From f5f0b6adccba71a44b55ffda0cf2c0d7177468f2 Mon Sep 17 00:00:00 2001
From: Willy <jemand771@gmx.net>
Date: Wed, 20 Aug 2025 03:14:03 +0200
Subject: [PATCH] nixosTests.certmgr.{command,systemd}: fix tests

first off, since #158167, the test needs to share the module's
service's `StateDirectory` during setup to work properly.

more importantly, certmgr seems to default to the `authsign` endpoint
instead of `sign` ever since its last update in nixpkgs (#271299).
while I would have liked to somehow disable/revert this behaviour,
it wasn't obvious to me how to.

set up the cfssl server to accept a single authentication key, and tell
certmgr to use that for its requests
---
 nixos/tests/certmgr.nix | 30 +++++++++++++++++++++++++++++-
 1 file changed, 29 insertions(+), 1 deletion(-)

diff --git a/nixos/tests/certmgr.nix b/nixos/tests/certmgr.nix
index 1a78e3150d8b..f6ef1b03fcab 100644
--- a/nixos/tests/certmgr.nix
+++ b/nixos/tests/certmgr.nix
@@ -1,6 +1,27 @@
 { runTest, pkgs, ... }:
 
 let
+  authKey = pkgs.writeText "auth-key" "1234ABCD";
+  cfsslConfig = pkgs.writeText "config.json" (
+    builtins.toJSON {
+      # also see `cfssl print-defaults config`
+      auth_keys = {
+        my_key = {
+          type = "standard";
+          key = "file:${authKey}";
+        };
+      };
+      signing = {
+        default = {
+          expiry = "168h";
+          auth_key = "my_key";
+          usages = [
+            "digital signature"
+          ];
+        };
+      };
+    }
+  );
   mkSpec =
     {
       host,
@@ -18,6 +39,7 @@ let
         label = "www_ca";
         profile = "three-month";
         remote = "localhost:8888";
+        auth_key_file = toString authKey;
       };
       certificate = {
         group = "nginx";
@@ -75,7 +97,10 @@ let
             ];
             networking.extraHosts = "127.0.0.1 imp.example.org decl.example.org";
 
-            services.cfssl.enable = true;
+            services.cfssl = {
+              enable = true;
+              configFile = toString cfsslConfig;
+            };
             systemd.services.cfssl.after = [
               "cfssl-init.service"
               "networking.target"
@@ -90,6 +115,9 @@ let
                 User = "cfssl";
                 Type = "oneshot";
                 WorkingDirectory = config.services.cfssl.dataDir;
+                # matches systemd.services.cfssl to run setup transparently
+                StateDirectory = baseNameOf config.services.cfssl.dataDir;
+                StateDirectoryMode = 700;
               };
               script = ''
                 ${pkgs.cfssl}/bin/cfssl genkey -initca ${