pub-solar/infra
6
1
Fork 3
Code Issues 23 Pull requests 10 Actions Packages Projects 1 Releases Wiki Activity

style: format using nixfmt-rfc-style
Some checks failed
Flake checks / Check (pull_request) Has been cancelled
Details

Browse source
This commit is contained in:
teutat3s 2024-08-25 02:41:29 +02:00
parent e1dadd17ab
commit 74f03555e5
Signed by: teutat3s
GPG key ID: 4FA1D3FA524F22C1
10 changed files with 374 additions and 358 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
flake.nix
View file

@ -79,14 +79,25 @@
master = import inputs.master { inherit system; }; master = import inputs.master { inherit system; };
}; };
packages = let packages =
nixos-lib = import (inputs.nixpkgs + "/nixos/lib") { }; let
testDir = builtins.attrNames (builtins.readDir ./tests); nixos-lib = import (inputs.nixpkgs + "/nixos/lib") { };
testFiles = builtins.filter (n: builtins.match "^.*.nix$" n != null) testDir; testDir = builtins.attrNames (builtins.readDir ./tests);
in builtins.listToAttrs (map (x: { testFiles = builtins.filter (n: builtins.match "^.*.nix$" n != null) testDir;
name = "test-${lib.strings.removeSuffix ".nix" x}"; in
value = nixos-lib.runTest (import (./tests + "/${x}") { inherit self; inherit pkgs; inherit lib; inherit config; }); builtins.listToAttrs (
}) testFiles); map (x: {
name = "test-${lib.strings.removeSuffix ".nix" x}";
value = nixos-lib.runTest (
import (./tests + "/${x}") {
inherit self;
inherit pkgs;
inherit lib;
inherit config;
}
);
}) testFiles
);
devShells.default = pkgs.mkShell { devShells.default = pkgs.mkShell {
buildInputs = with pkgs; [ buildInputs = with pkgs; [

