Skip to content
Next Hat
All Statefiles
Nanocl v0.17Statefile 0.1.0

Openssl Self-Signed

Generate a self-signed SSL certificate using OpenSSL and store it as a Nanocl secret.

jobsslcertificatesecurity

Description

This job generates a self-signed SSL certificate using OpenSSL and stores it as a Nanocl secret. It is useful for testing purposes or internal services where a trusted CA-signed certificate is not required.

Synopsis

SH
nanocl state apply -s nr.next-hat.com/v0.17/openssl-self-signed -- [--help] ARGUMENTS
nanocl state rm -s nr.next-hat.com/v0.17/openssl-self-signed -- [--help] ARGUMENTS

Arguments

ArgumentTypeDescriptionDefault
--domain
Required		String——

Render locally

Render this Statefile and save the result to Statefile.yml for review before applying it.

Pass any required Statefile arguments after --.

SH
nanocl state render -s nr.next-hat.com/v0.17/openssl-self-signed -o Statefile.yml

Content

YAML
ApiVersion: v0.17
Args:
  - Name: domain
    Kind: String
    Required: true
Jobs:
  - Name: openssl-self-signed
    Ttl: 5
    Containers:
      - Image: ubuntu:25.04
        HostConfig:
          Binds:
            - /run/nanocl/nanocl.sock:/run/nanocl/nanocl.sock
        Cmd:
          - /bin/sh
          - -c
          - >
            export DEBIAN_FRONTEND=noninteractive

            apt-get update -yqq

            apt-get install -yqq openssl wget

            wget
            https://github.com/nxthat/nanocl/releases/download/nanocl-0.17.0-nightly/nanocl_0.17.0_amd64.deb

            dpkg -i nanocl_0.17.0_amd64.deb

            openssl req -x509 -newkey rsa:2048 -nodes -keyout key.pem -out
            cert.pem -days 365 -subj "/CN=${{ Args.domain }}"

            # Test if secret already exists and patch it instead

            if nanocl secret inspect tls.${{ Args.domain }} > /dev/null 2>&1;
            then
              nanocl secret patch tls.${{ Args.domain }} tls --certificate-path ./cert.pem --certificate-key-path ./key.pem
              echo "Self-signed certificate for domain '${{ Args.domain }}' has been updated and stored as secret 'tls.${{ Args.domain }}'."
            else
              nanocl secret create tls.${{ Args.domain }} tls --certificate-path ./cert.pem --certificate-key-path ./key.pem
              echo "Self-signed certificate for domain '${{ Args.domain }}' has been created and stored as secret 'tls.${{ Args.domain }}'."
            fi