31 lines
962 B
Nix
31 lines
962 B
Nix
{ name, dataDir, user, domain, wantedBy ? [], Before ? [] }: { pkgs, ... }:
|
|
{
|
|
systemd.services."create-${name}-cert" = {
|
|
description = "Create a certificate for ${domain}";
|
|
|
|
script = ''
|
|
${pkgs.openssl}/bin/openssl req -x509 -newkey rsa:4096 -keyout ${domain}.key -out ${domain}.crt -nodes -subj '/CN=${domain}'
|
|
${pkgs.openssl}/bin/openssl pkcs12 -export -out ${domain}.pfx -inkey ${domain}.key -in ${domain}.crt -passout pass:
|
|
cat ${domain}.crt ${domain}.key > ${domain}.pem
|
|
chmod 644 ${domain}.crt
|
|
chmod 640 ${domain}.pfx
|
|
chmod 640 ${domain}.key
|
|
chmod 640 ${domain}.pem
|
|
'';
|
|
|
|
wantedBy = [ "multi-user.target" ] ++ wantedBy;
|
|
|
|
unitConfig = {
|
|
Before = [ "multi-user.target" ] ++ Before;
|
|
ConditionPathExists = "!${dataDir}/${domain}.pfx";
|
|
};
|
|
|
|
serviceConfig = {
|
|
User = user;
|
|
Type = "oneshot";
|
|
WorkingDirectory = dataDir;
|
|
RemainAfterExit = true;
|
|
};
|
|
};
|
|
}
|