john/dendritic
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

WIP janus secrets

Browse Source
This commit is contained in:
John Lancaster
2026-07-04 11:49:58 -05:00
parent cddc369687
commit 69f492c7cc
10 changed files with 318 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/services/ssh.nix
+3 -1
View File
@@ -1,13 +1,14 @@
{ inputs, ... }:
let
userName = "john";
sshHostCAPubKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNug18oLH0vZxnibXJzMJvTWFPZTnSlhCDDVi+rHhgnIum6ZXQ4SF+VHOOAM5BbzZmMKitNJ5lcrGP15Eur7DzQ=";
sshHostCAPubKeyPath = ../hosts/janus/ssh_host_ca_key.pub;
in
{
flake.modules.nixos.ssh = { config, pkgs, lib, ... }:
let
cfg = config.ssh;
configDir = "/etc/ssh";
sshHostCAPubKey = lib.removeSuffix "\n" (builtins.readFile sshHostCAPubKeyPath);
in
{
options.ssh = {
@@ -72,6 +73,7 @@ in
identityFile = cfg.identityFile;
publicKeyFile = "${identityFile}.pub";
certificateFile = "${identityFile}-cert.pub";
sshHostCAPubKey = lib.removeSuffix "\n" (builtins.readFile sshHostCAPubKeyPath);
in
{
options.ssh = with lib; {
modules/services/step-ca/ssh-host.nix
+39 -18
View File
@@ -11,6 +11,24 @@
cfg.hostname
"${cfg.hostname}.john-stream.com"
] ++ cfg.extraPrincipals);
sshHostCertRenew = pkgs.writeShellScriptBin "ssh-host-cert-renew" ''
set -euo pipefail
if [ ! -s "${sshKeyPath}.pub" ]; then
${lib.getExe' pkgs.openssh "ssh-keygen"} -y -f "${sshKeyPath}" > "${sshKeyPath}.pub"
chmod 0644 "${sshKeyPath}.pub"
fi
${lib.getExe pkgs.step-cli} ssh certificate \
--host --sign \
--provisioner "${cfg.provisioner}" \
--provisioner-password-file "${provisionerPasswordPath}" \
${principalArgs} \
"${cfg.hostname}" "${sshKeyPath}.pub"
'';
sshHostCertCheck = pkgs.writeShellScriptBin "ssh-host-cert-check" ''
${lib.getExe' pkgs.openssh "ssh-keygen"} -Lf ${sshCertPath}
'';
in
{
# NixOS Options
@@ -45,17 +63,9 @@
};
networking.nameservers = [ "192.168.1.150" ];
networking.dhcpcd.extraConfig = "nohook resolv.conf";
environment.systemPackages = with pkgs; [
# step-cli
(writeShellScriptBin "ssh-host-cert-renew" ''
${lib.getExe pkgs.step-cli} ssh certificate \
--host --sign \
--provisioner "${cfg.provisioner}" \
--provisioner-password-file "${provisionerPasswordPath}" \
${principalArgs} \
"${cfg.hostname}" "${sshKeyPath}.pub"
'')
(writeShellScriptBin "ssh-host-cert-check" "${lib.getExe' pkgs.openssh "ssh-keygen"} -Lf ${sshCertPath}")
environment.systemPackages = [
sshHostCertRenew
sshHostCertCheck
];
systemd.services.step-ssh-host-renew = {
@@ -63,7 +73,7 @@
wantedBy = [ ];
after = [ "network-online.target" ];
wants = [ "network-online.target" ];
path = with pkgs; [ coreutils systemd step-cli openssh ];
path = with pkgs; [ coreutils systemd step-cli openssh ];
serviceConfig = {
Type = "oneshot";
User = "root";
@@ -71,8 +81,14 @@
};
script = ''
set -euo pipefail
if ${lib.getExe pkgs.step-cli} ssh needs-renewal "${sshCertPath}" --expires-in "4h"; then
echo "Renewing SSH host certificate"
renew=0
if [ ! -s "${sshCertPath}" ]; then
echo "SSH host cert missing: ${sshCertPath}"
renew=1
elif ${lib.getExe pkgs.step-cli} ssh needs-renewal "${sshCertPath}" --expires-in "4h"; then
echo "SSH host cert needs renewal"
renew=1
else
rc=$?
if [ "$rc" -eq 1 ]; then
@@ -81,12 +97,17 @@
fi
if [ "$rc" -eq 2 ]; then
echo "SSH host cert missing: ${sshCertPath}" >&2
exit 1
echo "SSH host cert missing or unreadable: ${sshCertPath}"
renew=1
else
echo "step ssh needs-renewal failed with rc=$rc" >&2
exit "$rc"
fi
fi
echo "step ssh needs-renewal failed with rc=$rc" >&2
exit "$rc"
if [ "$renew" -eq 1 ]; then
${lib.getExe sshHostCertRenew}
${lib.getExe sshHostCertCheck}
fi
'';
};