gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/step-ca: nixfmt + add Python syntax hint

Browse Source 
Helps when writing & using a editor with tree-sitter support
This commit is contained in:
โทสฺตัล
2025-02-24 15:06:34 +07:00
parent 40f58bffcb
commit 2281c12585
1 changed files with 72 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/tests/step-ca.nix
+72 -61
View File
@@ -1,4 +1,5 @@
import ./make-test-python.nix ({ pkgs, ... }:
import ./make-test-python.nix (
{ pkgs, ... }:
let
test-certificates = pkgs.runCommandLocal "test-certificates" { } ''
mkdir -p $out
@@ -10,83 +11,93 @@ import ./make-test-python.nix ({ pkgs, ... }:
in
{
name = "step-ca";
nodes =
{
caserver =
{ config, pkgs, ... }: {
environment.etc.password-file.source = "${test-certificates}/intermediate-password-file";
services.step-ca = {
enable = true;
address = "[::]";
port = 8443;
openFirewall = true;
intermediatePasswordFile = "/etc/${config.environment.etc.password-file.target}";
settings = {
dnsNames = [ "caserver" ];
root = "${test-certificates}/root_ca.crt";
crt = "${test-certificates}/intermediate_ca.crt";
key = "${test-certificates}/intermediate_ca.key";
db = {
type = "badger";
dataSource = "/var/lib/step-ca/db";
};
authority = {
provisioners = [
{
type = "ACME";
name = "acme";
}
];
};
nodes = {
caserver =
{ config, pkgs, ... }:
{
environment.etc.password-file.source = "${test-certificates}/intermediate-password-file";
services.step-ca = {
enable = true;
address = "[::]";
port = 8443;
openFirewall = true;
intermediatePasswordFile = "/etc/${config.environment.etc.password-file.target}";
settings = {
dnsNames = [ "caserver" ];
root = "${test-certificates}/root_ca.crt";
crt = "${test-certificates}/intermediate_ca.crt";
key = "${test-certificates}/intermediate_ca.key";
db = {
type = "badger";
dataSource = "/var/lib/step-ca/db";
};
authority = {
provisioners = [
{
type = "ACME";
name = "acme";
}
];
};
};
};
};
caclient =
{ config, pkgs, ... }: {
security.acme.defaults.server = "https://caserver:8443/acme/acme/directory";
security.acme.defaults.email = "root@example.org";
security.acme.acceptTerms = true;
caclient =
{ config, pkgs, ... }:
{
security.acme.defaults.server = "https://caserver:8443/acme/acme/directory";
security.acme.defaults.email = "root@example.org";
security.acme.acceptTerms = true;
security.pki.certificateFiles = [ "${test-certificates}/root_ca.crt" ];
security.pki.certificateFiles = [ "${test-certificates}/root_ca.crt" ];
networking.firewall.allowedTCPPorts = [ 80 443 ];
networking.firewall.allowedTCPPorts = [
80
443
];
services.nginx = {
enable = true;
virtualHosts = {
"caclient" = {
forceSSL = true;
enableACME = true;
};
services.nginx = {
enable = true;
virtualHosts = {
"caclient" = {
forceSSL = true;
enableACME = true;
};
};
};
};
caclientcaddy =
{ config, pkgs, ... }: {
security.pki.certificateFiles = [ "${test-certificates}/root_ca.crt" ];
caclientcaddy =
{ config, pkgs, ... }:
{
security.pki.certificateFiles = [ "${test-certificates}/root_ca.crt" ];
networking.firewall.allowedTCPPorts = [ 80 443 ];
networking.firewall.allowedTCPPorts = [
80
443
];
services.caddy = {
enable = true;
virtualHosts."caclientcaddy".extraConfig = ''
respond "Welcome to Caddy!"
services.caddy = {
enable = true;
virtualHosts."caclientcaddy".extraConfig = ''
respond "Welcome to Caddy!"
tls caddy@example.org {
ca https://caserver:8443/acme/acme/directory
}
'';
};
tls caddy@example.org {
ca https://caserver:8443/acme/acme/directory
}
'';
};
};
catester = { config, pkgs, ... }: {
catester =
{ config, pkgs, ... }:
{
security.pki.certificateFiles = [ "${test-certificates}/root_ca.crt" ];
};
};
};
testScript =
testScript = # python
''
catester.start()
caserver.wait_for_unit("step-ca.service")
@@ -96,10 +107,10 @@ import ./make-test-python.nix ({ pkgs, ... }:
catester.succeed("curl https://caclient/ | grep \"Welcome to nginx!\"")
caclientcaddy.wait_for_unit("caddy.service")
# It's hard to know when caddy has finished the ACME
# dance with step-ca, so we keep trying to curl
# until succeess.
catester.wait_until_succeeds("curl https://caclientcaddy/ | grep \"Welcome to Caddy!\"")
'';
})
}
)