Something went wrong. Try again.
What happens if I push all of nixpkgs
Something went wrong. Try again.
Nix
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154import ./make-test-python.nix ( { pkgs, ... }: let test-certificates = pkgs.runCommandLocal "test-certificates" { } '' mkdir -p $out echo insecure-root-password > $out/root-password-file echo insecure-intermediate-password > $out/intermediate-password-file ${pkgs.step-cli}/bin/step certificate create "Example Root CA" $out/root_ca.crt $out/root_ca.key --password-file=$out/root-password-file --profile root-ca ${pkgs.step-cli}/bin/step certificate create "Example Intermediate CA 1" $out/intermediate_ca.crt $out/intermediate_ca.key --password-file=$out/intermediate-password-file --ca-password-file=$out/root-password-file --profile intermediate-ca --ca $out/root_ca.crt --ca-key $out/root_ca.key ''; in { name = "step-ca"; nodes = { caserver = { config, pkgs, ... }: { environment.etc.password-file.source = "${test-certificates}/intermediate-password-file"; services.step-ca = { enable = true; address = "[::]"; port = 8443; openFirewall = true; intermediatePasswordFile = "/etc/${config.environment.etc.password-file.target}"; settings = { dnsNames = [ "caserver" ]; root = "${test-certificates}/root_ca.crt"; crt = "${test-certificates}/intermediate_ca.crt"; key = "${test-certificates}/intermediate_ca.key"; db = { type = "badger"; dataSource = "/var/lib/step-ca/db"; }; authority = { provisioners = [ { type = "ACME"; name = "acme"; } ]; }; }; }; };
caclient = { config, pkgs, ... }: { security.acme.defaults.server = "https://caserver:8443/acme/acme/directory"; security.acme.defaults.email = "root@example.org"; security.acme.acceptTerms = true;
security.pki.certificateFiles = [ "${test-certificates}/root_ca.crt" ];
networking.firewall.allowedTCPPorts = [ 80 443 ];
services.nginx = { enable = true; virtualHosts = { "caclient" = { forceSSL = true; enableACME = true; }; }; }; };
caclientcaddy = { config, pkgs, ... }: { security.pki.certificateFiles = [ "${test-certificates}/root_ca.crt" ];
networking.firewall.allowedTCPPorts = [ 80 443 ];
services.caddy = { enable = true; virtualHosts."caclientcaddy".extraConfig = '' respond "Welcome to Caddy!"
tls caddy@example.org { ca https://caserver:8443/acme/acme/directory } ''; }; };
caclienth2o = { config, pkgs, ... }: { security.acme = { acceptTerms = true; defaults = { server = "https://caserver:8443/acme/acme/directory"; email = "root@example.org"; }; }; security.pki.certificateFiles = [ "${test-certificates}/root_ca.crt" ];
networking.firewall.allowedTCPPorts = [ 80 443 ];
services.h2o = { enable = true; hosts."caclienth2o" = { tls.policy = "force"; acme.enable = true; settings = { paths."/" = { "file.file" = "${pkgs.writeTextFile { name = "h2o_welcome.txt"; text = "Welcome to H2O!"; }}"; }; }; }; }; };
catester = { config, pkgs, ... }: { security.pki.certificateFiles = [ "${test-certificates}/root_ca.crt" ]; }; };
testScript = # python '' catester.start() caserver.wait_for_unit("step-ca.service") caserver.wait_until_succeeds("journalctl -o cat -u step-ca.service | grep '${pkgs.step-ca.version}'")
caclient.wait_for_unit("acme-finished-caclient.target") catester.succeed("curl https://caclient/ | grep \"Welcome to nginx!\"")
caclientcaddy.wait_for_unit("caddy.service") # It’s hard to know when Caddy has finished the ACME dance with # step-ca, so we keep trying cURL until success. catester.wait_until_succeeds("curl https://caclientcaddy/ | grep \"Welcome to Caddy!\"")
caclienth2o.wait_for_unit("acme-finished-caclienth2o.target") caclienth2o.wait_for_unit("h2o.service") catester.succeed("curl https://caclienth2o/ | grep \"Welcome to H2O!\"") ''; })