77 lines
1.7 KiB
Nix
77 lines
1.7 KiB
Nix
let
|
|
|
|
configuration = { config, pkgs, ... }: {
|
|
imports = [ ./configuration.nix ];
|
|
|
|
users.extraUsers.gebner.password = "";
|
|
users.users.root.password = "";
|
|
|
|
boot.enableContainers = true;
|
|
|
|
systemd.services.createSSLKeys = {
|
|
path = [ pkgs.easyrsa ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = "yes";
|
|
};
|
|
script = ''
|
|
rm -rf /etc/sslcerts
|
|
mkdir -p /etc/sslcerts/keys
|
|
cd /etc/sslcerts
|
|
|
|
# export PKCS11TOOL="pkcs11-tool"
|
|
export KEY_CONFIG=`${pkgs.easyrsa}/share/easy-rsa/whichopensslcnf ${pkgs.easyrsa}/share/easy-rsa/`
|
|
export KEY_DIR="$PWD/keys"
|
|
|
|
# PKCS11 fixes
|
|
# export PKCS11_MODULE_PATH="dummy"
|
|
# export PKCS11_PIN="dummy"
|
|
|
|
export KEY_SIZE=1024
|
|
|
|
export CA_EXPIRE=3650
|
|
export KEY_EXPIRE=3650
|
|
|
|
export KEY_COUNTRY="AT"
|
|
export KEY_PROVINCE="AT"
|
|
export KEY_CITY="Vienna"
|
|
export KEY_ORG="Gabriel"
|
|
export KEY_EMAIL="testing@gebner.org"
|
|
export KEY_CN=testing.gebner.org
|
|
export KEY_NAME=testing.gebner.org
|
|
export KEY_OU=testing
|
|
# export PKCS11_MODULE_PATH=changeme
|
|
# export PKCS11_PIN=1234
|
|
|
|
clean-all
|
|
build-dh
|
|
pkitool --initca
|
|
|
|
KEY_CN=gebner.org pkitool --server gebner_org
|
|
|
|
cat keys/gebner_org.crt keys/ca.crt >fullchain.pem
|
|
cp keys/gebner_org.key key.pem
|
|
cp key.pem key-dovecot.pem && chown dovecot2 key-dovecot.pem
|
|
|
|
'';
|
|
};
|
|
|
|
systemd.services.setupVM = rec {
|
|
wantedBy = [ "gogs.service" "dovecot2.service" ];
|
|
before = wantedBy;
|
|
wants = [ "createSSLKeys.service" ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = "yes";
|
|
};
|
|
script = ''
|
|
mkdir -p /srv/git.gebner.org
|
|
chown git:git -R /srv/git.gebner.org
|
|
'';
|
|
};
|
|
};
|
|
|
|
nixos = import <nixpkgs/nixos> { configuration = configuration; };
|
|
|
|
in nixos.vm
|