created config options for step-ca

modules/hosts/janus/default.nix

@@ -26,6 +26,21 @@ in
             "fded:fb16:653e:25da:be24:11ff:fea0:753f"
           ];
         };
+        step-ca = {
+          rootCertPath = ./root_ca.crt;
+          dnsNames = [
+            "${hostname}.john-stream.com"
+            "192.168.1.244"
+          ];
+          secrets = {
+            sopsFile = ./secrets.yaml;
+            caPassword = "janus/ca_password";
+            intermediateCrt = "janus/intermediate_ca_crt";
+            intermediateKey = "janus/intermediate_ca_key";
+            sshHostCaKey = "janus/ssh_host_ca_key";
+            sshUserCaKey = "janus/ssh_user_ca_key";
+          };
+        };
         mtls = {
           enable = true;
           subject = hostname;

modules/services/step-ca/step-ca.nix

@@ -1,43 +1,80 @@
 { inputs, ... }:
 {
-  flake.modules.nixos.step-ca = { config, pkgs, ... }:
+  flake.modules.nixos.step-ca = { config, pkgs, lib, ... }:
   let
-    # Keep host-specific trust anchor in repo; secret/private keys come from sops.
-    rootCertPath = ../../hosts/janus/root_ca.crt;
-    caPasswordPath = config.sops.secrets."janus/ca_password".path;
-    intermediateCrtPath = config.sops.secrets."janus/intermediate_ca_crt".path;
-    intermediateKeyPath = config.sops.secrets."janus/intermediate_ca_key".path;
-    sshHostCaKeyPath = config.sops.secrets."janus/ssh_host_ca_key".path;
-    sshUserCaKeyPath = config.sops.secrets."janus/ssh_user_ca_key".path;
+    cfg = config.step-ca;
+    caPasswordPath = (lib.getAttr cfg.secrets.caPassword config.sops.secrets).path;
+    intermediateCrtPath = (lib.getAttr cfg.secrets.intermediateCrt config.sops.secrets).path;
+    intermediateKeyPath = (lib.getAttr cfg.secrets.intermediateKey config.sops.secrets).path;
+    sshHostCaKeyPath = (lib.getAttr cfg.secrets.sshHostCaKey config.sops.secrets).path;
+    sshUserCaKeyPath = (lib.getAttr cfg.secrets.sshUserCaKey config.sops.secrets).path;
   in
   {
+    options.step-ca = {
+      rootCertPath = lib.mkOption {
+        description = "Path to the Step CA root certificate served by this host.";
+        type = lib.types.path;
+      };
+      dnsNames = lib.mkOption {
+        description = "DNS names and IP SANs advertised by this Step CA instance.";
+        type = with lib.types; listOf str;
+      };
+      secrets = {
+        sopsFile = lib.mkOption {
+          description = "Host-local SOPS file that stores Step CA secret material.";
+          type = lib.types.path;
+        };
+        caPassword = lib.mkOption {
+          description = "SOPS key for the Step CA intermediate password.";
+          type = lib.types.str;
+        };
+        intermediateCrt = lib.mkOption {
+          description = "SOPS key for the Step CA intermediate certificate.";
+          type = lib.types.str;
+        };
+        intermediateKey = lib.mkOption {
+          description = "SOPS key for the Step CA intermediate private key.";
+          type = lib.types.str;
+        };
+        sshHostCaKey = lib.mkOption {
+          description = "SOPS key for the Step SSH host CA private key.";
+          type = lib.types.str;
+        };
+        sshUserCaKey = lib.mkOption {
+          description = "SOPS key for the Step SSH user CA private key.";
+          type = lib.types.str;
+        };
+      };
+    };
+
+    config = {
       # Placeholders are expected initially until real material is inserted into sops.
-    sops.secrets."janus/ca_password" = {
-      sopsFile = ../../hosts/janus/secrets.yaml;
+      sops.secrets."${cfg.secrets.caPassword}" = {
+        sopsFile = cfg.secrets.sopsFile;
         owner = "step-ca";
         group = "step-ca";
         mode = "0400";
       };
-    sops.secrets."janus/intermediate_ca_crt" = {
-      sopsFile = ../../hosts/janus/secrets.yaml;
+      sops.secrets."${cfg.secrets.intermediateCrt}" = {
+        sopsFile = cfg.secrets.sopsFile;
         owner = "step-ca";
         group = "step-ca";
         mode = "0400";
       };
-    sops.secrets."janus/intermediate_ca_key" = {
-      sopsFile = ../../hosts/janus/secrets.yaml;
+      sops.secrets."${cfg.secrets.intermediateKey}" = {
+        sopsFile = cfg.secrets.sopsFile;
         owner = "step-ca";
         group = "step-ca";
         mode = "0400";
       };
-    sops.secrets."janus/ssh_host_ca_key" = {
-      sopsFile = ../../hosts/janus/secrets.yaml;
+      sops.secrets."${cfg.secrets.sshHostCaKey}" = {
+        sopsFile = cfg.secrets.sopsFile;
         owner = "step-ca";
         group = "step-ca";
         mode = "0400";
       };
-    sops.secrets."janus/ssh_user_ca_key" = {
-      sopsFile = ../../hosts/janus/secrets.yaml;
+      sops.secrets."${cfg.secrets.sshUserCaKey}" = {
+        sopsFile = cfg.secrets.sopsFile;
         owner = "step-ca";
         group = "step-ca";
         mode = "0400";
@@ -53,13 +90,10 @@
 
         # https://smallstep.com/docs/step-ca/configuration/#configuration-options
         settings = {
-        root = rootCertPath;
+          root = cfg.rootCertPath;
           crt = intermediateCrtPath;
           key = intermediateKeyPath;
-        dnsNames = [
-          "janus.john-stream.com"
-          "192.168.1.244"
-        ];
+          dnsNames = cfg.dnsNames;
 
           ssh = {
             hostKey = sshHostCaKeyPath;
@@ -127,4 +161,5 @@
         step-cli
       ];
     };
+  };
 }