summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authortv <tv@krebsco.de>2019-04-23 19:57:23 +0200
committertv <tv@krebsco.de>2019-04-23 19:57:23 +0200
commitc195713bc283d2a378f4c5c23d57df9d222add48 (patch)
tree9f29aa251cd400ac15a7668b0a8a4e3a8372931e
parent46172b7f016e53144a9be7fefd3cecdf54dd4bab (diff)
tv pki: generate global nssdb
-rw-r--r--tv/2configs/pki/default.nix50
1 files changed, 49 insertions, 1 deletions
diff --git a/tv/2configs/pki/default.nix b/tv/2configs/pki/default.nix
index 9e7f4763d..51a5c716f 100644
--- a/tv/2configs/pki/default.nix
+++ b/tv/2configs/pki/default.nix
@@ -1,10 +1,58 @@
with import <stockholm/lib>;
-{ config, ... }: let
+{ config, pkgs, ... }: let
certFile = config.environment.etc."ssl/certs/ca-certificates.crt".source;
in {
+ environment.etc."pki/nssdb".source =
+ pkgs.runCommand "system-wide-nssdb" {
+ inherit certFile;
+ buildInputs = [
+ pkgs.jq
+ pkgs.nssTools
+ ];
+ parseInfoScript = /* jq */ ''
+ ${toJSON certFile} as $certFile |
+
+ split("\t-----END CERTIFICATE-----\n")[] |
+ select(test("\t-----BEGIN CERTIFICATE-----\n")) |
+ . + "\t-----END CERTIFICATE-----\n" |
+
+ sub("^([0-9]+\t\n)*";"") |
+
+ (match("^([0-9]+)\t").captures[0].string | tonumber) as $lineNumber |
+
+ gsub("(?m)^[0-9]+\t";"") |
+
+ match("^([^\n]+)\n(.*)";"m").captures | map(.string) |
+
+ # Line numbers are added to the names to ensure uniqueness.
+ "\(.[0]) (\($certFile):\($lineNumber))" as $name |
+ .[1] as $cert |
+
+ { $name, $cert }
+ '';
+ passAsFile = [
+ "parseInfoScript"
+ ];
+ } /* sh */ ''
+ mkdir nssdb
+
+ nl -ba -w1 "$certFile" |
+ jq -ceRs -f "$parseInfoScriptPath" > certinfo.ndjson
+
+ exec < certinfo.ndjson
+ while read -r certinfo; do
+ name=$(printf %s "$certinfo" | jq -er .name)
+ cert=$(printf %s "$certinfo" | jq -er .cert)
+
+ printf %s "$cert" | certutil -A -d nssdb -n "$name" -t C,C,C
+ done
+
+ mv nssdb "$out"
+ '';
+
environment.variables = flip genAttrs (_: toString certFile) [
"CURL_CA_BUNDLE"
"GIT_SSL_CAINFO"