WIP with placeholder secrets
This commit is contained in:
John Lancaster
@@ -0,0 +1,37 @@
|
||||
# Janus
|
||||
|
||||
Generate passwords:
|
||||
```shell
|
||||
mkdir -p /tmp/janus-step-ca-bootstrap && chmod 700 /tmp/janus-step-ca-bootstrap && cd /tmp/janus-step-ca-bootstrap && umask 077 && openssl rand -base64 48 > ca_password.txt && openssl rand -base64 48 > admin_jwk_password.txt
|
||||
```
|
||||
|
||||
Bootstrap CA materials with SSH enabled:
|
||||
```shell
|
||||
STEPPATH=/tmp/janus-step-ca-bootstrap/step step ca init --name Janus --dns janus.john-stream.com --dns 192.168.1.244 --address :443 --provisioner admin --password-file /tmp/janus-step-ca-bootstrap/ca_password.txt --provisioner-password-file /tmp/janus-step-ca-bootstrap/admin_jwk_password.txt --ssh --deployment-type standalone --with-ca-url https://janus.john-stream.com
|
||||
```
|
||||
|
||||
Insert generated runtime CA material into `modules/hosts/janus/secrets.yaml` under `janus`:
|
||||
|
||||
- `/tmp/janus-step-ca-bootstrap/ca_password.txt` -> `ca_password`
|
||||
- `/tmp/janus-step-ca-bootstrap/step/certs/intermediate_ca.crt` -> `intermediate_ca_crt`
|
||||
- `/tmp/janus-step-ca-bootstrap/step/secrets/intermediate_ca_key` -> `intermediate_ca_key`
|
||||
- `/tmp/janus-step-ca-bootstrap/step/secrets/ssh_host_ca_key` -> `ssh_host_ca_key`
|
||||
- `/tmp/janus-step-ca-bootstrap/step/secrets/ssh_user_ca_key` -> `ssh_user_ca_key`
|
||||
|
||||
If rotating provisioner password, also set:
|
||||
|
||||
- `/tmp/janus-step-ca-bootstrap/admin_jwk_password.txt` -> `janus.admin_jwk` in `keys/secrets.yaml`
|
||||
|
||||
Secret source-of-truth after this split:
|
||||
|
||||
- `modules/hosts/janus/secrets.yaml`: Janus runtime CA secrets only (`ca_password`, `intermediate_ca_crt`, `intermediate_ca_key`, `ssh_host_ca_key`, `ssh_user_ca_key`)
|
||||
- `keys/secrets.yaml`: shared Janus provisioner secret (`janus.admin_jwk`) consumed by `step-ssh-host` across hosts
|
||||
|
||||
Then update public artifacts in repo from generated output:
|
||||
|
||||
- `modules/hosts/janus/root_ca.crt` from `/tmp/janus-step-ca-bootstrap/step/certs/root_ca.crt`
|
||||
- `modules/hosts/janus/fingerprint` from:
|
||||
```shell
|
||||
step certificate fingerprint /tmp/janus-step-ca-bootstrap/step/certs/root_ca.crt
|
||||
```
|
||||
- `modules/hosts/janus/ssh_user_ca.pub` from `/tmp/janus-step-ca-bootstrap/step/certs/ssh_user_ca_key.pub`
|
||||
@@ -4,55 +4,13 @@ let
|
||||
hostname = "janus";
|
||||
in
|
||||
{
|
||||
flake.modules.nixos.janus-ca =
|
||||
{ config, pkgs, lib, ... }:
|
||||
let
|
||||
cfg = config.janus-ca;
|
||||
johnHome = lib.attrByPath [ "users" "users" username "home" ] "/home/${username}" config;
|
||||
johnGroup = lib.attrByPath [ "users" "users" username "group" ] username config;
|
||||
cfgInEtc = lib.hasPrefix "/etc/" cfg.certDir;
|
||||
certDirEtcPath =
|
||||
if cfgInEtc then
|
||||
lib.removePrefix "/etc/" cfg.certDir
|
||||
else
|
||||
cfg.certDir;
|
||||
mkStepRules = home: user: group: [
|
||||
"d ${home}/.step 0700 ${user} ${group} -"
|
||||
"d ${home}/.step/config 0700 ${user} ${group} -"
|
||||
"d ${home}/.step/certs 0700 ${user} ${group} -"
|
||||
"L+ ${home}/.step/config/defaults.json - - - - /etc/step-ca/defaults.json"
|
||||
"L+ ${home}/.step/certs/root_ca.crt - - - - ${cfg.certDir}/root_ca.crt"
|
||||
];
|
||||
in
|
||||
{
|
||||
options.janus-ca = {
|
||||
certDir = lib.mkOption {
|
||||
description = "String path to where the mtls certs will be stored.";
|
||||
type = lib.types.str;
|
||||
default = "/etc/step-ca/certs";
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
