john/dendritic
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

commonized root CA pattern

Browse Source
This commit is contained in:
John Lancaster
2026-03-15 20:14:23 -05:00
parent f9a8ad47e3
commit 832149305b
2 changed files with 14 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
modules/programs/step-client.nix
View File

@@ -29,7 +29,7 @@ in
path = lib.mkOption { path = lib.mkOption {
type = lib.types.str; type = lib.types.str;
description = "String path to where the root_ca.crt file will be stored for the user"; description = "String path to where the root_ca.crt file will be stored for the user";
default = "${config.home.homeDirectory}/.step/certs/root_ca.crt"; default = ".step/certs/root_ca.crt";
}; };
source = lib.mkOption { source = lib.mkOption {
type = lib.types.path; type = lib.types.path;
@@ -47,7 +47,7 @@ in
}; };
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
home.file.".step/certs/root_ca.crt".source = cfg.rootCertFile.source; home.file."${cfg.rootCertFile.path}".source = cfg.rootCertFile.source;
home.file.".step/config/defaults.json".text = builtins.toJSON { home.file.".step/config/defaults.json".text = builtins.toJSON {
"ca-url" = cfg.caURL; "ca-url" = cfg.caURL;
fingerprint = cfg.fingerprint; fingerprint = cfg.fingerprint;

13
modules/services/step-ca/ssh-host.nix
View File

@@ -22,11 +22,18 @@ in
type = lib.types.str; type = lib.types.str;
default = "${caURL}"; default = "${caURL}";
}; };
rootCertFile = lib.mkOption { rootCertFile = {
path = lib.mkOption {
type = lib.types.str;
description = "String path to where the root_ca.crt file will be stored for the user";
default = "step/certs/root_ca.crt";
};
source = lib.mkOption {
type = lib.types.path; type = lib.types.path;
description = "Public Step root CA certificate file from the repo."; description = "Nix path to the root cert file within the repo";
default = ../../../keys/root_ca.crt; default = ../../../keys/root_ca.crt;
}; };
};
sshHostProvisioner = lib.mkOption { sshHostProvisioner = lib.mkOption {
type = lib.types.str; type = lib.types.str;
default = "admin"; default = "admin";
@@ -45,7 +52,7 @@ in
networking.nameservers = [ "192.168.1.150" ]; networking.nameservers = [ "192.168.1.150" ];
networking.dhcpcd.extraConfig = "nohook resolv.conf"; networking.dhcpcd.extraConfig = "nohook resolv.conf";
environment.etc."step/certs/root_ca.crt".source = cfg.rootCertFile; environment.etc."${cfg.rootCertFile.path}".source = cfg.rootCertFile.source;
environment.systemPackages = with pkgs; [ environment.systemPackages = with pkgs; [
step-cli step-cli
(writeShellScriptBin "ssh-host-cert-renew" '' (writeShellScriptBin "ssh-host-cert-renew" ''