456
modules/backups/default.nix
View file

@ -7,247 +7,257 @@
}: }:
{ {
options.pub-solar-os.backups = { options.pub-solar-os.backups = {
stores = with lib; mkOption { stores =
description = '' with lib;
Periodic backups to create with Restic. mkOption {
''; description = ''
type = types.attrsOf (types.submodule ({ name, ... }: { Periodic backups to create with Restic.
options = { '';
passwordFile = mkOption { type = types.attrsOf (
type = types.str; types.submodule (
description = '' { name, ... }:
Read the repository password from a file. {
''; options = {
example = "/etc/nixos/restic-password"; passwordFile = mkOption {
}; type = types.str;
description = ''
Read the repository password from a file.
'';
example = "/etc/nixos/restic-password";
};
repository = mkOption { repository = mkOption {
type = with types; nullOr str; type = with types; nullOr str;
default = null; default = null;
description = '' description = ''
repository to backup to. repository to backup to.
''; '';
example = "sftp:backup@192.168.1.100:/backups/${name}"; example = "sftp:backup@192.168.1.100:/backups/${name}";
}; };
}; };
})); }
)
);
default = { }; default = { };
example = { example = {
remotebackup = { remotebackup = {
repository = "sftp:backup@host:/backups/home"; repository = "sftp:backup@host:/backups/home";
passwordFile = "/etc/nixos/secrets/restic-password"; passwordFile = "/etc/nixos/secrets/restic-password";
};
}; };
}; };
};
backups = with lib; mkOption { backups =
description = '' with lib;
Periodic backups to create with Restic. mkOption {
''; description = ''
type = types.attrsOf (types.submodule ({ name, ... }: { Periodic backups to create with Restic.
options = { '';
paths = mkOption { type = types.attrsOf (
# This is nullable for legacy reasons only. We should consider making it a pure listOf types.submodule (
# after some time has passed since this comment was added. { name, ... }:
type = types.nullOr (types.listOf types.str); {
default = [ ]; options = {
description = '' paths = mkOption {
Which paths to backup, in addition to ones specified via # This is nullable for legacy reasons only. We should consider making it a pure listOf
`dynamicFilesFrom`. If null or an empty array and # after some time has passed since this comment was added.
`dynamicFilesFrom` is also null, no backup command will be run. type = types.nullOr (types.listOf types.str);
This can be used to create a prune-only job. default = [ ];
''; description = ''
example = [ Which paths to backup, in addition to ones specified via
"/var/lib/postgresql" `dynamicFilesFrom`. If null or an empty array and
"/home/user/backup" `dynamicFilesFrom` is also null, no backup command will be run.
]; This can be used to create a prune-only job.
'';
example = [
"/var/lib/postgresql"
"/home/user/backup"
];
};
exclude = mkOption {
type = types.listOf types.str;
default = [ ];
description = ''
Patterns to exclude when backing up. See
https://restic.readthedocs.io/en/latest/040_backup.html#excluding-files for
details on syntax.
'';
example = [
"/var/cache"
"/home/*/.cache"
".git"
];
};
timerConfig = mkOption {
type = types.nullOr (types.attrsOf unitOption);
default = {
OnCalendar = "daily";
Persistent = true;
};
description = ''
When to run the backup. See {manpage}`systemd.timer(5)` for
details. If null no timer is created and the backup will only
run when explicitly started.
'';
example = {
OnCalendar = "00:05";
RandomizedDelaySec = "5h";
Persistent = true;
};
};
user = mkOption {
type = types.str;
default = "root";
description = ''
As which user the backup should run.
'';
example = "postgresql";
};
extraBackupArgs = mkOption {
type = types.listOf types.str;
default = [ ];
description = ''
Extra arguments passed to restic backup.
'';
example = [ "--exclude-file=/etc/nixos/restic-ignore" ];
};
extraOptions = mkOption {
type = types.listOf types.str;
default = [ ];
description = ''
Extra extended options to be passed to the restic --option flag.
'';
example = [ "sftp.command='ssh backup@192.168.1.100 -i /home/user/.ssh/id_rsa -s sftp'" ];
};
initialize = mkOption {
type = types.bool;
default = false;
description = ''
Create the repository if it doesn't exist.
'';
};
pruneOpts = mkOption {
type = types.listOf types.str;
default = [ ];
description = ''
A list of options (--keep-\* et al.) for 'restic forget
--prune', to automatically prune old snapshots. The
'forget' command is run *after* the 'backup' command, so
keep that in mind when constructing the --keep-\* options.
'';
example = [
"--keep-daily 7"
"--keep-weekly 5"
"--keep-monthly 12"
"--keep-yearly 75"
];
};
runCheck = mkOption {
type = types.bool;
default = (builtins.length config.services.restic.backups.${name}.checkOpts > 0);
defaultText = literalExpression ''builtins.length config.services.backups.${name}.checkOpts > 0'';
description = "Whether to run the `check` command with the provided `checkOpts` options.";
example = true;
};
checkOpts = mkOption {
type = types.listOf types.str;
default = [ ];
description = ''
A list of options for 'restic check'.
'';
example = [ "--with-cache" ];
};
dynamicFilesFrom = mkOption {
type = with types; nullOr str;
default = null;
description = ''
A script that produces a list of files to back up. The
results of this command are given to the '--files-from'
option. The result is merged with paths specified via `paths`.
'';
example = "find /home/matt/git -type d -name .git";
};
backupPrepareCommand = mkOption {
type = with types; nullOr str;
default = null;
description = ''
