example redwax timestamping server & test case

{ config, lib, pkgs, resources, ... }:
with lib;
let
  tsWebRoot = "/data/http/ts";
  tsVhost = {
    hostName = "tss.local";
    documentRoot = "${tsWebRoot}/docroot";
    extraConfig = ''
      # backend configuration:
      #
      <IfModule mod_ca_simple.c>
        # use system clock as the time source
        CASimpleTime on
        # assign a random serial number
        CASimpleSerialRandom on
      </IfModule>

      # frontend configuration
      <IfModule mod_timestamp.c>
        <Location /timestamp>
          SetHandler timestamp
          TimestampSigningCertificate "${tsWebRoot}/keys/fullchain.pem"
          TimestampSigningKey         "${tsWebRoot}/keys/key.pem"
          TimestampDigest SHA256
          TimestampDefaultPolicy 1.2.3.4.5
          Require all granted
        </Location>
      </IfModule>
      '';
    };
  in {
    networking.firewall.enable = true;
    networking.firewall.rejectPackets = true;
    networking.firewall.allowPing = true;
    networking.firewall.allowedTCPPorts = [ 443 ];

  services.httpd = {
    enable = true;
    hostName = "localhost4";
    adminAddr = "noc@localhost";
    extraModules = [
      { name = "ca";        path = "${pkgs.apacheHttpdPackages.mod_ca}/modules/mod_ca.so"; }
      { name = "ca_simple"; path = "${pkgs.apacheHttpdPackages.mod_ca}/modules/mod_ca_simple.so"; }
      { name = "timestamp"; path = "${pkgs.apacheHttpdPackages.mod_timestamp}/modules/mod_timestamp.so"; }
    ];

    virtualHosts =
      [ {
          hostName = "localhost";
          globalRedirect = "https://localhost4/";
        }

        (tsVhost // {
          enableSSL = true;
          sslServerKey = "${tsWebRoot}/keys/key.pem";
          sslServerCert = "${tsWebRoot}/keys/fullchain.pem";
          extraConfig = tsVhost.extraConfig +
            ''
              Header always set Strict-Transport-Security "max-age=15552000"
              SSLProtocol All -SSLv2 -SSLv3
              SSLCipherSuite HIGH:!aNULL:!MD5:!EXP
              SSLHonorCipherOrder on
            '';
        })
      ];
  };
  environment.systemPackages = [ pkgs.openssl ]; # pkgs.apacheHttpdPackages.mod_ca pkgs.apacheHttpdPackages.mod_timestamp ];

  system.activationScripts.createDummyKey =
    let
      mkKeys = dir:
        ''
          dir=${dir}
          mkdir -m 0700 -p $dir
          if ! [[ -e $dir/key.pem ]]; then
            ${pkgs.openssl}/bin/openssl genrsa -out $dir/key-in.pem 1024
            ${pkgs.openssl}/bin/openssl req -new -key $dir/key-in.pem -out $dir/key.csr \
              -subj "/C=NL/ST=Zuid-Holland/L=Leiden/O=Koelie-Kerks/CN=Grote klokken doen bim-bam - timestamps server"

            ${pkgs.openssl}/bin/openssl rsa -in $dir/key-in.pem -out $dir/key.pem

            echo extendedKeyUsage=critical,timeStamping > $dir/ts.conf
            ${pkgs.openssl}/bin/openssl x509 -req -days 365 -in $dir/key.csr -signkey $dir/key.pem \
                 -out $dir/fullchain.pem -extfile $dir/ts.conf
          fi
      '';
    in
    ''
      ${mkKeys "${tsWebRoot}/keys"}
    '';
}

#
# To test:
#
# 1. generate a file to sign
#    dd if=/dev/urandom of=data.raw count=1 bs=1024
#
# 2. create a signing request for this file.
#    openssl ts -query -data data.raw -cert -sha256 -no_nonce -out request.tsq
#
# 3. offer it to the signing server:
#    curl -k -H Content-type:application/timestamp-query -H Host:tts.local --data-binary @request.tsq https://127.0.0.1/timestamp > reply.tsq
#
# 4. dump the content of the reply
#    openssl ts -reply -text -in reply.tsq
#
# 5. verify that it is actually signed & valid - and matches the has of our file.
#    openssl ts -verify -in reqply.tsq  -data data.raw -CAfile /data/http/ts/keys/fullchain.pem
#