       3
       +
       AxMVbWluaWNhIHJvb3QgY2EgNzg3NDZmMB4XDTIwMTAyMTEzMjgzNloXDTIyMTEy

     

       4
       +
       MDEzMjgzNlowFDESMBAGA1UEAxMJYWNtZS50ZXN0MIIBIjANBgkqhkiG9w0BAQEF

     

       5
       +
       AAOCAQ8AMIIBCgKCAQEAo8XjMVUaljcaqQ5MFhfPuQgSwdyXEUbpSHz+5yPkE0h9

     

       6
       +
       Z4Xu5BJF1Oq7h5ggCtadVsIspiY6Jm6aWDOjlh4myzW5UNBNUG3OPEk50vmmHFeH

     

       7
       +
       pImHO/d8yb33QoF9VRcTZs4tuJYg7l9bSs4jNG72vYvv2YiGAcmjJcsmAZIfniCN

     

       8
       +
       Xf/LjIm+Cxykn+Vo3UuzO1w5/iuofdgWO/aZxMezmXUivlL3ih4cNzCJei8WlB/l

     

       9
       +
       EnHrkcy3ogRmmynP5zcz7vmGIJX2ji6dhCa4Got5B7eZK76o2QglhQXqPatG0AOY

     

       10
       +
       H+RfQfzKemqPG5om9MgJtwFtTOU1LoaiBw//jXKESQIDAQABo3YwdDAOBgNVHQ8B

     

       11
       +
       Af8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB

     

       12
       +
       /wQCMAAwHwYDVR0jBBgwFoAU+8IZlLV/Qp5CXqpXMLvtxWlxcJwwFAYDVR0RBA0w

     

       13
       +
       C4IJYWNtZS50ZXN0MA0GCSqGSIb3DQEBCwUAA4IBAQB0pe8I5/VDkB5VMgQB2GJV

     

       14
       +
       GKzyigfWbVez9uLmqMj9PPP/zzYKSYeq+91aMuOZrnH7NqBxSTwanULkmqAmhbJJ

     

       15
       +
       YkXw+FlFekf9FyxcuArzwzzNZDSGcjcdXpN8S2K1qkBd00iSJF9kU7pdZYCIKR20

     

       16
       +
       QirdBrELEfsJ3GU62a6N3a2YsrisZUvq5TbjGJDcytAtt+WG3gmV7RInLdFfPwbw

     

       17
       +
       bEHPCnx0uiV0nxLjd/aVT+RceVrFQVt4hR99jLoMlBitSKluZ1ljsrpIyroBhQT0

     

       18
       +
       pp/pVi6HJdijG0fsPrC325NEGAwcpotLUhczoeM/rffKJd54wLhDkfYxOyRZXivs

     

       19
       +
       -----END CERTIFICATE-----

+27

nixos/tests/common/acme/server/acme.test.key.pem

···

       1
       +
       -----BEGIN RSA PRIVATE KEY-----

     

       2
       +
       MIIEowIBAAKCAQEAo8XjMVUaljcaqQ5MFhfPuQgSwdyXEUbpSHz+5yPkE0h9Z4Xu

     

       3
       +
       5BJF1Oq7h5ggCtadVsIspiY6Jm6aWDOjlh4myzW5UNBNUG3OPEk50vmmHFeHpImH

     

       4
       +
       O/d8yb33QoF9VRcTZs4tuJYg7l9bSs4jNG72vYvv2YiGAcmjJcsmAZIfniCNXf/L

     

       5
       +
       jIm+Cxykn+Vo3UuzO1w5/iuofdgWO/aZxMezmXUivlL3ih4cNzCJei8WlB/lEnHr

     

       6
       +
       kcy3ogRmmynP5zcz7vmGIJX2ji6dhCa4Got5B7eZK76o2QglhQXqPatG0AOYH+Rf

     

       7
       +
       QfzKemqPG5om9MgJtwFtTOU1LoaiBw//jXKESQIDAQABAoIBADox/2FwVFo8ioS4

     

