From f940a179053e54de0d46aada5b42502f7563f45f Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 20 Apr 2019 18:54:58 +0200
Subject: tv pki: immigrate certificate environment

---
 tv/2configs/pki/default.nix | 14 ++++++++++++++
 1 file changed, 14 insertions(+)
 create mode 100644 tv/2configs/pki/default.nix

(limited to 'tv/2configs/pki')

diff --git a/tv/2configs/pki/default.nix b/tv/2configs/pki/default.nix
new file mode 100644
index 00000000..f22b9a6d
--- /dev/null
+++ b/tv/2configs/pki/default.nix
@@ -0,0 +1,14 @@
+with import <stockholm/lib>;
+{ config, ... }: let
+
+  certFile = config.environment.etc."ssl/certs/ca-certificates.crt".source;
+
+in {
+
+  environment.variables = flip genAttrs (_: toString certFile) [
+    "CURL_CA_BUNDLE"
+    "GIT_SSL_CAINFO"
+    "SSL_CERT_FILE"
+  ];
+
+}
-- 
cgit v1.2.3


From 325119c2834610cb6840e116d79963d2c23cdc8a Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 21 Apr 2019 09:19:37 +0200
Subject: tv pki: import custom certificates

---
 tv/2configs/pki/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'tv/2configs/pki')

diff --git a/tv/2configs/pki/default.nix b/tv/2configs/pki/default.nix
index f22b9a6d..9e7f4763 100644
--- a/tv/2configs/pki/default.nix
+++ b/tv/2configs/pki/default.nix
@@ -11,4 +11,10 @@ in {
     "SSL_CERT_FILE"
   ];
 
+  security.pki.certificateFiles =
+    mapAttrsToList
+      (name: const (./certs + "/${name}"))
+      (filterAttrs (const (eq "regular"))
+                   (readDir ./certs));
+
 }
-- 
cgit v1.2.3


From c46803f244b15817f066f294ef47c9f400ab09c0 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sun, 21 Apr 2019 09:20:36 +0200
Subject: tv pki: add tv Root CA

---
 tv/2configs/pki/certs/tv.crt | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 tv/2configs/pki/certs/tv.crt

(limited to 'tv/2configs/pki')

diff --git a/tv/2configs/pki/certs/tv.crt b/tv/2configs/pki/certs/tv.crt
new file mode 100644
index 00000000..ccb2623f
--- /dev/null
+++ b/tv/2configs/pki/certs/tv.crt
@@ -0,0 +1,31 @@
+tv Root CA
+-----BEGIN CERTIFICATE-----
+MIIFGzCCAwOgAwIBAgIUbLFkDA1OgKbej/FQiJZ4gpGPg/4wDQYJKoZIhvcNAQEL
+BQAwFTETMBEGA1UEAwwKdHYgUm9vdCBDQTAeFw0xOTA0MjEwNzI1MTdaFw0yOTA0
+MTgwNzI1MTdaMBUxEzARBgNVBAMMCnR2IFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEB
+AQUAA4ICDwAwggIKAoICAQDEVpZo1PLayK2AULwNtRY/2RIs/h+Uz1k/I7AY5o7H
+HTD6pxNH3DZS82Y89nAHDVEnotK26TW6N1O2fBHUxH2GXVD+MaA/D9ngbNTJa7DW
+2EThezOyesAbXk7dkoHh4Bouj5L7Ronka5+IREFmb3mHmcXLuR/sot9Pwr9A7Lwm
+55Avv+VwMFnqVMXiCYQsDL7Mxf7Vm79+kXShpfDhNmHhyZc/xPjVk7lttSEp0LCq
+hhJjte3xDGbk7OThTSxoqP+K4Ek7NGatCcm4AUZlDl1kLN2QKudYqj0VRQpfE+4Q
+jMAAtttc/10MV0e08pRK0FvJsDsi70YZrHnDP6hIBrRNjC8iB/8rz2pjnYzgriUt
+HHEDr26234VB5Zqhsi8pmXA16FVkoKlucADXXKEcR/3VreTvZLdSsP3OrDdSCwhi
+H2W/7tshDPp+I9Q9fGNixry7PODbud1h/wLsq3Geg/U6VkDdl7uDNMB/O7LvlFaC
+7jkHv/xFLqV1Xx9+yFMdJTKLf9jnIIjeINfV4VcJZDrtgGpnC6cYD5DNLA4j7Mny
+EnBV9IRhmKiZLvUZP62dPhqIfSSPNxXV2+rT5ZfaXCuVe79R5npgJzF7/qslvnZ6
+0mjZfQdJiXY+/oT9zPUxTroFx7Qtda15aIVwXR+1cMRY/Hg/uBQyp7yWsvwhPYwH
+awIDAQABo2MwYTAdBgNVHQ4EFgQUWYjGpR7J/UqggxQV87hBQ8ZT0qkwHwYDVR0j
+BBgwFoAUWYjGpR7J/UqggxQV87hBQ8ZT0qkwDwYDVR0TAQH/BAUwAwEB/zAOBgNV
+HQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQELBQADggIBAA++eAA7KLEd4n05n8w95sJ7
+cxqQSkVxV3ASnEUQRwVGo3CqEKcNufbCTG7KKGQFUi2Xd3/SWgnEiSZZWo06azbV
+vlquG+9ilwnrnqfjlbUEjLMHDzukrEeIiRuFY7gZv6S2o4WkW/M9IPkP34+PRjip
+AJ8kFcy7wLPaeH7OagslAVUcf68lMm+8W4U1g0HZaY2zXFgdRrIO1dXKlJ22Wh4X
+fcblHjkASAGi+BK+xRJ9G7s3sie2wPyk+WKKv0Z+WheKf+L+TPBg2sJ+d25gW+gG
+XNJSQOzCqSfHrCtcW1xkGgifog28/ymN03ggn8oMBUebOp+ayLkbPQDaj6te3y1v
+YE0cfkzQ0T6sSzPzoOrwBEuSX8cLWTpzO2Zgqbf36UtHjgxi58vY46p7MjAInxAf
+j+k67rF7qWH38drg4nfGjNgiEdeJw9dtDFdmso+ZiWipUyGF4VYh+Q6JnXDMF0+A
+wXcYWa7ckXvVOLVpHJfrLDYTXznGnk2u4ToVNEk1j/klMRn96lxfFg04iv8fz8m6
+/Y8g0G1uIT5Mq9l68oZUoEkUHZabPNhYOiYtg4t5v/T3AIV8nm2A5jZYj0am26xT
+iqF/tqL3alWXs9OHP7FNdrVWtwO8vcspYcd4mOHdAC/dmhq+77BowR5Lldx9T+mR
+QT8jW9PXL0IH0wKMBXxf
+-----END CERTIFICATE-----
-- 
cgit v1.2.3


