From 4f9e67208bdcc606a34a18eadde2fad82078968d Mon Sep 17 00:00:00 2001
From: John Lancaster <32917998+jsl12@users.noreply.github.com>
Date: Sun, 5 Jul 2026 23:58:16 -0500
Subject: [PATCH] started optionModules.mtls

---
 modules/features/mtls/config.nix        | 49 ++++++++++++++++++++++++
 modules/features/mtls/mtls-wrappers.nix | 51 ++++---------------------
 2 files changed, 57 insertions(+), 43 deletions(-)
 create mode 100644 modules/features/mtls/config.nix

diff --git a/modules/features/mtls/config.nix b/modules/features/mtls/config.nix
new file mode 100644
index 0000000..be0676e
--- /dev/null
+++ b/modules/features/mtls/config.nix
@@ -0,0 +1,49 @@
+{ lib, ... }: {
+  options.optionModules.mtls = lib.mkOption {
+    type = lib.types.deferredModule;
+    description = "Shared mTLS certificate option definitions, imported by the mTLS wrapper modules.";
+  };
+
+  config.optionModules.mtls = { config, lib, pkgs, ... }: {
+    key = "mtls-config";
+    _file = "modules/features/mtls/config.nix";
+    options = {
+      certDir = lib.mkOption {
+        description = "String path to the directory where the certs will be stored";
+        type = lib.types.str;
+        default = "/etc/mtls";
+      };
+      keyFile = lib.mkOption {
+        description = "String path for the private key";
+        type = lib.types.str;
+        default = "${config.certDir}/key.pem";
+      };
+      certFile = lib.mkOption {
+        description = "String path for the public cert";
+        type = lib.types.str;
+        default = "${config.certDir}/cert.pem";
+      };
+      bundleFile = lib.mkOption {
+        description = "String path for the mTLS key bundle";
+        type = lib.types.str;
+        default = "${config.certDir}/mtls.pem";
+      };
+      subject = lib.mkOption {
+        description = "Subject for the cert";
+        type = lib.types.str;
+      };
+      provisioner = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+      };
+      provisionerPasswordFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+      };
+      overwrite = lib.mkEnableOption "Overwrite existing cert file?";
+      SANs = lib.mkOption {
+        description = "A list of Subject Alternative Names";
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+      };
+    };
+  };
+}
\ No newline at end of file
diff --git a/modules/features/mtls/mtls-wrappers.nix b/modules/features/mtls/mtls-wrappers.nix
index 96008e7..1ad6663 100644
--- a/modules/features/mtls/mtls-wrappers.nix
+++ b/modules/features/mtls/mtls-wrappers.nix
@@ -1,49 +1,12 @@
-{ self, inputs, lib, ... }:
+{ self, inputs, lib, config, ... }:
 let
+  mtlsConfigModule = config.optionModules.mtls;
   mkSANArgs = sans: builtins.concatLists (map (name: [ "--san" name ]) sans);
-  mkOpts = config: let cfg = config.mtls; in {
-    certDir = lib.mkOption {
-      description = "String path to the directory where the certs will be stored";
-      type = lib.types.str;
-      default = "/etc/mtls";
-    };
-    keyFile = lib.mkOption {
-      description = "String path for the private key";
-      type = lib.types.str;
-      default = "${config.certDir}/key.pem";
-    };
-    certFile = lib.mkOption {
-      description = "String path for the public cert";
-      type = lib.types.str;
-      default = "${config.certDir}/cert.pem";
-    };
-    bundleFile = lib.mkOption {
-      description = "String path for the mTLS key bundle";
-      type = lib.types.str;
-      default = "${config.certDir}/mtls.pem";
-    };
-    subject = lib.mkOption {
-      description = "Subject for the cert";
-      type = lib.types.str;
-    };
-    provisioner = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-    };
-    provisionerPasswordFile = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-    };
-    overwrite = lib.mkEnableOption "Overwrite existing cert file?";
-    SANs = lib.mkOption {
-      description = "A list of Subject Alternative Names";
-      type = lib.types.listOf lib.types.str;
-      default = [ ];
-    };
-  };
 in
 {
   flake.wrappers.mtls = {
     generate = inputs.wrappers.lib.wrapModule ({ config, lib, wlib, ... }: {
-      options = (mkOpts config);
+      imports = [ mtlsConfigModule ];
       config = {
         binName = "mtls-generate";
         package = config.pkgs.step-cli;
@@ -69,8 +32,10 @@ in
 
     renew = inputs.wrappers.lib.wrapModule ({ config, lib, wlib, ... }: {
       # https://github.com/Lassulus/wrappers#generating-systemd-services
-      imports = [ wlib.modules.systemd ];
-      options = (mkOpts config);
+      imports = [
+        wlib.modules.systemd mtlsConfigModule
+        mtlsConfigModule
+      ];
       config = {
         binName = "mtls-renew";
         package = config.pkgs.step-cli;
@@ -101,7 +66,7 @@ in
     });
 
     check = inputs.wrappers.lib.wrapModule ({ config, lib, wlib, ... }: {
-      options = (mkOpts config);
+      imports = [ mtlsConfigModule ];
       config = {
         binName = "mtls-check";
         # This pattern is necessary to wrap packages like openssl that provide more than one binary