       8
       +
       R+Ex5OZjMAcjU6sX/516jTmlT05q2+UFerYgqB/YqXqtW/V9/brulN8VhmRRuRbO

     

       9
       +
       grq9TBu5o3hMDK0f18EkZB/MBnLbx594H033y6gEkPBZAyhRYtuNOEH3VwxdZhtW

     

       10
       +
       1Lu1EoiYSUqLcNMBy6+KWJ8GRaXyacMYBlj2lMHmyzkA/t1+2mwTGC3lT6zN0F5Y

     

       11
       +
       E5umXOxsn6Tb6q3KM9O5IvtmMMKpgj4HIHZLZ6j40nNgHwGRaAv4Sha/vx0DeBw3

     

       12
       +
       6VlNiTTPdShEkhESlM5/ocqTfI92VHJpM5gkqTYOWBi2aKIPfAopXoqoJdWl4pQ/

     

       13
       +
       NCFIu2ECgYEAzntNKIcQtf0ewe0/POo07SIFirvz6jVtYNMTzeQfL6CoEjYArJeu

     

       14
       +
       Vzc4wEQfA4ZFVerBb1/O6M449gI3zex1PH4AX0h8q8DSjrppK1Jt2TnpVh97k7Gg

     

       15
       +
       Tnat/M/yW3lWYkcMVJJ3AYurXLFTT1dYP0HvBwZN04yInrEcPNXKfmcCgYEAywyJ

     

       16
       +
       51d4AE94PrANathKqSI/gk8sP+L1gzylZCcUEAiGk/1r45iYB4HN2gvWbS+CvSdp

     

       17
       +
       F7ShlDWrTaNh2Bm1dgTjc4pWb4J+CPy/KN2sgLwIuM4+ZWIZmEDcio6khrM/gNqK

     

       18
       +
       aR7xUsvWsqU26O84woY/xR8IHjSNF7cFWE1H2c8CgYEAt6SSi2kVQ8dMg84uYE8t

     

       19
       +
       o3qO00U3OycpkOQqyQQLeKC62veMwfRl6swCfX4Y11mkcTXJtPTRYd2Ia8StPUkB

     

       20
       +
       PDwUuKoPt/JXUvoYb59wc7M+BIsbrdBdc2u6cw+/zfutCNuH6/AYSBeg4WAVaIuW

     

       21
       +
       wSwzG1xP+8cR+5IqOzEqWCECgYATweeVTCyQEyuHJghYMi2poXx+iIesu7/aAkex

     

       22
       +
       pB/Oo5W8xrb90XZRnK7UHbzCqRHWqAQQ23Gxgztk9ZXqui2vCzC6qGZauV7cLwPG

     

       23
       +
       zTMg36sVmHP314DYEM+k59ZYiQ6P0jQPoIQo407D2VGrfsOOIhQIcUmP7tsfyJ5L

     

       24
       +
       hlGMfwKBgGq4VNnnuX8I5kl03NpaKfG+M8jEHmVwtI9RkPTCCX9bMjeG0cDxqPTF

     

       25
       +
       TRkf3r8UWQTZ5QfAfAXYAOlZvmGhHjSembRbXMrMdi3rGsYRSrQL6n5NHnORUaMy

     

       26
       +
       FCWo4gyAnniry7tx9dVNgmHmbjEHuQnf8AC1r3dibRCjvJWUiQ8H

     

       27
       +
       -----END RSA PRIVATE KEY-----

+20

nixos/tests/common/acme/server/ca.cert.pem

···

       1
       +
       -----BEGIN CERTIFICATE-----

     

       2
       +
       MIIDSzCCAjOgAwIBAgIIeHRvRrNvbGQwDQYJKoZIhvcNAQELBQAwIDEeMBwGA1UE

     

       3
       +
       AxMVbWluaWNhIHJvb3QgY2EgNzg3NDZmMCAXDTIwMTAyMTEzMjgzNloYDzIxMjAx

     

       4
       +
       MDIxMTMyODM2WjAgMR4wHAYDVQQDExVtaW5pY2Egcm9vdCBjYSA3ODc0NmYwggEi

