Statefile Manual

Name

Openssl Self-Signed - Generate a self-signed SSL certificate using OpenSSL and store it as a Nanocl secret.

Tags

job, ssl, certificate, security

Synopsis

nanocl state apply -s nr.next-hat.com/v0.17/openssl-self-signed -- [--help] ARGUMENTS

nanocl state rm -s nr.next-hat.com/v0.17/openssl-self-signed -- [--help] ARGUMENTS

Description

This job generates a self-signed SSL certificate using OpenSSL and stores it as a Nanocl secret. It is useful for testing purposes or internal services where a trusted CA-signed certificate is not required.

Arguments

--domain String (required)

Content

ApiVersion: v0.17
Args:
  - Name: domain
    Kind: String
    Required: true
Jobs:
  - Name: openssl-self-signed
    Ttl: 5
    Containers:
      - Image: ubuntu:25.04
        HostConfig:
          Binds:
            - /run/nanocl/nanocl.sock:/run/nanocl/nanocl.sock
        Cmd:
          - /bin/sh
          - '-c'
          - >
            export DEBIAN_FRONTEND=noninteractive

            apt-get update -yqq

            apt-get install -yqq openssl wget

            wget
            https://github.com/nxthat/nanocl/releases/download/nanocl-0.17.0-nightly/nanocl_0.17.0_amd64.deb

            dpkg -i nanocl_0.17.0_amd64.deb

            openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out
            cert.pem -days 365 -subj "/CN=${{ Args.domain }}"

            # Test if secret already exists and patch it instead

            if nanocl secret inspect tls.${{ Args.domain }} > /dev/null 2>&1;
            then
              nanocl secret patch tls.${{ Args.domain }} tls --certificate-path ./cert.pem --certificate-key-path ./key.pem
              echo "Self-signed certificate for domain '${{ Args.domain }}' has been updated and stored as secret 'tls.${{ Args.domain }}'."
            else
              nanocl secret create tls.${{ Args.domain }} tls --certificate-path ./cert.pem --certificate-key-path ./key.pem
              echo "Self-signed certificate for domain '${{ Args.domain }}' has been created and stored as secret 'tls.${{ Args.domain }}'."
            fi