WIP CA bootstrap rework

2026-03-25 17:55:31 -05:00
parent f8c09878a1
commit 7b0f419454
7 changed files with 11 additions and 39 deletions
@@ -0,0 +1,111 @@
+{ inputs, ... }:
+let
+  username = "john";
+  hostname = "john-pc-ubuntu";
+  # testTarget = "fded:fb16:653e:25da:be24:11ff:fea0:753f"; # test-nix
+  testTarget = "fded:fb16:653e:25da:be24:11ff:fe89:1cc3"; # soteria
+in
+{
+  flake.modules.homeManager."${hostname}" = { pkgs, config, ... }:
+  let
+    flakeDir = "${config.xdg.configHome}/home-manager/jsl-dendritic";
+    certDir = "${config.mtls.certDir}";
+    CACert = "${certDir}/root_ca.crt";
+    mtlsBundle = "${certDir}/${config.mtls.bundleFilename}";
+    resticPasswordFile = "${config.xdg.configHome}/restic/password.txt";
+  in
+  {
+    imports = with inputs.self.modules.homeManager; [
+      rebuild
+      john
+      mysops
+      janus-ca
+      step-ssh-user
+      mtls
+      restic
+      docker
+      desktop
+    ];
+    targets.genericLinux.enable = true;
+
+    shell.program = "zsh";
+
+    home.username = "${username}";
+    home.homeDirectory = "/home/${username}";
+
+    home.packages = with pkgs; [
+      nixos-rebuild
+      (writeShellScriptBin "test-push" ''
+        mkdir -p /var/tmp/nix-build
+        chmod 1777 /var/tmp/nix-build
+        nixos-rebuild switch \
+          --flake ${flakeDir}#john-pc-ubuntu \
+          --target-host root@${testTarget}
+      '')
+    ];
+
+    # TODO: make this more restrictive, rather than allowing all unfree packages
+    nixpkgs.config.allowUnfree = true;
+    nixpkgs.config.permittedInsecurePackages = [ "openssl-1.1.1w" ];
+
+    homeManagerFlakeDir = flakeDir;
+    docker.enable = true;
+
+    step-ssh-user = {
+      enable = true;
+      principals = ["root" "${username}" "appdaemon"];
+      provisioner = "admin";
+    };
+    ssh = {
+      certificates.enable = true;
+      matchSets = {
+        certs = true;
+        appdaemon = true;
+        homelab = true;
+        dev = true;
+      };
+    };
+
+    # This provides the keys at build time and will be included in the nix store
+    sops.defaultSopsFile = ../../../keys/secrets.yaml;
+
+    # This will provide the edit-secrets script targeting this file
+    mysops.hostSecretFile = "${config.xdg.configHome}/home-manager/jsl-dendritic/keys/secrets.yaml";
+
+    sops.secrets."restic_password" = {
+      path = resticPasswordFile;
+      mode = "0400";
+      sopsFile = ./secrets.yaml;
+    };
+    restic = {
+      passwordFile = resticPasswordFile;
+      OnCalendar = "*:0/15";
+      paths = [ "${config.xdg.userDirs.documents}" "/conf" ];
+      exclude = [
+        "/home/*/Pictures"
+        "/home/*/Videos"
+        "/home/*/go"
+        "/home/*/snap"
+        "/home/john/john-nas"
+      ];
+    };
+    mtls = {
+      enable = true;
+      subject = hostname;
+      san = [
+        "${hostname}"
+        "192.168.1.85"
+        "spiffe://john-stream.com/ubuntu"
+      ];
+      lifetime = "1h";
+      renew.onCalendar = "*:1/10";
+    };
+  };
+
+  flake.homeConfigurations."${hostname}" = inputs.home-manager.lib.homeManagerConfiguration {
+    pkgs = import inputs.nixpkgs { system = "x86_64-linux"; };
+    modules = with inputs.self.modules; [
+      homeManager."${hostname}"
+    ];
+  };
+}