sys/pki: move certificate list to certs.nix

1 files changed, 31 insertions, 0 deletions

diff --git a/sys/pki/certs.nix b/sys/pki/certs.nix
new file mode 100644
index 0000000..c191fc5
--- /dev/null
+++ b/sys/pki/certs.nix
@@ -0,0 +1,31 @@
+{
+  config.local.pki.ca = {
+    home = {
+      crl = ./public/home-crl.pem;
+      cert = ./public/home-ca.pem;
+      issuer = "root";
+
+      leaves = {
+        user-firefox.cert = ./public/home-user-firefox.pem;
+      };
+    };
+
+    mail = {
+      crl = ./public/mail-crl.pem;
+      cert = ./public/mail-ca.pem;
+      issuer = "root";
+
+      leaves = {
+        kiev.cert = ./public/mail-kiev.pem;
+        larsa.cert = ./public/mail-larsa.pem;
+      };
+    };
+
+    root = {
+      crl = ./public/root-crl.pem;
+      cert = ./public/root-ca.pem;
+      issuer = null;
+      leaves = { };
+    };
+  };
+}