summaryrefslogtreecommitdiffstats
path: root/tv/2configs/pki/default.nix
diff options
context:
space:
mode:
Diffstat (limited to 'tv/2configs/pki/default.nix')
-rw-r--r--tv/2configs/pki/default.nix68
1 files changed, 68 insertions, 0 deletions
diff --git a/tv/2configs/pki/default.nix b/tv/2configs/pki/default.nix
new file mode 100644
index 000000000..51a5c716f
--- /dev/null
+++ b/tv/2configs/pki/default.nix
@@ -0,0 +1,68 @@
+with import <stockholm/lib>;
+{ config, pkgs, ... }: let
+
+ certFile = config.environment.etc."ssl/certs/ca-certificates.crt".source;
+
+in {
+
+ environment.etc."pki/nssdb".source =
+ pkgs.runCommand "system-wide-nssdb" {
+ inherit certFile;
+ buildInputs = [
+ pkgs.jq
+ pkgs.nssTools
+ ];
+ parseInfoScript = /* jq */ ''
+ ${toJSON certFile} as $certFile |
+
+ split("\t-----END CERTIFICATE-----\n")[] |
+ select(test("\t-----BEGIN CERTIFICATE-----\n")) |
+ . + "\t-----END CERTIFICATE-----\n" |
+
+ sub("^([0-9]+\t\n)*";"") |
+
+ (match("^([0-9]+)\t").captures[0].string | tonumber) as $lineNumber |
+
+ gsub("(?m)^[0-9]+\t";"") |
+
+ match("^([^\n]+)\n(.*)";"m").captures | map(.string) |
+
+ # Line numbers are added to the names to ensure uniqueness.
+ "\(.[0]) (\($certFile):\($lineNumber))" as $name |
+ .[1] as $cert |
+
+ { $name, $cert }
+ '';
+ passAsFile = [
+ "parseInfoScript"
+ ];
+ } /* sh */ ''
+ mkdir nssdb
+
+ nl -ba -w1 "$certFile" |
+ jq -ceRs -f "$parseInfoScriptPath" > certinfo.ndjson
+
+ exec < certinfo.ndjson
+ while read -r certinfo; do
+ name=$(printf %s "$certinfo" | jq -er .name)
+ cert=$(printf %s "$certinfo" | jq -er .cert)
+
+ printf %s "$cert" | certutil -A -d nssdb -n "$name" -t C,C,C
+ done
+
+ mv nssdb "$out"
+ '';
+
+ environment.variables = flip genAttrs (_: toString certFile) [
+ "CURL_CA_BUNDLE"
+ "GIT_SSL_CAINFO"
+ "SSL_CERT_FILE"
+ ];
+
+ security.pki.certificateFiles =
+ mapAttrsToList
+ (name: const (./certs + "/${name}"))
+ (filterAttrs (const (eq "regular"))
+ (readDir ./certs));
+
+}