JakeHillion/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

nixos/taskserver: Fix manual PKI management

Browse Source 
The helper tool had a very early check whether the automatically created
CA key/cert are available and thus it would abort if the key was
unavailable even though we don't need or even want to have the CA key.

Unfortunately our NixOS test didn't catch this, because it was just
switching from a configuration with an automatically created CA to a
manual configuration without deleting the generated keys and certs.

This is done now in the tests and it's also fixed in the helper tool.

Reported-by: @jpotier
Signed-off-by: aszlig <aszlig@redmoonstudios.org>
This commit is contained in:
aszlig 2017-07-16 18:57:38 +02:00
parent 5d29744f4d
commit b618843860
No known key found for this signature in database
GPG Key ID: 1DE8E48E57DB5436
2 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
nixos/modules/services/misc/taskserver/helper-tool.py
View File

@ -448,6 +448,8 @@ def cli(ctx):
""" """
Manage Taskserver users and certificates Manage Taskserver users and certificates
""" """
if not IS_AUTO_CONFIG:
return
for path in (CA_KEY, CA_CERT, CRL_FILE): for path in (CA_KEY, CA_CERT, CRL_FILE):
if not os.path.exists(path): if not os.path.exists(path):
msg = "CA setup not done or incomplete, missing file {}." msg = "CA setup not done or incomplete, missing file {}."

4
nixos/tests/taskserver.nix
View File

@ -246,6 +246,10 @@ in {
}; };
subtest "check manual configuration", sub { subtest "check manual configuration", sub {
# Remove the keys from automatic CA creation, to make sure the new
# generation doesn't use keys from before.
$server->succeed('rm -rf ${cfg.dataDir}/keys/* >&2');
$server->succeed('${switchToNewServer} >&2'); $server->succeed('${switchToNewServer} >&2');
$server->waitForUnit("taskserver.service"); $server->waitForUnit("taskserver.service");
$server->waitForOpenPort(${portStr}); $server->waitForOpenPort(${portStr});