WIP with placeholder secrets

2026-07-03 22:46:49 -05:00
parent cf418ca7a0
commit 6499ad7612
12 changed files with 370 additions and 102 deletions
@@ -1,29 +1,145 @@
-{ self, inputs, ... }: {
-  flake.modules.homeManager.step-client = { config, pkgs, lib, ... }: {
-    home.file.".step/config/defaults.json".text = builtins.toJSON {
-      ca-url = "https://janus.john-stream.com/";
-      fingerprint = "2036c44f7b5901566ff7611ea6c927291ecc6d2dd00779c0eead70ec77fa10d6";
-      root = ../hosts/janus/root_ca.crt;
-    };
-    home.packages = [
-      inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.step-bootstrap
-    ];
-    # sops.secrets."step-ca-defaults" = {
-    #   sopsFile = ../hosts/janus/defaults.json;
-    #   format = "json";
-    #   key = ""; # This causes it to decode the whole file
-    #   path = "${config.home.homeDirectory}/defaults.json";
-    #   mode = "0400";
-    # };
+{ self, inputs, ... }:
+let
+  defaultCaUrl = "https://janus.john-stream.com/";
+  defaultFingerprint = "2036c44f7b5901566ff7611ea6c927291ecc6d2dd00779c0eead70ec77fa10d6";
+  defaultRoot = ../hosts/janus/root_ca.crt;
+
+  mkStepBootstrap = { pkgs, caUrl, fingerprint, install ? false }:
+    (inputs.self.wrappers.stepBootstrap.apply {
+      inherit pkgs install;
+      ca-url = caUrl;
+      inherit fingerprint;
+    }).wrapper;
+
+  mkDefaultsText = cfg: builtins.toJSON {
+    ca-url = cfg.caUrl;
+    fingerprint = cfg.fingerprint;
+    root = cfg.root;
  };
+in
+{
+  flake.modules.nixos.step-client = { config, pkgs, lib, ... }:
+    let
+      cfg = config."step-client";
+    in
+    {
+      options."step-client" = {
+        enable = lib.mkOption {
+          description = "Enable step-ca client bootstrap";
+          type = lib.types.bool;
+          default = true;
+        };
+
+        caUrl = lib.mkOption {
+          description = "The step-ca URL used for bootstrap and renewal.";
+          type = lib.types.str;
+          default = defaultCaUrl;
+        };
+
+        fingerprint = lib.mkOption {
+          description = "The SHA256 fingerprint of the step-ca root certificate.";
+          type = lib.types.str;
+          default = defaultFingerprint;
+        };
+
+        root = lib.mkOption {
+          description = "The step-ca root certificate used for bootstrap.";
+          type = lib.types.path;
+          default = defaultRoot;
+        };
+
+        certDir = lib.mkOption {
+          description = "Directory used to store root CA material for mTLS and step bootstrap.";
+          type = lib.types.str;
+          default = "/etc/step-ca/certs";
+        };
+      };
+
+      config = lib.mkIf cfg.enable {
+        environment.systemPackages = [
+          (mkStepBootstrap {
+            inherit pkgs;
+            caUrl = cfg.caUrl;
+            fingerprint = cfg.fingerprint;
+          })
+        ];
+
+        environment.etc."step-ca/defaults.json".text = mkDefaultsText cfg;
+
+        systemd.tmpfiles.rules = [
+          "d ${cfg.certDir} 0750 root root -"
+          "d /root/.step 0700 root root -"
+          "d /root/.step/config 0700 root root -"
+          "d /root/.step/certs 0700 root root -"
+          "L+ /root/.step/config/defaults.json - - - - /etc/step-ca/defaults.json"
+          "L+ /root/.step/certs/root_ca.crt - - - - ${cfg.certDir}/root_ca.crt"
+        ];
+      };
+    };
+
+  flake.modules.homeManager.step-client = { config, pkgs, lib, ... }:
+    let
+      cfg = config."step-client";
+    in
+    {
+      options."step-client" = {
+        enable = lib.mkOption {
+          description = "Enable step-ca client bootstrap";
+          type = lib.types.bool;
+          default = true;
+        };
+
+        caUrl = lib.mkOption {
+          description = "The step-ca URL used for bootstrap and renewal.";
+          type = lib.types.str;
+          default = defaultCaUrl;
+        };
+
+        fingerprint = lib.mkOption {
+          description = "The SHA256 fingerprint of the step-ca root certificate.";
+          type = lib.types.str;
+          default = defaultFingerprint;
+        };
+
+        root = lib.mkOption {
+          description = "The step-ca root certificate used for bootstrap.";
+          type = lib.types.path;
+          default = defaultRoot;
+        };
+
+        certDir = lib.mkOption {
+          description = "Directory used to store root CA material for mTLS and step bootstrap.";
+          type = lib.types.str;
+          default = "${config.home.homeDirectory}/.step/certs";
+        };
+      };
+
+      config = lib.mkIf cfg.enable (
+        let
+          certDirPath = lib.removePrefix "${config.home.homeDirectory}/" cfg.certDir;
+        in
+        {
+        home.packages = [
+          (mkStepBootstrap {
+            inherit pkgs;
+            caUrl = cfg.caUrl;
+            fingerprint = cfg.fingerprint;
+          })
+        ];
+
+        home.file.".step/config/defaults.json".text = mkDefaultsText cfg;
+        home.file."${certDirPath}/root_ca.crt".source = cfg.root;
+        }
+      );
+    };

  perSystem = { system, pkgs, lib, ... }: {
-    packages.step-bootstrap = (inputs.self.wrappers.stepBootstrap.apply {
+    packages.step-bootstrap = mkStepBootstrap {
      inherit pkgs;
-      ca-url = "https://janus.john-stream.com";
-      fingerprint = "2036c44f7b5901566ff7611ea6c927291ecc6d2dd00779c0eead70ec77fa10d6";
+      caUrl = defaultCaUrl;
+      fingerprint = defaultFingerprint;
      install = true;
-    }).wrapper;
+    };
  };

  flake.wrappers.stepBootstrap = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {