created config options for step-ca
This commit is contained in:
John Lancaster
@@ -26,6 +26,21 @@ in
|
|||||||
"fded:fb16:653e:25da:be24:11ff:fea0:753f"
|
"fded:fb16:653e:25da:be24:11ff:fea0:753f"
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
step-ca = {
|
||||||
|
rootCertPath = ./root_ca.crt;
|
||||||
|
dnsNames = [
|
||||||
|
"${hostname}.john-stream.com"
|
||||||
|
"192.168.1.244"
|
||||||
|
];
|
||||||
|
secrets = {
|
||||||
|
sopsFile = ./secrets.yaml;
|
||||||
|
caPassword = "janus/ca_password";
|
||||||
|
intermediateCrt = "janus/intermediate_ca_crt";
|
||||||
|
intermediateKey = "janus/intermediate_ca_key";
|
||||||
|
sshHostCaKey = "janus/ssh_host_ca_key";
|
||||||
|
sshUserCaKey = "janus/ssh_user_ca_key";
|
||||||
|
};
|
||||||
|
};
|
||||||
mtls = {
|
mtls = {
|
||||||
enable = true;
|
enable = true;
|
||||||
subject = hostname;
|
subject = hostname;
|
||||||
|
|||||||
@@ -1,130 +1,165 @@
|
|||||||
{ inputs, ... }:
|
{ inputs, ... }:
|
||||||
{
|
{
|
||||||
flake.modules.nixos.step-ca = { config, pkgs, ... }:
|
flake.modules.nixos.step-ca = { config, pkgs, lib, ... }:
|
||||||
let
|
let
|
||||||
# Keep host-specific trust anchor in repo; secret/private keys come from sops.
|
cfg = config.step-ca;
|
||||||
rootCertPath = ../../hosts/janus/root_ca.crt;
|
caPasswordPath = (lib.getAttr cfg.secrets.caPassword config.sops.secrets).path;
|
||||||
caPasswordPath = config.sops.secrets."janus/ca_password".path;
|
intermediateCrtPath = (lib.getAttr cfg.secrets.intermediateCrt config.sops.secrets).path;
|
||||||
intermediateCrtPath = config.sops.secrets."janus/intermediate_ca_crt".path;
|
intermediateKeyPath = (lib.getAttr cfg.secrets.intermediateKey config.sops.secrets).path;
|
||||||
intermediateKeyPath = config.sops.secrets."janus/intermediate_ca_key".path;
|
sshHostCaKeyPath = (lib.getAttr cfg.secrets.sshHostCaKey config.sops.secrets).path;
|
||||||
sshHostCaKeyPath = config.sops.secrets."janus/ssh_host_ca_key".path;
|
sshUserCaKeyPath = (lib.getAttr cfg.secrets.sshUserCaKey config.sops.secrets).path;
|
||||||
sshUserCaKeyPath = config.sops.secrets."janus/ssh_user_ca_key".path;