A script that must run before starting the backup process.
'';
};
backupCleanupCommand = mkOption {
type = with types; nullOr str;
default = null;
description = ''
A script that must run after finishing the backup process.
'';
};
package = mkPackageOption pkgs "restic" { };
createWrapper = lib.mkOption {
type = lib.types.bool;
default = true;
description = ''
Whether to generate and add a script to the system path, that has the same environment variables set
as the systemd service. This can be used to e.g. mount snapshots or perform other opterations, without
having to manually specify most options.
'';
};
};
}
)
);
default = { };
example = {
localbackup = {
paths = [ "/home" ];
exclude = [ "/home/*/.cache" ];
initialize = true;
}; };
remotebackup = {
exclude = mkOption { paths = [ "/home" ];
type = types.listOf types.str; extraOptions = [
default = [ ]; "sftp.command='ssh backup@host -i /etc/nixos/secrets/backup-private-key -s sftp'"
description = ''
Patterns to exclude when backing up. See
https://restic.readthedocs.io/en/latest/040_backup.html#excluding-files for
details on syntax.
'';
example = [
"/var/cache"
"/home/*/.cache"
".git"
]; ];
}; timerConfig = {
timerConfig = mkOption {
type = types.nullOr (types.attrsOf unitOption);
default = {
OnCalendar = "daily";
Persistent = true;
};
description = ''
When to run the backup. See {manpage}`systemd.timer(5)` for
details. If null no timer is created and the backup will only
run when explicitly started.
'';
example = {
OnCalendar = "00:05"; OnCalendar = "00:05";
RandomizedDelaySec = "5h"; RandomizedDelaySec = "5h";
Persistent = true;
}; };
}; };
user = mkOption {
type = types.str;
default = "root";
description = ''
As which user the backup should run.
'';
example = "postgresql";
};
extraBackupArgs = mkOption {
type = types.listOf types.str;
default = [ ];
description = ''
Extra arguments passed to restic backup.
'';
example = [
"--exclude-file=/etc/nixos/restic-ignore"
];
};
extraOptions = mkOption {
type = types.listOf types.str;
default = [ ];
description = ''
Extra extended options to be passed to the restic --option flag.
'';
example = [
"sftp.command='ssh backup@192.168.1.100 -i /home/user/.ssh/id_rsa -s sftp'"
];
};
initialize = mkOption {
type = types.bool;
default = false;
description = ''
Create the repository if it doesn't exist.
'';
};
pruneOpts = mkOption {
type = types.listOf types.str;
default = [ ];
description = ''
A list of options (--keep-\* et al.) for 'restic forget
--prune', to automatically prune old snapshots. The
'forget' command is run *after* the 'backup' command, so
keep that in mind when constructing the --keep-\* options.
'';
example = [
"--keep-daily 7"
"--keep-weekly 5"
"--keep-monthly 12"
"--keep-yearly 75"
];
};
runCheck = mkOption {
type = types.bool;
default = (builtins.length config.services.restic.backups.${name}.checkOpts > 0);
defaultText = literalExpression ''builtins.length config.services.backups.${name}.checkOpts > 0'';
description = "Whether to run the `check` command with the provided `checkOpts` options.";
example = true;
};
checkOpts = mkOption {
type = types.listOf types.str;
default = [ ];
description = ''
A list of options for 'restic check'.
'';
example = [
"--with-cache"
];
};
dynamicFilesFrom = mkOption {
type = with types; nullOr str;
default = null;
description = ''
A script that produces a list of files to back up. The
results of this command are given to the '--files-from'
option. The result is merged with paths specified via `paths`.
'';
example = "find /home/matt/git -type d -name .git";
};
backupPrepareCommand = mkOption {
type = with types; nullOr str;
default = null;
description = ''
A script that must run before starting the backup process.
'';
};
backupCleanupCommand = mkOption {
type = with types; nullOr str;
default = null;
description = ''
A script that must run after finishing the backup process.
'';
};
package = mkPackageOption pkgs "restic" { };
createWrapper = lib.mkOption {
type = lib.types.bool;
default = true;
description = ''
Whether to generate and add a script to the system path, that has the same environment variables set
as the systemd service. This can be used to e.g. mount snapshots or perform other opterations, without
having to manually specify most options.
'';
};
};
}));
default = { };
example = {
localbackup = {
paths = [ "/home" ];
exclude = [ "/home/*/.cache" ];
initialize = true;
};
remotebackup = {
paths = [ "/home" ];
extraOptions = [
"sftp.command='ssh backup@host -i /etc/nixos/secrets/backup-private-key -s sftp'"
];
timerConfig = {
OnCalendar = "00:05";
RandomizedDelaySec = "5h";
};
}; };
}; };
};
}; };
config = { config = {
services.restic.backups = let services.restic.backups =
stores = config.pub-solar-os.backups.stores; let
backups = config.pub-solar-os.backups.backups; stores = config.pub-solar-os.backups.stores;
backups = config.pub-solar-os.backups.backups;
storeNames = builtins.attrNames stores; storeNames = builtins.attrNames stores;
backupNames = builtins.attrNames backups; backupNames = builtins.attrNames backups;
createBackups = backupName: map createBackups =
(storeName: { backupName:
name = "${backupName}-${storeName}"; map (storeName: {
value = stores."${storeName}" // backups."${backupName}"; name = "${backupName}-${storeName}";
}) value = stores."${storeName}" // backups."${backupName}";
storeNames; }) storeNames;
in builtins.listToAttrs (lib.lists.flatten (map createBackups backupNames)); in
builtins.listToAttrs (lib.lists.flatten (map createBackups backupNames));
}; };
} }

