48 lines
1015 B
Nix
48 lines
1015 B
Nix
# unpackPhase
|
|
# patchPhase
|
|
# configurePhase
|
|
# buildPhase
|
|
# checkPhase
|
|
# installPhase
|
|
# fixupPhase
|
|
# installCheckPhase
|
|
# distPhase
|
|
{
|
|
stdenv,
|
|
openssl,
|
|
k8s,
|
|
key_name,
|
|
ca_name,
|
|
ca_config,
|
|
...
|
|
}:
|
|
stdenv.mkDerivation (finalAttrs: {
|
|
name = "tls-key-${key_name}";
|
|
nativeBuildInputs = [ openssl ];
|
|
buildInputs = [ ];
|
|
|
|
unpackPhase = "true";
|
|
|
|
buildPhase = ''
|
|
cp ${k8s.ca."${ca_name}"}/${ca_name}-ca.crt ${k8s.ca."${ca_name}"}/${ca_name}-ca.key ./
|
|
|
|
openssl genrsa -out "${key_name}.key" 4096
|
|
|
|
openssl req -new -key "${key_name}.key" -sha256 \
|
|
-config "${ca_config}" -section ${key_name} \
|
|
-out "${key_name}.csr"
|
|
|
|
openssl x509 -req -days 3653 -in "${key_name}.csr" \
|
|
-copy_extensions copyall \
|
|
-sha256 -CA "./${ca_name}-ca.crt" \
|
|
-CAkey "./${ca_name}-ca.key" \
|
|
-CAcreateserial \
|
|
-out "${key_name}.crt"
|
|
'';
|
|
|
|
installPhase = ''
|
|
mkdir "$out"
|
|
cp "${key_name}.crt" "${key_name}.key" $out/
|
|
'';
|
|
})
|