SebastianStork/nixos-config
1
0
Fork 0
mirror of https://github.com/SebastianStork/nixos-config.git synced 2026-03-22 11:59:08 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

scripts/nebula-recert-host: Refactor

Browse source
This commit is contained in:
SebastianStork 2026-02-26 18:48:51 +01:00
parent caebd6e241
commit b76aab2cfe
Signed by: SebastianStork
SSH key fingerprint: SHA256:tRrGdjYOwgHxpSc/wTOZQZEjxcb15P0tyXRsbAfd+2Q
1 changed files with 15 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

23
scripts/nebula/recert-host.nix
View file

@ -7,16 +7,16 @@
text = '' text = ''
if [[ $# -lt 1 ]] || [[ $# -gt 2 ]]; then if [[ $# -lt 1 ]] || [[ $# -gt 2 ]]; then
echo "Usage: $0 <host> [<ca-key-path>]" echo "Usage: $0 <hostname> [<ca-key-path>]"
exit 1 exit 1
fi fi
host="$1" hostname="$1"
address="$(nix eval --raw ".#allHosts.$host.config.custom.networking.overlay.cidr")" address="$(nix eval --raw ".#allHosts.$hostname.config.custom.networking.overlay.cidr")"
groups="$(nix eval --raw ".#allHosts.$host.config.custom.services.nebula.groups" --apply 'builtins.concatStringsSep ","')" groups="$(nix eval --raw ".#allHosts.$hostname.config.custom.services.nebula.groups" --apply 'builtins.concatStringsSep ","')"
ca_cert='modules/system/services/nebula/ca.crt' ca_cert="$(nix eval --raw ".#allHosts.$hostname.config.custom.services.nebula.caCertificateFile")"
host_pub="$(nix eval --raw ".#allHosts.$host.config.custom.services.nebula.publicKeyFile")" host_pub="$(nix eval --raw ".#allHosts.$hostname.config.custom.services.nebula.publicKeyFile")"
host_cert="$(nix eval --raw ".#allHosts.$host.config.custom.services.nebula.certificateFile")" host_cert="$(nix eval --raw ".#allHosts.$hostname.config.custom.services.nebula.certificateFile")"
host_cert="''${host_cert#*-source/}" host_cert="''${host_cert#*-source/}"
if [[ $# -eq 2 ]]; then if [[ $# -eq 2 ]]; then
@ -34,6 +34,13 @@
fi fi
rm -f "$host_cert" rm -f "$host_cert"
nebula-cert sign -name "$host" -networks "$address" -groups "$groups" -ca-crt "$ca_cert" -ca-key "$ca_key" -in-pub "$host_pub" -out-crt "$host_cert" nebula-cert sign \
-name "$hostname" \
-networks "$address" \
-groups "$groups" \
-ca-crt "$ca_cert" \
-ca-key "$ca_key" \
-in-pub "$host_pub" \
-out-crt "$host_cert"
''; '';
} }