4
modules/core/nix.nix
View file

@ -6,9 +6,7 @@
... ...
}: }:
{ {
nixpkgs.config = lib.mkDefault { nixpkgs.config = lib.mkDefault { allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ ]; };
allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ ];
};
nix = { nix = {
# Use default version alias for nix package # Use default version alias for nix package

4
modules/keycloak/default.nix
View file

@ -42,9 +42,7 @@
}; };
}; };
nixpkgs.config = lib.mkDefault { nixpkgs.config = lib.mkDefault { permittedInsecurePackages = [ "keycloak-23.0.6" ]; };
permittedInsecurePackages = [ "keycloak-23.0.6" ];
};
# keycloak # keycloak
services.keycloak = { services.keycloak = {

55
tests/keycloak.nix
View file

@ -4,8 +4,10 @@
lib, lib,
config, config,
... ...
}: let }:
in { let
in
{
name = "keycloak"; name = "keycloak";
hostPkgs = pkgs; hostPkgs = pkgs;
@ -42,9 +44,7 @@ in {
./support/global.nix ./support/global.nix
]; ];
systemd.tmpfiles.rules = [ systemd.tmpfiles.rules = [ "f /tmp/dbf 1777 root root 10d password" ];
"f /tmp/dbf 1777 root root 10d password"
];
virtualisation.memorySize = 4096; virtualisation.memorySize = 4096;
@ -65,27 +65,30 @@ in {
enableOCR = true; enableOCR = true;
testScript = {nodes, ...}: let testScript =
user = nodes.client.users.users.${nodes.client.pub-solar-os.authentication.username}; { nodes, ... }:
#uid = toString user.uid; let
bus = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/$(id -u ${user.name})/bus"; user = nodes.client.users.users.${nodes.client.pub-solar-os.authentication.username};
gdbus = "${bus} gdbus"; #uid = toString user.uid;
su = command: "su - ${user.name} -c '${command}'"; bus = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/$(id -u ${user.name})/bus";
gseval = "call --session -d org.gnome.Shell -o /org/gnome/Shell -m org.gnome.Shell.Eval"; gdbus = "${bus} gdbus";
wmClass = su "${gdbus} ${gseval} global.display.focus_window.wm_class"; su = command: "su - ${user.name} -c '${command}'";
in '' gseval = "call --session -d org.gnome.Shell -o /org/gnome/Shell -m org.gnome.Shell.Eval";
start_all() wmClass = su "${gdbus} ${gseval} global.display.focus_window.wm_class";
in
''
start_all()
nachtigall.wait_for_unit("system.slice") nachtigall.wait_for_unit("system.slice")
nachtigall.succeed("ping 127.0.0.1 -c 2") nachtigall.succeed("ping 127.0.0.1 -c 2")
nachtigall.wait_for_unit("nginx.service") nachtigall.wait_for_unit("nginx.service")
nachtigall.wait_for_unit("keycloak.service") nachtigall.wait_for_unit("keycloak.service")
nachtigall.wait_until_succeeds("curl http://127.0.0.1:8080/") nachtigall.wait_until_succeeds("curl http://127.0.0.1:8080/")
nachtigall.wait_until_succeeds("curl https://auth.test.pub.solar/") nachtigall.wait_until_succeeds("curl https://auth.test.pub.solar/")
client.wait_for_unit("system.slice") client.wait_for_unit("system.slice")
client.sleep(30) client.sleep(30)
# client.wait_until_succeeds("${wmClass} | grep -q 'firefox'") # client.wait_until_succeeds("${wmClass} | grep -q 'firefox'")
client.screenshot("screen") client.screenshot("screen")
''; '';
} }

