forked from dan/liminix
22 lines
610 B
Nix
22 lines
610 B
Nix
|
{ liminix, certifix-client, svc, lib, writeText, serviceFns }:
|
||
|
|
{
|
||
|
|
caCertificate,
|
||
|
|
secret,
|
||
|
|
subject,
|
||
|
|
serviceUrl
|
||
|
|
}:
|
||
|
|
let
|
||
|
|
inherit (builtins) filter isString split;
|
||
|
|
inherit (liminix.services) oneshot;
|
||
|
|
name = "certifix-${lib.strings.sanitizeDerivationName subject}";
|
||
|
|
caCertFile = writeText "ca.crt" caCertificate;
|
||
|
|
secretFile = writeText "secret" secret;
|
||
|
|
in oneshot {
|
||
|
|
inherit name;
|
||
|
|
up = ''
|
||
|
|
(in_outputs ${name}
|
||
|
|
SSL_CA_CERT_FILE=${caCertFile} ${certifix-client}/bin/certifix-client --subject ${subject} --secret ${secretFile} --key-out key --certificate-out cert ${serviceUrl}
|
||
|
|
)
|
||
|
|
'';
|
||
|
|
}
|