WIP CA bootstrap rework

2026-03-25 17:55:31 -05:00
parent f8c09878a1
commit 7b0f419454
7 changed files with 11 additions and 39 deletions
@@ -0,0 +1,61 @@
+{ inputs, ... }:
+let
+  username = "john";
+  hostname = "janus";
+in
+{
+  flake.modules.homeManager.janus-ca = { config, ... }: {
+    home.file.".step/config/defaults.json".text = builtins.toJSON {
+      "ca-url" = "https://janus.john-stream.com/";
+      fingerprint = "2036c44f7b5901566ff7611ea6c927291ecc6d2dd00779c0eead70ec77fa10d6";
+      root = (builtins.readFile ./root_ca.crt);
+    };
+  };
+
+  flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
+    modules = with inputs.self.modules; [
+      nixos.lxc
+      nixos.mysops
+      nixos.step-ssh-host
+      inputs.home-manager.nixosModules.home-manager
+      nixos."${username}"
+      nixos.zsh
+      nixos.docker
+      nixos.login-text
+      nixos.mtls
+      {
+        networking.hostName = hostname;
+        step-ssh-host = {
+          hostname = hostname;
+        };
+        mtls = {
+          enable = true;
+          subject = hostname;
+          san = [
+            "${hostname}.john-stream.com"
+            "192.168.1.244"
+          ];
+        };
+
+        home-manager.users."${username}" = {
+          imports = with inputs.self.modules.homeManager; [
+            sops
+            step-ssh-user
+            janus-ca
+          ];
+          
+          shell.program = "zsh";
+          docker.enable = true;
+          # step-ssh-user = {
+          #   enable = true;
+          #   principals = [ "${hostname}" ];
+          # };
+          ssh.matchSets = {
+            certs = true;
+            homelab = true;
+          };
+        };
+      }
+    ];
+  };
+}
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBlDCCATqgAwIBAgIRAKDvqOX8WVhJ/ev02Y1gXKQwCgYIKoZIzj0EAwIwKDEO
+MAwGA1UEChMFSmFudXMxFjAUBgNVBAMTDUphbnVzIFJvb3QgQ0EwHhcNMjUxMjE4
+MDYwMjI4WhcNMzUxMjE2MDYwMjI4WjAoMQ4wDAYDVQQKEwVKYW51czEWMBQGA1UE
+AxMNSmFudXMgUm9vdCBDQTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABMt6kNpx
+Q9vySc1N6F9jJObeQXZI+9f33E1cN4zbEuNpmtpRl0WaPa1AGNbSi5sIbiH7wDv2
+llXfCqYWkeoCE5mjRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/
+AgEBMB0GA1UdDgQWBBRo55byyyo2sePP+8zz+uM4mXNV+zAKBggqhkjOPQQDAgNI
+ADBFAiB6zxTbvWMZWgDQhKGh+MnGQQ7f8UGhzinOfRG7a/HdOAIhAIVWt6MLl6QU
+FOvl/qIFGd7YJeWU5aahPABVttxjSMn/
+-----END CERTIFICATE-----