From c195713bc283d2a378f4c5c23d57df9d222add48 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Tue, 23 Apr 2019 19:57:23 +0200
Subject: tv pki: generate global nssdb

---
 tv/2configs/pki/default.nix | 50 ++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 49 insertions(+), 1 deletion(-)

(limited to 'tv/2configs/pki')

diff --git a/tv/2configs/pki/default.nix b/tv/2configs/pki/default.nix
index 9e7f4763..51a5c716 100644
--- a/tv/2configs/pki/default.nix
+++ b/tv/2configs/pki/default.nix
@@ -1,10 +1,58 @@
 with import <stockholm/lib>;
-{ config, ... }: let
+{ config, pkgs, ... }: let
 
   certFile = config.environment.etc."ssl/certs/ca-certificates.crt".source;
 
 in {
 
+  environment.etc."pki/nssdb".source =
+    pkgs.runCommand "system-wide-nssdb" {
+      inherit certFile;
+      buildInputs = [
+        pkgs.jq
+        pkgs.nssTools
+      ];
+      parseInfoScript = /* jq */ ''
+        ${toJSON certFile} as $certFile |
+
+        split("\t-----END CERTIFICATE-----\n")[] |
+        select(test("\t-----BEGIN CERTIFICATE-----\n")) |
+        . + "\t-----END CERTIFICATE-----\n" |
+
+        sub("^([0-9]+\t\n)*";"") |
+
+        (match("^([0-9]+)\t").captures[0].string | tonumber) as $lineNumber |
+
+        gsub("(?m)^[0-9]+\t";"") |
+
+        match("^([^\n]+)\n(.*)";"m").captures | map(.string) |
+
+        # Line numbers are added to the names to ensure uniqueness.
+        "\(.[0]) (\($certFile):\($lineNumber))" as $name |
+        .[1] as $cert |
+
+        { $name, $cert }
+      '';
+      passAsFile = [
+        "parseInfoScript"
+      ];
+    } /* sh */ ''
+      mkdir nssdb
+
+      nl -ba -w1 "$certFile" |
+      jq -ceRs -f "$parseInfoScriptPath" > certinfo.ndjson
+
+      exec < certinfo.ndjson
+      while read -r certinfo; do
+        name=$(printf %s "$certinfo" | jq -er .name)
+        cert=$(printf %s "$certinfo" | jq -er .cert)
+
+        printf %s "$cert" | certutil -A -d nssdb -n "$name" -t C,C,C
+      done
+
+      mv nssdb "$out"
+    '';
+
   environment.variables = flip genAttrs (_: toString certFile) [
     "CURL_CA_BUNDLE"
     "GIT_SSL_CAINFO"
-- 
cgit v1.2.3