environment.etc = lib.mkIf cfgInEtc {
|
||||
"step-ca/defaults.json".text = builtins.toJSON {
|
||||
ca-url = "https://janus.john-stream.com/";
|
||||
fingerprint = "2036c44f7b5901566ff7611ea6c927291ecc6d2dd00779c0eead70ec77fa10d6";
|
||||
root = ./root_ca.crt;
|
||||
};
|
||||
};
|
||||
systemd.tmpfiles.rules =
|
||||
mkStepRules johnHome username johnGroup
|
||||
++ mkStepRules "/root" "root" "root";
|
||||
};
|
||||
};
|
||||
|
||||
flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
|
||||
modules = with inputs.self.modules; [
|
||||
nixos.lxc
|
||||
nixos.mysops
|
||||
nixos.step-ssh-host
|
||||
nixos.janus-ca
|
||||
nixos.step-client
|
||||
nixos.step-ca
|
||||
inputs.home-manager.nixosModules.home-manager
|
||||
nixos."${username}"
|
||||
nixos.docker
|
||||
@@ -60,7 +18,7 @@ in
|
||||
nixos.mtls
|
||||
({ lib, pkgs, ... }: {
|
||||
networking.hostName = hostname;
|
||||
sops.defaultSopsFile = ../../../keys/secrets.yaml;
|
||||
sops.defaultSopsFile = ./secrets.yaml;
|
||||
step-ssh-host = {
|
||||
hostname = hostname;
|
||||
extraPrincipals = [
|
||||
@@ -90,6 +48,7 @@ in
|
||||
home-manager.users."${username}" = {
|
||||
imports = with inputs.self.modules.homeManager; [
|
||||
mysops
|
||||
step-client
|
||||
];
|
||||
docker.enable = true;
|
||||
};
|
||||
|
||||
@@ -0,0 +1,30 @@
|
||||
janus:
|
||||
ca_password: ENC[AES256_GCM,data:GmuqoePDJd5Cn7+sWbvXPlGoUf3SVgYnHOoq9mnPWNWj,iv:VY/8olA+yu66wW+RbhD58GtA0YUWuAtm1HUXtNIIuLk=,tag:fCz3x6B4UPw+XpJE0F3t/g==,type:str]
|
||||
intermediate_ca_crt: ENC[AES256_GCM,data:9W6QXGlcPdfas1ea6S3w1OYI/SeF6YDIdF5J7Hv4ype3,iv:H8oVfbMLBRvU0ywovVSB84g0q1wPhHEdzfpIVAY0Bkg=,tag:7/pU0N1SlfC1i8H2IgPGVA==,type:str]
|
||||
intermediate_ca_key: ENC[AES256_GCM,data:wrzE8pgSZrtMA2jyLuVhMFxr47ICDBUkqOFyFJex9h3g,iv:I3Sz07e+cFDOUunCu7ZGcAjckRJDy3NmTXoB0vtA0HI=,tag:inANSVzyAzWlX4J5pheY8A==,type:str]
|
||||
ssh_host_ca_key: ENC[AES256_GCM,data:IT3PcnbrexRDvxoVEyyxYBx7+Brm3SzVP3Yr2UGkFjeH,iv:edfMiRR+EVx9veTH+mEAFtEdC/rlW8uU5jMD8UX2Ylo=,tag:KKS/2GQE8V6obbjfMLspug==,type:str]
|
||||
ssh_user_ca_key: ENC[AES256_GCM,data:w3gc97CYUODNxk0gIyghd9PCksDVvrdvl8j/NQe/tCtw,iv:WbWlVCPV7niVHEJ9sVcO9SAcLSfquE/bvcR5KClxszk=,tag:08uj+lv9MflYOtQh28K6pw==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCTEFTSy96QTluaWo0bURH
|
||||
YlpFSWx3VnYvSHpDYU1PNmZrb0FuVHVTcG00CmJnT09OZEJad01OZk8zUzlPT1Ft
|
||||
bVpHeW9UMXZYN1JJQVgrTk9OamhZeXcKLS0tIFhXMVNDQjhVcUp2aHhjenlGVW9z
|
||||
cTNPalJOQVJNQWxzMnVMT1lYQS9SNW8KWapdX8dwxEvcqhKI8RJmCWRrV7sRmS72
|
||||
sUt6HaUGpQfUQ97MtS01DYaSZjbAvj8t//mXhLubZddDTtTuhbpjAg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1ykcs39e62pz3xu6cedg8ea685kv5d5qsrhgkndygzm8rx30xd5ys5t3qxt
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWcnVWS2lpMDM5VWxLWDIx
|
||||
R0xWQ3ZOaEVFNTR5bXArNTc4MzFOM2xCQWhjCnBZeUtJQ3RvWDdZeVRpRzBPbTl2
|
||||
M3FOTlRnTDhIaGg2VzM3MFVEc1FVUmcKLS0tIDAzeDlaZGt5Q2dJbzNWRVB4Qmwr
|
||||
SWpxcytNdEFBQ2o0Q3lWSHZSNEdCUUEKgHE0j678WIhcQQsZQ5RcQNkQcP++ibvr
|
||||
ZT3ScL4PAYhH+lxciJK4tit53taevbp5o0jFibaup4ByDvgj7HPclw==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1gvplss0ddmyf6vpjy363wu3n057vhm0j6n7tc94cxd8kadapypws5mtaj0
|
||||
lastmodified: "2026-07-04T03:42:39Z"
|
||||
mac: ENC[AES256_GCM,data:qBuVJo9F5IiQGDqji0ZfNH6MYYLgaVuEoHGsvejw1ffFjYeqGI5LrZmez8xTx8dymQADCDYINZNYlKxgXaXdGqrlKaU8GzuWeF7M0Ad43+S/8DbP2OGPXERHAH+IWVjvzlurXs4tWE4ULw4PbsVpWqOBaSk603N7cuy7Ztwfk8M=,iv:lceVJAeZi8FwKo8DAET1hgUi54Bu+0kjWcGEZxs5wCA=,tag:mFkqan9BHtI6NkxqbjkIcQ==,type:str]
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.13.1
|
||||
Reference in New Issue
Block a user