tjh.dev
nixpkgs mirror (for testing)
github.com/NixOS/nixpkgs
nix
1import ./make-test-python.nix ({ pkgs, ... }:
2 let
3 test-certificates = pkgs.runCommandLocal "test-certificates" { } ''
4 mkdir -p $out
5 echo insecure-root-password > $out/root-password-file
6 echo insecure-intermediate-password > $out/intermediate-password-file
7 ${pkgs.step-cli}/bin/step certificate create "Example Root CA" $out/root_ca.crt $out/root_ca.key --password-file=$out/root-password-file --profile root-ca
8 ${pkgs.step-cli}/bin/step certificate create "Example Intermediate CA 1" $out/intermediate_ca.crt $out/intermediate_ca.key --password-file=$out/intermediate-password-file --ca-password-file=$out/root-password-file --profile intermediate-ca --ca $out/root_ca.crt --ca-key $out/root_ca.key
9 '';
10 in
11 {
12 name = "step-ca";
13 nodes =
14 {
15 caserver =
16 { config, pkgs, ... }: {
17 services.step-ca = {
18 enable = true;
19 address = "[::]";
20 port = 8443;
21 openFirewall = true;
22 intermediatePasswordFile = "${test-certificates}/intermediate-password-file";
23 settings = {
24 dnsNames = [ "caserver" ];
25 root = "${test-certificates}/root_ca.crt";
26 crt = "${test-certificates}/intermediate_ca.crt";
27 key = "${test-certificates}/intermediate_ca.key";
28 db = {
29 type = "badger";
30 dataSource = "/var/lib/step-ca/db";
31 };
32 authority = {
33 provisioners = [
34 {
35 type = "ACME";
36 name = "acme";
37 }
38 ];
39 };
40 };
41 };
42 };
43
44 caclient =
45 { config, pkgs, ... }: {
46 security.acme.defaults.server = "https://caserver:8443/acme/acme/directory";
47 security.acme.defaults.email = "root@example.org";
48 security.acme.acceptTerms = true;
49
50 security.pki.certificateFiles = [ "${test-certificates}/root_ca.crt" ];
51
52 networking.firewall.allowedTCPPorts = [ 80 443 ];
53
54 services.nginx = {
55 enable = true;
56 virtualHosts = {
57 "caclient" = {
58 forceSSL = true;
59 enableACME = true;
60 };
61 };
62 };
63 };
64
65 caclientcaddy =
66 { config, pkgs, ... }: {
67 security.pki.certificateFiles = [ "${test-certificates}/root_ca.crt" ];
68
69 networking.firewall.allowedTCPPorts = [ 80 443 ];
70
71 services.caddy = {
72 enable = true;
73 virtualHosts."caclientcaddy".extraConfig = ''
74 respond "Welcome to Caddy!"
75
76 tls caddy@example.org {
77 ca https://caserver:8443/acme/acme/directory
78 }
79 '';
80 };
81 };
82
83 catester = { config, pkgs, ... }: {
84 security.pki.certificateFiles = [ "${test-certificates}/root_ca.crt" ];
85 };
86 };
87
88 testScript =
89 ''
90 catester.start()
91 caserver.wait_for_unit("step-ca.service")
92 caserver.wait_until_succeeds("journalctl -o cat -u step-ca.service | grep '${pkgs.step-ca.version}'")
93
94 caclient.wait_for_unit("acme-finished-caclient.target")
95 catester.succeed("curl https://caclient/ | grep \"Welcome to nginx!\"")
96
97 caclientcaddy.wait_for_unit("caddy.service")
98 catester.succeed("curl https://caclientcaddy/ | grep \"Welcome to Caddy!\"")
99 '';
100 })