|
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
# Placeholders are expected initially until real material is inserted into sops.
|
options.step-ca = {
|
||||||
sops.secrets."janus/ca_password" = {
|
rootCertPath = lib.mkOption {
|
||||||
sopsFile = ../../hosts/janus/secrets.yaml;
|
description = "Path to the Step CA root certificate served by this host.";
|
||||||
owner = "step-ca";
|
type = lib.types.path;
|
||||||
group = "step-ca";
|
};
|
||||||
mode = "0400";
|
dnsNames = lib.mkOption {
|
||||||
};
|
description = "DNS names and IP SANs advertised by this Step CA instance.";
|
||||||
sops.secrets."janus/intermediate_ca_crt" = {
|
type = with lib.types; listOf str;
|
||||||
sopsFile = ../../hosts/janus/secrets.yaml;
|
};
|
||||||
owner = "step-ca";
|
secrets = {
|
||||||
group = "step-ca";
|
sopsFile = lib.mkOption {
|
||||||
mode = "0400";
|
description = "Host-local SOPS file that stores Step CA secret material.";
|
||||||
};
|
type = lib.types.path;
|
||||||
sops.secrets."janus/intermediate_ca_key" = {
|
|
||||||
sopsFile = ../../hosts/janus/secrets.yaml;
|
|
||||||
owner = "step-ca";
|
|
||||||
group = "step-ca";
|
|
||||||
mode = "0400";
|
|
||||||
};
|
|
||||||
sops.secrets."janus/ssh_host_ca_key" = {
|
|
||||||
sopsFile = ../../hosts/janus/secrets.yaml;
|
|
||||||
owner = "step-ca";
|
|
||||||
group = "step-ca";
|
|
||||||
mode = "0400";
|
|
||||||
};
|
|
||||||
sops.secrets."janus/ssh_user_ca_key" = {
|
|
||||||
sopsFile = ../../hosts/janus/secrets.yaml;
|
|
||||||
owner = "step-ca";
|
|
||||||
group = "step-ca";
|
|
||||||
mode = "0400";
|
|
||||||
};
|
|
||||||
|
|
||||||
# https://github.com/NixOS/nixpkgs/blob/nixos-23.05/nixos/modules/services/security/step-ca.nix
|
|
||||||
services.step-ca = {
|
|
||||||
enable = true;
|
|
||||||
openFirewall = true;
|
|
||||||
address = "0.0.0.0";
|
|
||||||
port = 443;
|
|
||||||
intermediatePasswordFile = caPasswordPath;
|
|
||||||
|
|
||||||
# https://smallstep.com/docs/step-ca/configuration/#configuration-options
|
|
||||||
settings = {
|
|
||||||
root = rootCertPath;
|
|
||||||
crt = intermediateCrtPath;
|
|
||||||
key = intermediateKeyPath;
|
|
||||||
dnsNames = [
|
|
||||||
"janus.john-stream.com"
|
|
||||||
"192.168.1.244"
|
|
||||||
];
|
|
||||||
|
|
||||||
ssh = {
|
|
||||||
hostKey = sshHostCaKeyPath;
|
|
||||||
userKey = sshUserCaKeyPath;
|
|
||||||
};
|
};
|
||||||
|
caPassword = lib.mkOption {
|
||||||
db = {
|
description = "SOPS key for the Step CA intermediate password.";
|
||||||
type = "badgerv2";
|
type = lib.types.str;
|
||||||
dataSource = "/var/lib/step-ca/db";
|
|
||||||
};
|
};
|
||||||
|
intermediateCrt = lib.mkOption {
|
||||||
authority = {
|
description = "SOPS key for the Step CA intermediate certificate.";
|
||||||
backdate = "1m0s";
|
type = lib.types.str;
|
||||||
provisioners = [
|
|
||||||
{
|
|
||||||
type = "ACME";
|
|
||||||
name = "acme";
|
|
||||||
}
|
|
||||||
{
|
|
||||||
type = "SSHPOP";
|
|
||||||
name = "sshpop";
|
|
||||||
claims.enableSSHCA = true;
|
|
||||||
}
|
|
||||||
