WIP janus secrets

modules/features/mtls.nix

@@ -144,6 +144,33 @@ in
           type = lib.types.str;
           default = "/etc/step-ca/certs";
         };
+        bootstrap = {
+          enable = lib.mkOption {
+            description = "Enable initial mTLS issuance when cert material is missing or invalid.";
+            type = lib.types.bool;
+            default = false;
+          };
+          wantedBy = lib.mkOption {
+            description = "systemd targets that should pull in mtls-bootstrap.service.";
+            type = with lib.types; listOf str;
+            default = [ "multi-user.target" ];
+          };
+          after = lib.mkOption {
+            description = "systemd units/targets that mtls-bootstrap.service should run after.";
+            type = with lib.types; listOf str;
+            default = [ "network-online.target" ];
+          };
+          wants = lib.mkOption {
+            description = "systemd units/targets that mtls-bootstrap.service should pull in.";
+            type = with lib.types; listOf str;
+            default = [ "network-online.target" ];
+          };
+          provisionerPasswordFile = lib.mkOption {
+            description = "Optional path passed to mtls-generate as --provisioner-password-file for noninteractive issuance.";
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+          };
+        };
         certReaders = lib.mkOption {
           description = "";
           type = lib.types.listOf lib.types.str;
@@ -179,6 +206,38 @@ in
           mtlsRenewWrapper.outputs.systemd-system
         ];
 
+        systemd.services.mtls-bootstrap = lib.mkIf cfg.bootstrap.enable {
+          description = "Issue initial mTLS certificate if missing or invalid";
+          wantedBy = cfg.bootstrap.wantedBy;
+          after = cfg.bootstrap.after;
+          wants = cfg.bootstrap.wants;
+          path = with pkgs; [ coreutils step-cli ];
+          serviceConfig = {
+            Type = "oneshot";
+            User = cfg.renew.user;
+            Group = cfg.renew.group;
+          };
+          script = ''
+            set -euo pipefail
+
+            if [ -s "${cfg.certFile}" ] \
+              && [ -s "${cfg.keyFile}" ] \
+              && [ -s "${cfg.bundleFile}" ] \
+              && step certificate inspect "${cfg.certFile}" >/dev/null 2>&1; then
+              echo "mTLS certificate already exists"
+              exit 0
+            fi
+
+            echo "Issuing initial mTLS certificate"
+            cmd=(/run/current-system/sw/bin/mtls-generate)
+            ${lib.optionalString (cfg.bootstrap.provisionerPasswordFile != null) ''
+              cmd+=(--provisioner-password-file "${cfg.bootstrap.provisionerPasswordFile}")
+            ''}
+
+            "''${cmd[@]}"
+          '';
+        };
+
         systemd.timers.mtls-renew = lib.mkIf cfg.renew.enable {
           wantedBy = [ "timers.target" ];
           timerConfig = {

modules/features/step-client.nix

@@ -68,6 +68,7 @@ in
 
         systemd.tmpfiles.rules = [
           "d ${cfg.certDir} 0750 root root -"
+          "L+ ${cfg.certDir}/root_ca.crt - - - - ${cfg.root}"
           "d /root/.step 0700 root root -"
           "d /root/.step/config 0700 root root -"
           "d /root/.step/certs 0700 root root -"