john/dendritic
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

breaking up mtls with better wrappers

Browse Source
This commit is contained in:
John Lancaster
2026-07-05 22:59:05 -05:00
parent 39504cd856
commit 1b98c83d3f
4 changed files with 302 additions and 514 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/features/mtls/default.nix
+167
View File
@@ -0,0 +1,167 @@
{ self, inputs, lib, ... }:
let
# Options that will be in common between the nixos module and the home-manager module.
mkOpts = config: let cfg = config.mtls; in {
enable = lib.mkEnableOption "Enable mTLS";
subject = lib.mkOption {
description = "The Common Name, DNS Name, or IP address that will be set as the Subject Common Name for the certificate. If no Subject Alternative Names (SANs) are configured (via the --san flag) then the subject will be set as the only SAN.";
type = lib.types.str;
};
certDir = lib.mkOption {
description = "String path to the directory where the certs will be stored";
type = lib.types.str;
};
caFile = lib.mkOption {
description = "String path for the root CA file";
type = lib.types.str;
default = "${cfg.certDir}/root_ca.crt";
};
keyFile = lib.mkOption {
description = "String path for the private key";
type = lib.types.str;
default = "${cfg.certDir}/key.pem";
};
certFile = lib.mkOption {
description = "String path for the public cert";
type = lib.types.str;
default = "${cfg.certDir}/cert.pem";
};
bundleFile = lib.mkOption {
description = "String path for the mTLS key bundle";
type = lib.types.str;
default = "${cfg.certDir}/mtls.pem";
};
san = lib.mkOption {
description = "List of SAN to give the mTLS cert";
type = lib.types.listOf lib.types.str;
default = [ ];
};
provisioner = lib.mkOption {
type = lib.types.str;
default = "admin";
};
lifetime = lib.mkOption {
type = lib.types.str;
default = "24h";
};
renew = {
enable = lib.mkOption {
description = "Enable automatic mTLS certificate renewal using a systemd timer.";
type = lib.types.bool;
default = cfg.enable;
};
onCalendar = lib.mkOption {
description = "systemd OnCalendar schedule for mTLS certificate renewal checks.";
type = lib.types.str;
default = "*:1/15";
};
randomizedDelaySec = lib.mkOption {
description = "Randomized delay added to renewal timer runs to avoid synchronized renewals.";
type = lib.types.str;
default = "5m";
};
user = lib.mkOption {
description = "User account to run the mTLS renewal service as.";
type = lib.types.str;
default = "root";
};
group = lib.mkOption {
description = "Group to run the mTLS renewal service as. Defaults to the configured renewal user.";
type = lib.types.nullOr lib.types.str;
default = "mtls";
};
reloadUnits = lib.mkOption {
description = "systemd units to try-reload-or-restart after a successful certificate renewal.";
type = lib.types.listOf lib.types.str;
default = [ ];
};
postCommands = lib.mkOption {
description = "Shell commands to run after a successful certificate renewal.";
type = lib.types.listOf lib.types.lines;
default = [ ];
};
};
};
in
{
flake.modules.nixos.mtls = { config, lib, pkgs, ... }:
let
cfg = config.mtls;
mtlsWrappers = inputs.self.wrappers.mtls;
mtlsGenerate = mtlsWrappers.generate.apply {
inherit pkgs;
inherit (cfg) subject;
SANs = cfg.san;
provisioner = "admin";
provisionerPasswordFile = config.sops.secrets."janus/admin_jwk".path;
};
mtlsRenew = mtlsWrappers.renew.apply {
inherit pkgs;
};
mtlsCheck = mtlsWrappers.check.apply {
inherit pkgs;
};
in
{
options.mtls = (mkOpts config) // {
certDir = lib.mkOption {
description = "String path to where the mtls certs will be stored.";
type = lib.types.str;
default = "/etc/step-ca/certs";
};
bootstrap = {
enable = lib.mkOption {
description = "Enable initial mTLS issuance when cert material is missing or invalid.";
type = lib.types.bool;
default = false;
};
wantedBy = lib.mkOption {
description = "systemd targets that should pull in mtls-bootstrap.service.";
type = with lib.types; listOf str;
default = [ "multi-user.target" ];
};
after = lib.mkOption {
description = "systemd units/targets that mtls-bootstrap.service should run after.";
type = with lib.types; listOf str;
default = [ "network-online.target" ];
};
wants = lib.mkOption {
description = "systemd units/targets that mtls-bootstrap.service should pull in.";
type = with lib.types; listOf str;
default = [ "network-online.target" ];
};
provisionerPasswordFile = lib.mkOption {
description = "Optional path passed to mtls-generate as --provisioner-password-file for noninteractive issuance.";
type = lib.types.nullOr lib.types.str;
default = null;
};
};
certReaders = lib.mkOption {
description = "";
type = lib.types.listOf lib.types.str;
default = [ ];
};
};
config = lib.mkIf cfg.enable {
users.groups.certReaders = {
name = cfg.renew.group;
members = cfg.certReaders;
};
environment.systemPackages = [
mtlsGenerate.wrapper
mtlsCheck.wrapper
mtlsRenew.wrapper
];
systemd = {
packages = [ mtlsRenew.outputs.systemd-system ];
