certdoll

a (mostly) rfc8555 compliant ACME CA server written in elixir (primary logic) and gleam (just for the UI) with a tiny bit of rust for fun

developing

use nix; direnv supported

# due to gleam issues, this may need to be ran _a lot_ over and over
# run either one until it actually finishes
mix deps.get
mix gleam.deps.get

# run the web server
mix phx.server --open

# run tests (currently not productively testing)
mix test

deploying

{ inputs, ... }: {
  import = [
    inputs.certdoll.nixosModules.default
  ];

  services.certdoll = {
    enable = true;
    host = "acme.doll";
    port = 4000;
    user = "certdoll";

    dns_server = "10.100.69.69";

    ca_certificate = config.sops.secrets."acme.ca.doll.pem".path;
    ca_private_key = config.sops.secrets."acme.ca.doll.key".path;
    ca_private_key_password = config.sops.secrets."acme.ca.doll.key_".path;
    ca_chain = config.sops.secrets."acme.ca.doll.chain.pem".path;

    secret_key_base = config.sops.secrets."secret_key_base".path;
  };
}

progress

• directory (/acme/directory)
• nonce (/acme/nonce/new)
  • wtf is this for actually?
  • oh right, security....
• orders
  • new order (/acme/order/new)
  • get order (/acme/order/<order_id>)
• accounts
  • creation (/acme/account/new)
  • get account (/acme/account/<account_id>)
  • lookup by key on new account
• authz (/acme/authz/<authz_id>)
  • dns identifier authz
    • http-01 (/acme/authz/<authz_id>/chall/http-01)
    • dns-01 (/acme/authz/<authz_id>/chall/dns-01)
      • dns-over-https
      • dns-over-udp
    • tls-alpn-01 (/acme/authz/<authz_id>/chall/tls-alpn-01)
    • dns-account-01
    • dns-persist-01
  • ip identifier authz
    • http-01 (/acme/authz/<authz_id/chall/http-01)
      • BUG: can't do http-01 against IPv6 IPs
    • tls-alpn-01 (/acme/authz/<authz_id>/chall/tls-alpn-01)
• certificate (/acme/cert/<cert_id>)
• certificate revokation
  • CRL distribution
  • revoke-cert (/acme/revoke-cert)
• key change (/acme/key-change)
• caa enforcement
• web UI
  • homepage with docs (/)
  • something to fill the terms link (/terms)
  • certificate list (/certificates)
  • identifier list (/identifiers)