     

       5
       +
       MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCrNTzVLDJOKtGYGLU98EEcLKps

     

       6
       +
       tXHCLC6G54LKbEcU80fn+ArX8qsPSHyhdXQkcYjq6Vh/EDJ1TctyRSnvAjwyG4Aa

     

       7
       +
       1Zy1QFc/JnjMjvzimCkUc9lQ+wkLwHSM/KGwR1cGjmtQ/EMClZTA0NwulJsXMKVz

     

       8
       +
       bd5asXbq/yJTQ5Ww25HtdNjwRQXTvB7r3IKcY+DsED9CvFvC9oG/ZhtZqZuyyRdC

     

       9
       +
       kFUrrv8WNUDkWSN+lMR6xMx8v0583IN6f11IhX0b+svK98G81B2eswBdkzvVyv9M

     

       10
       +
       unZBO0JuJG8sdM502KhWLmzBC1ZbvgUBF9BumDRpMFH4DCj7+qQ2taWeGyc7AgMB

     

       11
       +
       AAGjgYYwgYMwDgYDVR0PAQH/BAQDAgKEMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggr

     

       12
       +
       BgEFBQcDAjASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBT7whmUtX9CnkJe

     

       13
       +
       qlcwu+3FaXFwnDAfBgNVHSMEGDAWgBT7whmUtX9CnkJeqlcwu+3FaXFwnDANBgkq

     

       14
       +
       hkiG9w0BAQsFAAOCAQEARMe1wKmF33GjEoLLw0oDDS4EdAv26BzCwtrlljsEtwQN

     

       15
       +
       95oSzUNd6o4Js7WCG2o543OX6cxzM+yju8TES3+vJKDgsbNMU0bWCv//tdrb0/G8

     

       16
       +
       OkU3Kfi5q4fOauZ1pqGv/pXdfYhZ5ieB/zwis3ykANe5JfB0XqwCb1Vd0C3UCIS2

     

       17
       +
       NPKngRwNSzphIsbzfvxGDkdM1enuGl5CVyDhrwTMqGaJGDSOv6U5jKFxKRvigqTN

     

       18
       +
       Ls9lPmT5NXYETduWLBR3yUIdH6kZXrcozZ02B9vjOB2Cv4RMDc+9eM30CLIWpf1I

     

       19
       +
       097e7JkhzxFhfC/bMMt3P1FeQc+fwH91wdBmNi7tQw==

     

       20
       +
       -----END CERTIFICATE-----

+27

nixos/tests/common/acme/server/ca.key.pem

···

       1
       +
       -----BEGIN RSA PRIVATE KEY-----

     

       2
       +
       MIIEowIBAAKCAQEAqzU81SwyTirRmBi1PfBBHCyqbLVxwiwuhueCymxHFPNH5/gK

     

       3
       +
       1/KrD0h8oXV0JHGI6ulYfxAydU3LckUp7wI8MhuAGtWctUBXPyZ4zI784pgpFHPZ

     

       4
       +
       UPsJC8B0jPyhsEdXBo5rUPxDApWUwNDcLpSbFzClc23eWrF26v8iU0OVsNuR7XTY

     

       5
       +
       8EUF07we69yCnGPg7BA/QrxbwvaBv2YbWambsskXQpBVK67/FjVA5FkjfpTEesTM

     

       6
       +
       fL9OfNyDen9dSIV9G/rLyvfBvNQdnrMAXZM71cr/TLp2QTtCbiRvLHTOdNioVi5s

     

       7
       +
       wQtWW74FARfQbpg0aTBR+Awo+/qkNrWlnhsnOwIDAQABAoIBAA3ykVkgd5ysmlSU

     

       8
       +
       trcsCnHcJaojgff6l3PACoSpG4VWaGY6a8+54julgRm6MtMBONFCX0ZCsImj484U

     

       9
       +
       Wl0xRmwil2YYPuL5MeJgJPktMObY1IfpBCw3tz3w2M3fiuCMf0d2dMGtO1xLiUnH

