shell script improvement

bin/gen-syncthing-cert

@@ -1,5 +1,5 @@
 #!/bin/sh
-set -euo pipefail
+set -eu
 
 tmp=$(mktemp -d)
 trap 'rm -rf -- "$tmp"' EXIT

bin/gen-tls-cert

@@ -18,6 +18,14 @@ openssl req -nodes \
     -subj '/CN=lan' \
     | agenix -e secrets/tlskey.age
 
+cat > "$tmp/extfile" << EOF
+subjectAltName=DNS:roam.lan,DNS:*.roam.lan
+authorityKeyIdentifier=keyid,issuer
+basicConstraints=CA:FALSE
+keyUsage=digitalSignature,keyEncipherment
+extendedKeyUsage=serverAuth
+EOF
+
 openssl x509 -req \
     -CA "$tmp/ca.cert" \
     -CAkey "$tmp/ca.key" \
@@ -25,6 +33,6 @@ openssl x509 -req \
     -out pki/server.cert \
     -days 365 \
     -CAcreateserial \
-  -extfile <(printf "subjectAltName=DNS:roam.lan,DNS:*.roam.lan\nauthorityKeyIdentifier=keyid,issuer\nbasicConstraints=CA:FALSE\nkeyUsage=digitalSignature,keyEncipherment\nextendedKeyUsage=serverAuth")
+    -extfile "$tmp/extfile"
 
 mv "$tmp/ca.cert" pki/ca.cert