{
|
|
||||||
type = "JWK";
|
|
||||||
name = "admin";
|
|
||||||
key = {
|
|
||||||
use = "sig";
|
|
||||||
kty = "EC";
|
|
||||||
kid = "xoxgOJFbveSLIL2gm1Yu5ZiRb9v8Jxe44F56i3v-Nf8";
|
|
||||||
crv = "P-256";
|
|
||||||
alg = "ES256";
|
|
||||||
x = "zFO8hPx_eH0Iyz7UJI-w8ODMusEKCZ28M76sGWmWYxA";
|
|
||||||
y = "XIWLLyKDzqxV9UH-2KeAkKPDrgLoPrxxW9-PzkXggME";
|
|
||||||
};
|
|
||||||
encryptedKey = "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoiUVJnTnJVTF9KcmxJYkJMVTlGNVRPZyJ9.DMu7xBNCq5pr-_--YTxNr5Hrcqy6ZmSVHsWurfVXL7Hk0Q3vyYRxiw.h-CnFiYc-DhxThI3.plx3_Qa_0kU-2TwnqFNfAfGnCpfQ2e0iiCMLruNHbLMnHeXQ1BysHBqps45_02zZXIRdHoDgYGtXRSfcdUYYoS0pLoPzC6m301ZFNSAFdRVlSZ3Q6VmWdixPXXnEB4EgSKTT_wxR33L8t9OpFzD85KfY-b_Un1l99ufjCnfg-EYkcICTn_G4-8bcW3eFIvJ6setzu-l0jHMhLQdIweqncn9on9xBXBD-ANhZfP95P2BJt-APqCi8eqiAvn_vClovdg0PxzRwOVDvWREz66FDw-HTU7xDtGO9hACopT5tfZOXDoykgZw1mJsq9NEq9ZzvKG2hvyk1UXtExxrNtFo.5q1OfGU4Amo4Si-vpeI42g";
|
|
||||||
claims = {
|
|
||||||
enableSSHCA = true;
|
|
||||||
disableRenewal = false;
|
|
||||||
allowRenewalAfterExpiry = false;
|
|
||||||
disableSmallstepExtensions = false;
|
|
||||||
};
|
|
||||||
options = {
|
|
||||||
x509 = { };
|
|
||||||
ssh = { };
|
|
||||||
};
|
|
||||||
}
|
|
||||||
];
|
|
||||||
};
|
};
|
||||||
|
intermediateKey = lib.mkOption {
|
||||||
tls = {
|
description = "SOPS key for the Step CA intermediate private key.";
|
||||||
cipherSuites = [
|
type = lib.types.str;
|
||||||
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
|
};
|
||||||
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
|
sshHostCaKey = lib.mkOption {
|
||||||
];
|
description = "SOPS key for the Step SSH host CA private key.";
|
||||||
minVersion = 1.2;
|
type = lib.types.str;
|
||||||
maxVersion = 1.3;
|
};
|
||||||
renegotiation = false;
|
sshUserCaKey = lib.mkOption {
|
||||||
|
description = "SOPS key for the Step SSH user CA private key.";
|
||||||
|
type = lib.types.str;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
environment.systemPackages = with pkgs; [
|
config = {
|
||||||
step-ca
|
# Placeholders are expected initially until real material is inserted into sops.
|
||||||
step-cli
|
sops.secrets."${cfg.secrets.caPassword}" = {
|
||||||
];
|
sopsFile = cfg.secrets.sopsFile;
|
||||||
|
owner = "step-ca";
|
||||||
|
group = "step-ca";
|
||||||
|
mode = "0400";
|
||||||
|
};
|
||||||
|
sops.secrets."${cfg.secrets.intermediateCrt}" = {
|
||||||
|
sopsFile = cfg.secrets.sopsFile;
|
||||||
|
owner = "step-ca";
|
||||||
|
group = "step-ca";
|
||||||
|
mode = "0400";
|
||||||
|
};
|
||||||
|
sops.secrets."${cfg.secrets.intermediateKey}" = {
|
||||||
|
sopsFile = cfg.secrets.sopsFile;
|
||||||
|
owner = "step-ca";
|
||||||
|
group = "step-ca";
|
||||||
|
mode = "0400";
|
||||||
|
};
|
||||||
|
sops.secrets."${cfg.secrets.sshHostCaKey}" = {
|
||||||
|
sopsFile = cfg.secrets.sopsFile;
|
||||||
|
owner = "step-ca";
|
||||||
|
group = "step-ca";
|
||||||
|
mode = "0400";
|
||||||
|
};
|
||||||
|
sops.secrets."${cfg.secrets.sshUserCaKey}" = {
|
||||||
|
sopsFile = cfg.secrets.sopsFile;
|
||||||
|
owner = "step-ca";
|
||||||
|
group = "step-ca";
|
||||||
|
mode = "0400";
|
||||||
|
};
|
||||||
|
|
||||||
|
# https://github.com/NixOS/nixpkgs/blob/nixos-23.05/nixos/modules/services/security/step-ca.nix
|
||||||
|
services.step-ca = {
|
||||||
|
enable = true;
|
||||||
|
openFirewall = true;
|
||||||
|
address = "0.0.0.0";
|
||||||
|
port = 443;
|
||||||
|
intermediatePasswordFile = caPasswordPath;
|
||||||
|
|
||||||
|
# https://smallstep.com/docs/step-ca/configuration/#configuration-options
|
||||||
|
settings = {
|
||||||
|
root = cfg.rootCertPath;
|
||||||
|
crt = intermediateCrtPath;
|
||||||
|
key = intermediateKeyPath;
|
||||||
|
dnsNames = cfg.dnsNames;
|
||||||
|
|
||||||
|
ssh = {
|
||||||
|
hostKey = sshHostCaKeyPath;
|
||||||
|
userKey = sshUserCaKeyPath;
|
||||||
|
};
|
||||||
|
|
||||||
|
db = {
|
||||||
|
type = "badgerv2";
|
||||||
|
dataSource = "/var/lib/step-ca/db";
|
||||||
|
};
|
||||||
|
|
||||||
|
authority = {
|
||||||
|
backdate = "1m0s";
|
||||||
|
provisioners = [
|
||||||
|
{
|
||||||
|
type = "ACME";
|
||||||
|
name = "acme";
|
||||||
|
}
|
||||||
|
{
|
||||||
|
type = "SSHPOP";
|
||||||
|
name = "sshpop";
|
||||||
|
claims.enableSSHCA = true;
|
||||||
|
}
|
||||||
|
{
|
||||||
|
type = "JWK";
|
||||||
|
name = "admin";
|
||||||
|
key = {
|
||||||
|
use = "sig";
|
||||||
|
kty = "EC";
|
||||||
|
kid = "xoxgOJFbveSLIL2gm1Yu5ZiRb9v8Jxe44F56i3v-Nf8";
|
||||||
|
crv = "P-256";
|
||||||
|
alg = "ES256";
|
||||||
|
x = "zFO8hPx_eH0Iyz7UJI-w8ODMusEKCZ28M76sGWmWYxA";
|
||||||
|
y = "XIWLLyKDzqxV9UH-2KeAkKPDrgLoPrxxW9-PzkXggME";
|
||||||
|
};
|
||||||
|
encryptedKey = "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoiUVJnTnJVTF9KcmxJYkJMVTlGNVRPZyJ9.DMu7xBNCq5pr-_--YTxNr5Hrcqy6ZmSVHsWurfVXL7Hk0Q3vyYRxiw.h-CnFiYc-DhxThI3.plx3_Qa_0kU-2TwnqFNfAfGnCpfQ2e0iiCMLruNHbLMnHeXQ1BysHBqps45_02zZXIRdHoDgYGtXRSfcdUYYoS0pLoPzC6m301ZFNSAFdRVlSZ3Q6VmWdixPXXnEB4EgSKTT_wxR33L8t9OpFzD85KfY-b_Un1l99ufjCnfg-EYkcICTn_G4-8bcW3eFIvJ6setzu-l0jHMhLQdIweqncn9on9xBXBD-ANhZfP95P2BJt-APqCi8eqiAvn_vClovdg0PxzRwOVDvWREz66FDw-HTU7xDtGO9hACopT5tfZOXDoykgZw1mJsq9NEq9ZzvKG2hvyk1UXtExxrNtFo.5q1OfGU4Amo4Si-vpeI42g";
|
||||||
|
claims = {
|
||||||
|
enableSSHCA = true;
|
||||||
|
disableRenewal = false;
|
||||||
|
allowRenewalAfterExpiry = false;
|
||||||
|
disableSmallstepExtensions = false;
|
||||||
|
};
|
||||||
|
options = {
|
||||||
|
x509 = { };
|
||||||
|
ssh = { };
|
||||||
|
};
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
tls = {
|
||||||
|
cipherSuites = [
|
||||||
|
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
|
||||||
|
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
|
||||||
|
];
|
||||||
|
minVersion = 1.2;
|
||||||
|
maxVersion = 1.3;
|
||||||
|
renegotiation = false;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
environment.systemPackages = with pkgs; [
|
||||||
|
step-ca
|
||||||
|
step-cli
|
||||||
|
];
|
||||||
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
Reference in New Issue
Block a user