service.nu

pki-server/src/service.nu — HTTP routes & request handlers.

API

: ~ s g_ca_cert_path ./certs/ca.crt``

: ~ s g_ca_key_path ./certs/ca.key``

: ~ s g_crl_file_path ./certs/ca.crl``

: ~ s g_index_file_path ./certs/index.txt``

: ~ s g_serial_file_path ./certs/serial``

: ~ s g_initial_certs_dir ./certs/initial``

: ~ s g_device_certs_dir ./certs/certificates``

: ~ s g_device_init_key your-device-init-key``

: ~ s g_management_key your-management-key-here``

: ~ s g_ca_cn Private PKI CA``

: ~ i g_ca_handle 0

@ pki_service_init s ca_cert s ca_key s crl_file s index_file s serial_file s initial_dir s device_dir s init_key s mgmt_key s ca_cn → b

@ _resp_json i status String json_str → HttpResponse

@ _resp_err_json i status s msg → HttpResponse

@ _resp_html i status String html → HttpResponse

@ _sanitize_device_id s raw → String

Sanitize device ID to [a-zA-Z0-9-._] and prevent directory traversal

@ _wants_json HttpRequest req → b

Check if request prefers JSON (via header or content-type)

@ handle_health HttpRequest req Params p → HttpResponse

GET /health

@ handle_ca_cert HttpRequest req Params p → HttpResponse

GET /ca-cert

@ handle_crl HttpRequest req Params p → HttpResponse

GET /crl

@ handle_init HttpRequest req Params p → HttpResponse

POST /init

@ handle_renew_initial_cert HttpRequest req Params p → HttpResponse

POST /renew_initial_cert

@ handle_request_cert_get HttpRequest req Params p → HttpResponse

GET /request-cert

@ handle_request_cert_post HttpRequest req Params p → HttpResponse

POST /request-cert

@ handle_revoke_get HttpRequest req Params p → HttpResponse

GET /revoke

@ handle_revoke_post HttpRequest req Params p → HttpResponse

POST /revoke

@ handle_index HttpRequest req Params p → HttpResponse

GET /

@ handle_api_docs HttpRequest req Params p → HttpResponse

GET /api

@ handle_style_css HttpRequest req Params p → HttpResponse

GET /css/style.css

@ handle_favicon HttpRequest req Params p → HttpResponse

GET /favicon.ico

@ pki_build_app → *HttpApp

---

auth.nu

pki-server/src/auth.nu — API Key & Device Key authentication helpers.

API

@ auth_check_api_key HttpRequest req s management_key → b

Check if request carries a valid Management API key

@ auth_check_device_key s provided_key s expected_key → b

Check if provided initialization key matches configured key

---

pki.nu

pki-server/src/pki.nu — Pure-NURL PKI Engine & CA Operations.

API

& c @ nurl_rand_fill *u buf i n → i

: PkiCert

: PkiCert {
    String cert_pem
    String key_pem
    String serial_hex
    String expires_iso
}

@ pki_cert_free PkiCert c → v

: PkiCertInfo

: PkiCertInfo {
    String serial_hex
    String cn
    b ok
}

@ pki_cert_info_free PkiCertInfo i → v

: PkiCa

: PkiCa {
    ( Vec u ) scalar
    ( Vec u ) pubkey
    String cert_pem
    String key_pem
    String cn
}

@ pki_ca_new → *PkiCa

@ pki_ca_free * PkiCa ca → v

@ _pki_rand_bytes i n → ( Vec u )

@ _pki_scalar_ok ( Vec u ) d → b

@ _pki_nibble i n → i

@ _pki_bytes_to_hex ( Vec u ) b → String

@ _pki_tlv i tag ( Vec u ) content → ( Vec u )

@ _pki_int ( Vec u ) mag → ( Vec u )

@ _pki_int1 i v → ( Vec u )

@ _pki_int_hex s hex → ( Vec u )

@ _pki_oid s hex → ( Vec u )

@ _pki_bitstring ( Vec u ) content → ( Vec u )

@ _pki_bool_true → ( Vec u )

@ _pki_push2 String st i v → v

@ _pki_utctime i unix → ( Vec u )

@ pki_iso_timestamp i unix → String

@ _pki_name s cn → ( Vec u )

@ _pki_alg_ecdsa_sha256 → ( Vec u )

@ _pki_spki ( Vec u ) pub65 → ( Vec u )

@ _pki_extensions s cn b is_ca → ( Vec u )

@ _pki_sig_der ( Vec u ) rs → ( Vec u )

@ _pki_pem s label ( Vec u ) der → String

@ pki_generate_ca s cn i validity_days → *PkiCa

@ pki_load_or_create_ca s ca_cert_path s ca_key_path s ca_cn → *PkiCa

@ pki_issue_device_cert * PkiCa ca s device_id i validity_days → PkiCert

@ pki_verify_cert ( Vec u ) ca_pubkey s cert_pem s expected_cn → b

@ pki_extract_cert_info s cert_pem → PkiCertInfo

@ pki_generate_crl * PkiCa ca ( Vec String ) revoked_serials ( Vec i ) revoked_times → String

@ pki_record_revocation s index_file_path s crl_file_path * PkiCa ca s serial_hex s cn → String

@ pki_load_crl s crl_file_path * PkiCa ca s index_file_path → String

@ pki_invalidate_initial_cert s initial_dir s device_id → b

---

ui.nu

pki-server/src/ui.nu — Server-rendered Web Interface for PKI management.

API

@ _ui_wrap s title String body String active_nav → String

Base layout wrapper

@ ui_render_index → String

@ ui_render_request_cert s error_msg → String

@ ui_render_cert_result s device_id s cert s key s ca_cert s expires → String

@ ui_render_revoke_cert s error_msg → String

@ ui_render_revoke_result s message s serial s revocation_time s crl → String

@ ui_render_api_docs → String

@ ui_default_css → String

---

main.nu

pki-server/src/main.nu — Pure-NURL Private PKI Server.

API

@ _env_or s name s default_val → String

Helper: env var or default

@ main → i