From e5fc654f50e2b99bcae186962b29c8754f382f3b Mon Sep 17 00:00:00 2001
From: lassulus <lassulus@lassul.us>
Date: Thu, 9 Dec 2021 11:21:06 +0100
Subject: add ACME ca via ca.r

---
 .../generate-krebs-intermediate-ca/default.nix     | 29 ++++++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 krebs/5pkgs/simple/generate-krebs-intermediate-ca/default.nix

(limited to 'krebs/5pkgs/simple/generate-krebs-intermediate-ca/default.nix')

diff --git a/krebs/5pkgs/simple/generate-krebs-intermediate-ca/default.nix b/krebs/5pkgs/simple/generate-krebs-intermediate-ca/default.nix
new file mode 100644
index 00000000..8cec5432
--- /dev/null
+++ b/krebs/5pkgs/simple/generate-krebs-intermediate-ca/default.nix
@@ -0,0 +1,29 @@
+{ pkgs }:
+pkgs.writers.writeDashBin "generate-intermediate-ca" ''
+  TMPDIR=$(mktemp -d)
+  trap "rm -rf $TMPDIR;" INT TERM EXIT
+  mkdir -p "$TMPDIR/krebs"
+  brain show ca/ca.key > "$TMPDIR/krebs/ca.key"
+  brain show ca/ca.crt > "$TMPDIR/krebs/ca.crt"
+  export STEPPATH="$TMPDIR/step"
+  cat << EOF > "$TMPDIR/intermediate.tpl"
+  {
+      "subject": {{ toJson .Subject }},
+      "keyUsage": ["certSign", "crlSign"],
+      "basicConstraints": {
+          "isCA": true,
+          "maxPathLen": 0
+      },
+      "nameConstraints": {
+          "critical": true,
+          "permittedDNSDomains": ["r" ,"w"]
+      }
+  }
+  EOF
+
+  ${pkgs.step-cli}/bin/step certificate create "Krebs ACME CA" intermediate_ca.crt intermediate_ca.key \
+    --template "$TMPDIR/intermediate.tpl" \
+    --ca "$TMPDIR/krebs/ca.crt" \
+    --ca-key "$TMPDIR/krebs/ca.key" \
+    --no-password --insecure
+''
-- 
cgit v1.2.3