machine_setup/nix/kubernetes/keys/package/k8s-ca/package.nix

# unpackPhase
# patchPhase
# configurePhase
# buildPhase
# checkPhase
# installPhase
# fixupPhase
# installCheckPhase
# distPhase
{
  stdenv,
  openssl,
  ca_name,
  ca_config,
  ...
}:
stdenv.mkDerivation (finalAttrs: {
  name = "k8s-ca-${ca_name}";
  nativeBuildInputs = [ openssl ];
  buildInputs = [ ];

  unpackPhase = "true";

  buildPhase = ''
    openssl genrsa -out "${ca_name}-ca.key" 4096

    openssl req -x509 -new -sha512 -noenc \
            -key "${ca_name}-ca.key" -days 3653 \
            -config "${ca_config}" \
            -out "${ca_name}-ca.crt"
  '';

  installPhase = ''
    mkdir "$out"
    cp "${ca_name}-ca.crt" "${ca_name}-ca.key" $out/
  '';
})