| 1 | #!/usr/bin/env bash |
| 2 | |
| 3 | set -x |
| 4 | |
| 5 | hosts="localhost ofborg-eval02 ofborg-eval03 ofborg-eval04 ofborg-build01 ofborg-build02 ofborg-build03 ofborg-build04 ofborg-build05" |
| 6 | |
| 7 | C="DE" |
| 8 | O="NixOS Infra" |
| 9 | |
| 10 | newDir="$(date '+%Y-%m-%dT%H:%M')" |
| 11 | mkdir "${newDir}" |
| 12 | cd "${newDir}" || exit |
| 13 | |
| 14 | openssl genpkey -algorithm Ed25519 -out ca.key |
| 15 | openssl req -x509 -new -nodes -key ca.key -sha256 -days 18250 -out ca.crt \ |
| 16 | -subj "/C=${C}/O=${O}/CN=hydra-queue-runner-ca" |
| 17 | |
| 18 | cat <<EOF >server.cnf |
| 19 | [req] |
| 20 | prompt = no |
| 21 | x509_extensions = v3_req |
| 22 | req_extensions = v3_req |
| 23 | default_md = sha256 |
| 24 | distinguished_name = req_distinguished_name |
| 25 | |
| 26 | [req_distinguished_name] |
| 27 | C = ${C} |
| 28 | O = ${O} |
| 29 | CN = queue-runner.staging-hydra.nixos.org |
| 30 | |
| 31 | [v3_req] |
| 32 | basicConstraints = CA:FALSE |
| 33 | keyUsage = nonRepudiation, digitalSignature, keyEncipherment, keyAgreement |
| 34 | extendedKeyUsage = critical, serverAuth |
| 35 | subjectAltName = @alt_names |
| 36 | |
| 37 | [alt_names] |
| 38 | DNS.1 = queue-runner.staging-hydra.nixos.org |
| 39 | EOF |
| 40 | |
| 41 | openssl genpkey -algorithm Ed25519 -out server.key |
| 42 | openssl req -new -key server.key -out server.csr -config server.cnf |
| 43 | openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 18250 -sha256 -extfile server.cnf -extensions v3_req |
| 44 | |
| 45 | for host in ${hosts}; do |
| 46 | openssl genpkey -algorithm Ed25519 -out "client-${host}.key" |
| 47 | openssl req -new -key "client-${host}.key" -out "client-${host}.csr" \ |
| 48 | -subj "/C=${C}/O=${O}/CN=hydra-queue-builder-${host}" |
| 49 | openssl x509 -req -in "client-${host}.csr" -CA ca.crt -CAkey ca.key -CAcreateserial -out "client-${host}.crt" -days 18250 -sha256 |
| 50 | done |
| 51 | |
| 52 | rm -rf -- *.csr *.srl |
| 53 | rm server.cnf |
| 54 | |
| 55 | cd - || exit |