summaryrefslogtreecommitdiffstats
path: root/tv/2configs
diff options
context:
space:
mode:
authortv <tv@krebsco.de>2019-04-23 19:57:23 +0200
committertv <tv@krebsco.de>2019-04-23 19:57:23 +0200
commit7eb10dc182e46a5f9d97bc010a6567e7f23c7df0 (patch)
tree586191c1835ab615b56cdf67489d9543cc6062b5 /tv/2configs
parent0e4485da4d1858523483bb6750daeacbe3378e61 (diff)
tv pki: generate global nssdb
Diffstat (limited to 'tv/2configs')
-rw-r--r--tv/2configs/pki/default.nix50
1 files changed, 49 insertions, 1 deletions
diff --git a/tv/2configs/pki/default.nix b/tv/2configs/pki/default.nix
index 9e7f476..51a5c71 100644
--- a/tv/2configs/pki/default.nix
+++ b/tv/2configs/pki/default.nix
@@ -1,10 +1,58 @@
with import <stockholm/lib>;
-{ config, ... }: let
+{ config, pkgs, ... }: let
certFile = config.environment.etc."ssl/certs/ca-certificates.crt".source;
in {
+ environment.etc."pki/nssdb".source =
+ pkgs.runCommand "system-wide-nssdb" {
+ inherit certFile;
+ buildInputs = [
+ pkgs.jq
+ pkgs.nssTools
+ ];
+ parseInfoScript = /* jq */ ''
+ ${toJSON certFile} as $certFile |
+
+ split("\t-----END CERTIFICATE-----\n")[] |
+ select(test("\t-----BEGIN CERTIFICATE-----\n")) |
+ . + "\t-----END CERTIFICATE-----\n" |
+
+ sub("^([0-9]+\t\n)*";"") |
+
+ (match("^([0-9]+)\t").captures[0].string | tonumber) as $lineNumber |
+
+ gsub("(?m)^[0-9]+\t";"") |
+
+ match("^([^\n]+)\n(.*)";"m").captures | map(.string) |
+
+ # Line numbers are added to the names to ensure uniqueness.
+ "\(.[0]) (\($certFile):\($lineNumber))" as $name |
+ .[1] as $cert |
+
+ { $name, $cert }
+ '';
+ passAsFile = [
+ "parseInfoScript"
+ ];
+ } /* sh */ ''
+ mkdir nssdb
+
+ nl -ba -w1 "$certFile" |
+ jq -ceRs -f "$parseInfoScriptPath" > certinfo.ndjson
+
+ exec < certinfo.ndjson
+ while read -r certinfo; do
+ name=$(printf %s "$certinfo" | jq -er .name)
+ cert=$(printf %s "$certinfo" | jq -er .cert)
+
+ printf %s "$cert" | certutil -A -d nssdb -n "$name" -t C,C,C
+ done
+
+ mv nssdb "$out"
+ '';
+
environment.variables = flip genAttrs (_: toString certFile) [
"CURL_CA_BUNDLE"
"GIT_SSL_CAINFO"