61
tests/support/ca.nix
View file

@ -3,14 +3,11 @@
lib, lib,
config, config,
... ...
}: { }:
imports = [ {
./global.nix imports = [ ./global.nix ];
];
systemd.tmpfiles.rules = [ systemd.tmpfiles.rules = [ "f /tmp/step-ca-intermediate-pw 1777 root root 10d password" ];
"f /tmp/step-ca-intermediate-pw 1777 root root 10d password"
];
networking.interfaces.eth0.ipv4.addresses = [ networking.interfaces.eth0.ipv4.addresses = [
{ {
@ -19,30 +16,32 @@
} }
]; ];
services.step-ca = let services.step-ca =
certificates = pkgs.stdenv.mkDerivation { let
name = "certificates"; certificates = pkgs.stdenv.mkDerivation {
src = ./step; name = "certificates";
installPhase = '' src = ./step;
mkdir -p $out; installPhase = ''
cp -r certs $out/ mkdir -p $out;
cp -r secrets $out/ cp -r certs $out/
''; cp -r secrets $out/
}; '';
in { };
enable = true; in
openFirewall = true; {
intermediatePasswordFile = "/tmp/step-ca-intermediate-pw"; enable = true;
port = 443; openFirewall = true;
address = "0.0.0.0"; intermediatePasswordFile = "/tmp/step-ca-intermediate-pw";
settings = (builtins.fromJSON (builtins.readFile ./step/config/ca.json)) // { port = 443;
root = "${certificates}/certs/root_ca.crt"; address = "0.0.0.0";
crt = "${certificates}/certs/intermediate_ca.crt"; settings = (builtins.fromJSON (builtins.readFile ./step/config/ca.json)) // {
key = "${certificates}/secrets/intermediate_ca_key"; root = "${certificates}/certs/root_ca.crt";
db = { crt = "${certificates}/certs/intermediate_ca.crt";
type = "badgerv2"; key = "${certificates}/secrets/intermediate_ca_key";
dataSource = "/var/lib/step-ca/db"; db = {
type = "badgerv2";
dataSource = "/var/lib/step-ca/db";
};
}; };
}; };
};
} }

4
tests/support/client.nix
View file

@ -5,9 +5,7 @@
... ...
}: }:
{ {
imports = [ imports = [ ./global.nix ];
./global.nix
];
services.xserver.enable = true; services.xserver.enable = true;
services.xserver.displayManager.gdm.enable = true; services.xserver.displayManager.gdm.enable = true;

29
tests/support/global.nix
View file

@ -3,14 +3,13 @@
lib, lib,
config, config,
... ...
}: { }:
{
pub-solar-os.networking.domain = "test.pub.solar"; pub-solar-os.networking.domain = "test.pub.solar";
security.acme.defaults.server = "https://ca.${config.pub-solar-os.networking.domain}/acme/acme/directory"; security.acme.defaults.server = "https://ca.${config.pub-solar-os.networking.domain}/acme/acme/directory";
security.pki.certificates = [ security.pki.certificates = [ (builtins.readFile ./step/certs/root_ca.crt) ];
(builtins.readFile ./step/certs/root_ca.crt)
];
services.openssh = { services.openssh = {
enable = true; enable = true;
@ -24,16 +23,18 @@
security.pam.services.sshd.allowNullPassword = true; security.pam.services.sshd.allowNullPassword = true;
virtualisation.forwardPorts = let virtualisation.forwardPorts =
address = (builtins.elemAt config.networking.interfaces.eth0.ipv4.addresses 0).address; let
lastAddressPart = builtins.elemAt (lib.strings.splitString "." address) 3; address = (builtins.elemAt config.networking.interfaces.eth0.ipv4.addresses 0).address;
in [ lastAddressPart = builtins.elemAt (lib.strings.splitString "." address) 3;
{ in
from = "host"; [
host.port = 2000 + (lib.strings.toInt lastAddressPart); {
guest.port = 22; from = "host";
} host.port = 2000 + (lib.strings.toInt lastAddressPart);
]; guest.port = 22;
}
];
networking.interfaces.eth0.useDHCP = false; networking.interfaces.eth0.useDHCP = false;