     

       10
       +
       +hgFXTkfamsj6ThkOrbcQBSebeRxbKM5hqyCaQoieV+0IJnyxUVq/apib8N50VsH

     

       11
       +
       SHd4oqLUuEZgg6N70+l5DpzedJUb4nrwS/KhUHUBgnoPItYBCiGPmrwLk7fUhPs6

     

       12
       +
       kTDqJDtc/xW/JbjmzhWEpVvtumcC/OEKULss7HLdeQqwVBrRQkznb0M9AnSra3d0

     

       13
       +
       X11/Y4ECgYEA3FC8SquLPFb2lHK4+YbJ4Ac6QVWeYFEHiZ0Rj+CmONmjcAvOGLPE

     

       14
       +
       SblRLm3Nbrkxbm8FF6/AfXa/rviAKEVPs5xqGfSDw/3n1uInPcmShiBCLwM/jHH5

     

       15
       +
       NeVG+R5mTg5zyQ/pQMLWRcs+Ail+ZAnZuoGpW3Cdc8OtCUYFQ7XB6nsCgYEAxvBJ

     

       16
       +
       zFxcTtsDzWbMWXejugQiUqJcEbKWwEfkRbf3J2rAVO2+EFr7LxdRfN2VwPiTQcWc

     

       17
       +
       LnN2QN+ouOjqBMTh3qm5oQY+TLLHy86k9g1k0gXWkMRQgP2ZdfWH1HyrwjLUgLe1

     

       18
       +
       VezFN7N1azgy6xFkInAAvuA4loxElZNvkGBgekECgYA/Xw26ILvNIGqO6qzgQXAh

     

       19
       +
       +5I7JsiGheg4IjDiBMlrQtbrLMoceuD0H9UFGNplhel9DXwWgxxIOncKejpK2x0A

     

       20
       +
       2fX+/0FDh+4+9hA5ipiV8gN3iGSoHkSDxy5yC9d7jlapt+TtFt4Rd1OfxZWwatDw

     

       21
       +
       /8jaH3t6yAcmyrhK8KYVrwKBgAE5KwsBqmOlvyE9N5Z5QN189wUREIXfVkP6bTHs

     

       22
       +
       jq2EX4hmKdwJ4y+H8i1VY31bSfSGlY5HkXuWpH/2lrHO0CDBZG3UDwADvWzIaYVF

     

       23
       +
       0c/kz0v2mRQh+xaZmus4lQnNrDbaalgL666LAPbW0qFVaws3KxoBYPe0BxvwWyhF

     

       24
       +
       H3LBAoGBAKRRNsq2pWQ8Gqxc0rVoH0FlexU9U2ci3lsLmgEB0A/o/kQkSyAxaRM+

     

       25
       +
       VdKp3sWfO8o8lX5CVQslCNBSjDTNcat3Co4NEBLg6Xv1yKN/WN1GhusnchP9szsP

     

       26
       +
       oU47gC89QhUyWSd6vvr2z2NG9C3cACxe4dhDSHQcE4nHSldzCKv2

     

       27
       +
       -----END RSA PRIVATE KEY-----

+1 -4

nixos/tests/common/acme/server/default.nix

···

       51
        
       # that it has to be started _before_ the ACME service.

     

       52
        
       { config, pkgs, lib, ... }:

     

       53
        
       let

     

       54
       -
         testCerts = import ./snakeoil-certs.nix {

     

       55
       -
           minica = pkgs.minica;

     

       56
       -
           mkDerivation = pkgs.stdenv.mkDerivation;

     

       57
       -
         };

     

       58
        
         domain = testCerts.domain;

     

       59
        
       

     

       60
        
         resolver = let

···

       51
        
       # that it has to be started _before_ the ACME service.

     

       52
        
       { config, pkgs, lib, ... }:

     

       53
        
       let

     

       54
       +
         testCerts = import ./snakeoil-certs.nix;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       55
        
         domain = testCerts.domain;

     

       56
        
       

     

       57
        
         resolver = let

+29

nixos/tests/common/acme/server/generate-certs.nix

···

       1
       +
       # Minica can provide a CA key and cert, plus a key

     

       2
       +
       # and cert for our fake CA server's Web Front End (WFE).

