started optionModules.mtls

2026-07-05 23:58:16 -05:00
parent 118e1d8f4f
commit 4f9e67208b
2 changed files with 57 additions and 43 deletions
@@ -0,0 +1,49 @@
+{ lib, ... }: {
+  options.optionModules.mtls = lib.mkOption {
+    type = lib.types.deferredModule;
+    description = "Shared mTLS certificate option definitions, imported by the mTLS wrapper modules.";
+  };
+
+  config.optionModules.mtls = { config, lib, pkgs, ... }: {
+    key = "mtls-config";
+    _file = "modules/features/mtls/config.nix";
+    options = {
+      certDir = lib.mkOption {
+        description = "String path to the directory where the certs will be stored";
+        type = lib.types.str;
+        default = "/etc/mtls";
+      };
+      keyFile = lib.mkOption {
+        description = "String path for the private key";
+        type = lib.types.str;
+        default = "${config.certDir}/key.pem";
+      };
+      certFile = lib.mkOption {
+        description = "String path for the public cert";
+        type = lib.types.str;
+        default = "${config.certDir}/cert.pem";
+      };
+      bundleFile = lib.mkOption {
+        description = "String path for the mTLS key bundle";
+        type = lib.types.str;
+        default = "${config.certDir}/mtls.pem";
+      };
+      subject = lib.mkOption {
+        description = "Subject for the cert";
+        type = lib.types.str;
+      };
+      provisioner = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+      };
+      provisionerPasswordFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+      };
+      overwrite = lib.mkEnableOption "Overwrite existing cert file?";
+      SANs = lib.mkOption {
+        description = "A list of Subject Alternative Names";
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+      };
+    };
+  };
+}