# Timer-driven oneshot: only the timer is enabled. NixOS does not
# honor the unit's [Install] section for systemd.packages, so the
# wantedBy must be set explicitly here.
timers.mtls-renew.wantedBy = [ "timers.target" ];
};
};
};
}
modules/features/mtls/mtls-wrappers.nix
+125
View File
@@ -0,0 +1,125 @@
{ self, inputs, lib, ... }:
let
mkSANArgs = sans: builtins.concatLists (map (name: [ "--san" name ]) sans);
mkOpts = config: let cfg = config.mtls; in {
certDir = lib.mkOption {
description = "String path to the directory where the certs will be stored";
type = lib.types.str;
default = "/etc/mtls";
};
keyFile = lib.mkOption {
description = "String path for the private key";
type = lib.types.str;
default = "${config.certDir}/key.pem";
};
certFile = lib.mkOption {
description = "String path for the public cert";
type = lib.types.str;
default = "${config.certDir}/cert.pem";
};
bundleFile = lib.mkOption {
description = "String path for the mTLS key bundle";
type = lib.types.str;
default = "${config.certDir}/mtls.pem";
};
subject = lib.mkOption {
description = "Subject for the cert";
type = lib.types.str;
};
provisioner = lib.mkOption {
type = lib.types.nullOr lib.types.str;
};
provisionerPasswordFile = lib.mkOption {
type = lib.types.nullOr lib.types.str;
};
overwrite = lib.mkEnableOption "Overwrite existing cert file?";
SANs = lib.mkOption {
description = "A list of Subject Alternative Names";
type = lib.types.listOf lib.types.str;
default = [ ];
};
};
in
{
flake.wrappers.mtls = {
generate = inputs.wrappers.lib.wrapModule ({ config, lib, wlib, ... }: {
options = (mkOpts config);
config = {
binName = "mtls-generate";
package = config.pkgs.step-cli;
extraPackages = with config.pkgs; [ coreutils step-cli systemd ];
preHook = "mkdir -p ${config.certDir}";
args = [
"ca" "certificate"
"${config.subject}" "${config.certFile}" "${config.keyFile}"
"--not-before" "-5m"
"--not-after" "24h"
]
++ lib.optionals (config.provisioner != null) [ "--provisioner" "${config.provisioner}" ]
++ lib.optionals (config.provisionerPasswordFile != null) [
"--provisioner-password-file" "${config.provisionerPasswordFile}"
]
++ lib.optionals config.overwrite [ "-f" ]
++ mkSANArgs config.SANs;
postHook = ''
(umask 077; cat "${config.certFile}" "${config.keyFile}" > "${config.bundleFile}")
'';
};
});
renew = inputs.wrappers.lib.wrapModule ({ config, lib, wlib, ... }: {
# https://github.com/Lassulus/wrappers#generating-systemd-services
imports = [ wlib.modules.systemd ];
options = (mkOpts config);
config = {
binName = "mtls-renew";
package = config.pkgs.step-cli;
extraPackages = with config.pkgs; [ coreutils step-cli systemd ];
args = [
"ca" "renew"
"${config.certFile}" "${config.keyFile}"
];
postHook = ''
(umask 077; cat "${config.certFile}" "${config.keyFile}" > "${config.bundleFile}")
'';
systemd = {
description = "Renew the mTLS certificate when Smallstep marks it ready";
documentation = [
"https://smallstep.com/docs/step-ca/certificate-authority-server-production"
];
startLimitIntervalSec = 0;
after = [ "network-online.target" ];
wants = [ "network-online.target" ];
serviceConfig = {
Type = lib.mkDefault "oneshot";
ExecCondition = "${lib.getExe config.pkgs.step-cli} certificate needs-renewal ${config.certFile}";
};
startAt = "hourly";
};
};
});
check = inputs.wrappers.lib.wrapModule ({ config, lib, wlib, ... }: {
options = (mkOpts config);
config = {
binName = "mtls-check";
# This pattern is necessary to wrap packages like openssl that provide more than one binary
package = config.pkgs.symlinkJoin {
name = "openssl";
paths = [ config.pkgs.openssl.bin config.pkgs.openssl.man ];
meta.mainProgram = "openssl";
};
args = [
"x509"
"-noout"
"-in" config.bundleFile
"-subject"
"-issuer"
"-ext" "subjectAltName,extendedKeyUsage"
"-enddate"
];
};
});
};
}