82
tests/support/step/config/ca.json
View file

@ -1,46 +1,44 @@
{ {
"federatedRoots": null, "federatedRoots": null,
"address": ":443", "address": ":443",
"insecureAddress": "", "insecureAddress": "",
"dnsNames": [ "dnsNames": ["ca.test.pub.solar"],
"ca.test.pub.solar" "logger": {
], "format": "text"
"logger": { },
"format": "text" "db": {
}, "type": "badgerv2",
"db": { "badgerFileLoadingMode": ""
"type": "badgerv2", },
"badgerFileLoadingMode": "" "authority": {
}, "provisioners": [
"authority": {
"provisioners": [
{ {
"name": "acme", "name": "acme",
"type": "ACME" "type": "ACME"
}, },
{ {
"type": "JWK", "type": "JWK",
"name": "test.pub.solar", "name": "test.pub.solar",
"key": { "key": {
"use": "sig", "use": "sig",
"kty": "EC", "kty": "EC",
"kid": "lM-BJXRwwQcdgxLqAS4Za23A2YatZpwXx-PP5NIt8JM", "kid": "lM-BJXRwwQcdgxLqAS4Za23A2YatZpwXx-PP5NIt8JM",
"crv": "P-256", "crv": "P-256",
"alg": "ES256", "alg": "ES256",
"x": "ouB2mP04Kt8rDa10C8ZzYyzA36rrz-k0c4_ud1hVjyg", "x": "ouB2mP04Kt8rDa10C8ZzYyzA36rrz-k0c4_ud1hVjyg",
"y": "RbXKcudQRPEFqjG_5AxuqCQXn7pyRToQCwC4MrwLVUQ" "y": "RbXKcudQRPEFqjG_5AxuqCQXn7pyRToQCwC4MrwLVUQ"
}, },
"encryptedKey": "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoiNWR5T2puR2Y5aFFNRlc1U25fRWhzUSJ9.a3xtSBuMmzZCMsdfHAXMgFpe9bq8A6bGGOoW9F2Gw7AhxL4bG-AlgA.IA68rSJSGTAKnaVS.XDQc4da-8D9Ykfw-8S4uphsauq5gsEm4qp7zKQUIvcjUlnPAtiHP3xiiBie29ncdg8rKmyzprEEOpTNvXtQl7LsPsHXyKV3SqsTnJecvim9YXGDneAHyWe-XF6hyCZAfSoFbFMgLDKR6d44hMht3ueazL_TPlkFUBLrJbsW782MfdfF3nzcaDf_JDuhKsKHDmKqZyNXDzwf6rINe8adrf5gqaLM2_sGhk7i3XyXygn8HHVw1Dj_w2gPOVm4MS7CO_NgikPqAtGuXDhpWZfXte-FlnMO6d9xQF67b0cwB8kmColPSp1zRiCKPAk9vof8Nn-gGE_aw8zxPi0CJkoY.xbuqSSspgLc_Uw17uiRF7Q" "encryptedKey": "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoiNWR5T2puR2Y5aFFNRlc1U25fRWhzUSJ9.a3xtSBuMmzZCMsdfHAXMgFpe9bq8A6bGGOoW9F2Gw7AhxL4bG-AlgA.IA68rSJSGTAKnaVS.XDQc4da-8D9Ykfw-8S4uphsauq5gsEm4qp7zKQUIvcjUlnPAtiHP3xiiBie29ncdg8rKmyzprEEOpTNvXtQl7LsPsHXyKV3SqsTnJecvim9YXGDneAHyWe-XF6hyCZAfSoFbFMgLDKR6d44hMht3ueazL_TPlkFUBLrJbsW782MfdfF3nzcaDf_JDuhKsKHDmKqZyNXDzwf6rINe8adrf5gqaLM2_sGhk7i3XyXygn8HHVw1Dj_w2gPOVm4MS7CO_NgikPqAtGuXDhpWZfXte-FlnMO6d9xQF67b0cwB8kmColPSp1zRiCKPAk9vof8Nn-gGE_aw8zxPi0CJkoY.xbuqSSspgLc_Uw17uiRF7Q"
} }
] ]
}, },
"tls": { "tls": {
"cipherSuites": [ "cipherSuites": [
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
], ],
"minVersion": 1.2, "minVersion": 1.2,
"maxVersion": 1.3, "maxVersion": 1.3,
"renegotiation": false "renegotiation": false
} }
} }

8
tests/support/step/config/defaults.json
View file

@ -1,6 +1,6 @@
{ {
"ca-url": "https://ca.test.pub.solar", "ca-url": "https://ca.test.pub.solar",
"ca-config": "/home/b12f/.step/config/ca.json", "ca-config": "/home/b12f/.step/config/ca.json",
"fingerprint": "4d6a1a918355380acbd0256a2203d0a0da8436bb788e8f19326589045c3cd842", "fingerprint": "4d6a1a918355380acbd0256a2203d0a0da8436bb788e8f19326589045c3cd842",
"root": "/home/b12f/.step/certs/root_ca.crt" "root": "/home/b12f/.step/certs/root_ca.crt"
} }