     

       3
       +
       {

     

       4
       +
         pkgs ? import <nixpkgs> {},

     

       5
       +
         minica ? pkgs.minica,

     

       6
       +
         mkDerivation ? pkgs.stdenv.mkDerivation

     

       7
       +
       }:

     

       8
       +
       let

     

       9
       +
         conf = import ./snakeoil-certs.nix;

     

       10
       +
         domain = conf.domain;

     

       11
       +
       in mkDerivation {

     

       12
       +
         name = "test-certs";

     

       13
       +
         buildInputs = [ minica ];

     

       14
       +
         phases = [ "buildPhase" "installPhase" ];

     

       15
       +
       

     

       16
       +
         buildPhase = ''

     

       17
       +
           minica \

     

       18
       +
             --ca-key ca.key.pem \

     

       19
       +
             --ca-cert ca.cert.pem \

     

       20
       +
             --domains ${domain}

     

       21
       +
         '';

     

       22
       +
       

     

       23
       +
         installPhase = ''

     

       24
       +
           mkdir -p $out

     

       25
       +
           mv ca.*.pem $out/

     

       26
       +
           mv ${domain}/key.pem $out/${domain}.key.pem

     

       27
       +
           mv ${domain}/cert.pem $out/${domain}.cert.pem

     

       28
       +
         '';

     

       29
       +
       }

+4 -28

nixos/tests/common/acme/server/snakeoil-certs.nix

···

       1
       -
       # Minica can provide a CA key and cert, plus a key

     

       2
       -
       # and cert for our fake CA server's Web Front End (WFE).

     

       3
       -
       { minica, mkDerivation }:

     

       4
        
       let

     

       5
        
         domain = "acme.test";

     

       6
       -
       

     

       7
       -
         selfSignedCertData = mkDerivation {

     

       8
       -
           name = "test-certs";

     

       9
       -
           buildInputs = [ minica ];

     

       10
       -
           phases = [ "buildPhase" "installPhase" ];

     

       11
       -
       

     

       12
       -
           buildPhase = ''

     

       13
       -
             mkdir ca

     

       14
       -
             minica \

     

       15
       -
               --ca-key ca/key.pem \

     

       16
       -
               --ca-cert ca/cert.pem \

     

       17
       -
               --domains ${domain}

     

       18
       -
             chmod 600 ca/*

     

       19
       -
             chmod 640 ${domain}/*.pem

     

       20
       -
           '';

     

       21
       -
       

     

       22
       -
           installPhase = ''

     

       23
       -
             mkdir -p $out

     

       24
       -
             mv ${domain} ca $out/

     

       25
       -
           '';

     

       26
       -
         };

     

       27
        
       in {

     

       28
        
         inherit domain;

     

       29
        
         ca = {

     

       30
       -
           cert = "${selfSignedCertData}/ca/cert.pem";

     

       31
       -
           key = "${selfSignedCertData}/ca/key.pem";

     

       32
        
         };

     

       33
        
         "${domain}" = {

     

       34
       -
           cert = "${selfSignedCertData}/${domain}/cert.pem";

     

       35
       -
           key = "${selfSignedCertData}/${domain}/key.pem";

     

       36
        
         };

     

       37
        
       }

···

       0
        
       
     

       0
        
       
     

       0
        
       
     

       1
        
       let

     

       2
        
         domain = "acme.test";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       3
        
       in {

     

       4
        
         inherit domain;

     

       5
        
         ca = {

     

       6
       +
           cert = ./ca.cert.pem;

     

       7
       +
           key = ./ca.key.pem;

     

       8
        
         };

     

       9
        
         "${domain}" = {

     

       10
       +
           cert = ./. + "/${domain}.cert.pem";

     

       11
       +
           key = ./. + "/${domain}.key.pem";

     

       12
        
         };

     

       13
        
       }