From 73f5df1832ef7beaeb10d86e9764199470d1e304 Mon Sep 17 00:00:00 2001 From: John Lancaster <32917998+jsl12@users.noreply.github.com> Date: Sun, 5 Jul 2026 10:59:58 -0500 Subject: [PATCH] WIP SSH cert wrappers --- modules/features/ssh-certs.nix | 49 ++++++++++++++ modules/hosts/janus/default.nix | 4 +- modules/services/step-ca/ssh-host.nix | 93 ++++++++------------------- 3 files changed, 77 insertions(+), 69 deletions(-) diff --git a/modules/features/ssh-certs.nix b/modules/features/ssh-certs.nix index 0ad9dd6..f1a8ea2 100644 --- a/modules/features/ssh-certs.nix +++ b/modules/features/ssh-certs.nix @@ -42,6 +42,9 @@ in type = lib.types.nullOr lib.types.str; default = "admin"; }; + provisionerPasswordFile = lib.mkOption { + type = lib.types.nullOr lib.types.str; + }; extraPrincipals = lib.mkOption { type = lib.types.listOf lib.types.str; default = [ ]; @@ -73,6 +76,9 @@ in "--principal" "$IP_ADDRESS" ] ++ lib.optionals (config.provisioner != null) [ "--provisioner" "${config.provisioner}" ] + ++ lib.optionals (config.provisionerPasswordFile != null) [ + "--provisioner-password-file" "${config.provisionerPasswordFile}" + ] ++ lib.optionals config.overwrite [ "-f" ] ++ mkPrincipalArgs config.extraPrincipals; postHook = '' @@ -81,6 +87,25 @@ in }; }); + flake.wrappers.renewHostWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: { + options = { + sshHostKeyFile = lib.mkOption { + type = lib.types.str; + default = "/etc/ssh/ssh_host_ed25519_key"; + }; + overwrite = lib.mkEnableOption "Overwrite existing cert file?"; + }; + + config = { + binName = "ssh-host-cert-renew"; + package = config.pkgs.step-cli; + extraPackages = with config.pkgs; [ systemd ]; + args = + [ "ssh" "renew" "${config.sshHostKeyFile}-cert.pub" "${config.sshHostKeyFile}" ] + ++ lib.optionals config.overwrite [ "-f" ]; + }; + }); + flake.wrappers.hostCheckWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: { options = { certPath = lib.mkOption { @@ -136,4 +161,28 @@ in args = [ "-Lf" "${config.certPath}" ]; }; }); + + flake.wrappers.renewalCheck = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: { + options = { + certPath = lib.mkOption { + type = lib.types.nullOr lib.types.str; + default = "$HOME/.ssh/id_ed25519-cert.pub"; + }; + expires-in = lib.mkOption { + type = lib.types.str; + default = "4h"; + }; + }; + config = { + binName = "ssh-renewal-check"; + package = config.pkgs.step-cli; + preHook = '' + echo "Checking SSH cert at ${config.certPath}" + ''; + args = [ + "ssh" "needs-renewal" "${config.certPath}" + "--expires-in" "${config.expires-in}" + ]; + }; + }); } \ No newline at end of file diff --git a/modules/hosts/janus/default.nix b/modules/hosts/janus/default.nix index ef0c178..fe49a96 100644 --- a/modules/hosts/janus/default.nix +++ b/modules/hosts/janus/default.nix @@ -25,8 +25,8 @@ in }; sops.defaultSopsFile = ./secrets.yaml; ssh-certs = { - hostname = hostname; - extraPrincipals = [ ipv4 ipv6 ]; + provisioner = "admin"; + extraPrincipals = [ "janus.john-stream.com" ipv4 ipv6 ]; }; step-ca = { rootCertPath = ./root_ca.crt; diff --git a/modules/services/step-ca/ssh-host.nix b/modules/services/step-ca/ssh-host.nix index f26a5ff..84758e5 100644 --- a/modules/services/step-ca/ssh-host.nix +++ b/modules/services/step-ca/ssh-host.nix @@ -2,41 +2,33 @@ flake.modules.nixos.ssh-certs = { config, pkgs, lib, ... }: let cfg = config.ssh-certs; - provisionerPasswordPath = config.sops.secrets."janus/admin_jwk".path; + wrappers = inputs.self.wrappers; sshKeyPath = "/etc/ssh/ssh_host_ed25519_key"; sshCertPath = "${sshKeyPath}-cert.pub"; - mkPrincipalArgs = principals: - lib.concatMapStringsSep " " (principal: ''--principal "${principal}"'') principals; - principalArgs = mkPrincipalArgs ([ - cfg.hostname - "${cfg.hostname}.john-stream.com" - ] ++ cfg.extraPrincipals); - sshHostCertRenew = pkgs.writeShellScriptBin "ssh-host-cert-renew" '' - set -euo pipefail - if [ ! -s "${sshKeyPath}.pub" ]; then - ${lib.getExe' pkgs.openssh "ssh-keygen"} -y -f "${sshKeyPath}" > "${sshKeyPath}.pub" - chmod 0644 "${sshKeyPath}.pub" - fi - - ${lib.getExe pkgs.step-cli} ssh certificate \ - --host --sign \ - --provisioner "${cfg.provisioner}" \ - --provisioner-password-file "${provisionerPasswordPath}" \ - ${principalArgs} \ - "${cfg.hostname}" "${sshKeyPath}.pub" - ''; - sshHostCertCheck = pkgs.writeShellScriptBin "ssh-host-cert-check" '' - ${lib.getExe' pkgs.openssh "ssh-keygen"} -Lf ${sshCertPath} - ''; + sshHostCertSign = (wrappers.signHostWrapper.apply { + inherit pkgs; + inherit (cfg) provisioner extraPrincipals; + provisionerPasswordFile = config.sops.secrets."janus/admin_jwk".path; + }).wrapper; + sshHostCertRenew = (wrappers.renewHostWrapper.apply { + inherit pkgs; + sshHostKeyFile = sshKeyPath; + overwrite = true; + }).wrapper; + sshHostCertCheck = (wrappers.hostCheckWrapper.apply { + inherit pkgs; + certPath = sshCertPath; + }).wrapper; + sshHostRenewalCheck = (wrappers.renewalCheck.apply { + inherit pkgs; + certPath = sshCertPath; + expires-in = "4h"; + }).wrapper; in { # NixOS Options options.ssh-certs = { - hostname = lib.mkOption { - description = "Networking host name to register with the CA"; - type = lib.types.str; - }; provisioner = lib.mkOption { description = "Provisioner inside Step CA to use for the SSH certificates"; type = lib.types.str; @@ -64,59 +56,30 @@ networking.nameservers = [ "192.168.1.150" ]; networking.dhcpcd.extraConfig = "nohook resolv.conf"; environment.systemPackages = [ + sshHostCertSign sshHostCertRenew + sshHostRenewalCheck sshHostCertCheck ]; systemd.services.ssh-certs-renew = { - description = "Renew Step SSH host certificate if needed"; + description = "SSH host certificate renewal"; wantedBy = [ "multi-user.target" ]; - before = [ "sshd.service" ]; after = [ "network-online.target" ]; wants = [ "network-online.target" ]; - path = with pkgs; [ coreutils systemd step-cli openssh ]; + path = with pkgs; [ step-cli systemd ]; serviceConfig = { Type = "oneshot"; User = "root"; Group = "root"; + ExecCondition = lib.getExe sshHostRenewalCheck; + ExecStart = lib.getExe sshHostCertRenew; }; - script = '' - set -euo pipefail - - renew=0 - if [ ! -s "${sshCertPath}" ]; then - echo "SSH host cert missing: ${sshCertPath}" - renew=1 - elif ${lib.getExe pkgs.step-cli} ssh needs-renewal "${sshCertPath}" --expires-in "4h"; then - echo "SSH host cert needs renewal" - renew=1 - else - rc=$? - if [ "$rc" -eq 1 ]; then - echo "SSH host cert does not need renewal" - exit 0 - fi - - if [ "$rc" -eq 2 ]; then - echo "SSH host cert missing or unreadable: ${sshCertPath}" - renew=1 - else - echo "step ssh needs-renewal failed with rc=$rc" >&2 - exit "$rc" - fi - fi - - if [ "$renew" -eq 1 ]; then - ${lib.getExe sshHostCertRenew} - ${lib.getExe sshHostCertCheck} - fi - ''; }; systemd.timers.ssh-certs-renew = { description = "Periodic Step SSH host certificate renewal"; wantedBy = [ "timers.target" ]; - timerConfig = { OnBootSec = "5m"; OnUnitActiveSec = "4h"; @@ -125,10 +88,6 @@ Unit = "ssh-certs-renew.service"; }; }; - - # Ensure sshd waits for a cert reconciliation attempt at boot. - systemd.services.sshd.wants = [ "ssh-certs-renew.service" ]; - systemd.services.sshd.after = [ "ssh-certs-renew.service" ]; }; }; } \ No newline at end of file