incorporated john-p14s, big squash merge of stuff
This commit is contained in:
John Lancaster
@@ -1,317 +0,0 @@
|
||||
{ inputs, lib, ... }:
|
||||
let
|
||||
# Options that will be in common between
|
||||
opts = {
|
||||
enable = lib.mkEnableOption "Enable mTLS";
|
||||
ca = {
|
||||
url = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
};
|
||||
fingerprint = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
};
|
||||
};
|
||||
subject = lib.mkOption {
|
||||
description = "The Common Name, DNS Name, or IP address that will be set as the Subject Common Name for the certificate. If no Subject Alternative Names (SANs) are configured (via the --san flag) then the subject will be set as the only SAN.";
|
||||
type = lib.types.str;
|
||||
};
|
||||
keyFilename = lib.mkOption {
|
||||
description = "String filename for the private key";
|
||||
type = lib.types.str;
|
||||
default = "key.pem";
|
||||
};
|
||||
certFilename = lib.mkOption {
|
||||
description = "String filename for the public certificate";
|
||||
type = lib.types.str;
|
||||
default = "cert.pem";
|
||||
};
|
||||
bundleFilename = lib.mkOption {
|
||||
description = "String filename for the mTLS key bundle";
|
||||
type = lib.types.str;
|
||||
default = "mtls.pem";
|
||||
};
|
||||
san = lib.mkOption {
|
||||
description = "List of SAN to give the mTLS cert";
|
||||
type = lib.types.listOf lib.types.str;
|
||||
default = [ ];
|
||||
};
|
||||
provisioner = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "admin";
|
||||
};
|
||||
lifetime = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "6h";
|
||||
};
|
||||
renew = {
|
||||
enable = lib.mkOption {
|
||||
description = "Enable automatic mTLS certificate renewal using a systemd timer.";
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
};
|
||||
onCalendar = lib.mkOption {
|
||||
description = "systemd OnCalendar schedule for mTLS certificate renewal checks.";
|
||||
type = lib.types.str;
|
||||
default = "*:1/15";
|
||||
};
|
||||
randomizedDelaySec = lib.mkOption {
|
||||
description = "Randomized delay added to renewal timer runs to avoid synchronized renewals.";
|
||||
type = lib.types.str;
|
||||
default = "5m";
|
||||
};
|
||||
user = lib.mkOption {
|
||||
description = "User account to run the mTLS renewal service as.";
|
||||
type = lib.types.str;
|
||||
default = "root";
|
||||
};
|
||||
group = lib.mkOption {
|
||||
description = "Group to run the mTLS renewal service as. Defaults to the configured renewal user when null.";
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = null;
|
||||
};
|
||||
reloadUnits = lib.mkOption {
|
||||
description = "systemd units to try-reload-or-restart after a successful certificate renewal.";
|
||||
type = lib.types.listOf lib.types.str;
|
||||
default = [ ];
|
||||
};
|
||||
postCommands = lib.mkOption {
|
||||
description = "Shell commands to run after a successful certificate renewal.";
|
||||
type = lib.types.listOf lib.types.lines;
|
||||
default = [ ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
mkMtlsRenewScript = {
|
||||
pkgs,
|
||||
tlsCert,
|
||||
tlsKey,
|
||||
mtlsBundle,
|
||||
reloadUnits ? [ ],
|
||||
postCommands ? [ ],
|
||||
systemctlArgs ? [ ],
|
||||
}:
|
||||
let
|
||||
renewReloadScript = lib.concatMapStringsSep "\n" (unit: ''
|
||||
if ${lib.getExe' pkgs.systemd "systemctl"} ${lib.escapeShellArgs systemctlArgs} --quiet is-active "${unit}"; then
|
||||
${lib.getExe' pkgs.systemd "systemctl"} ${lib.escapeShellArgs systemctlArgs} try-reload-or-restart "${unit}"
|
||||
fi
|
||||
'') reloadUnits;
|
||||
renewPostCommands = lib.concatStringsSep "\n" postCommands;
|
||||
in
|
||||
pkgs.writeShellScriptBin "mtls-renew" ''
|
||||
set -euo pipefail
|
||||
|
||||
if ${lib.getExe pkgs.step-cli} certificate needs-renewal "${tlsCert}"; then
|
||||
echo "Renewing mTLS certificate"
|
||||
else
|
||||
echo "Skipping renew"
|
||||
exit "$?"
|
||||
fi
|
||||
|
||||
${lib.getExe pkgs.step-cli} ca renew --force "${tlsCert}" "${tlsKey}"
|
||||
|
||||
umask 077
|
||||
${lib.getExe' pkgs.coreutils "cat"} "${tlsCert}" "${tlsKey}" > "${mtlsBundle}"
|
||||
|
||||
echo "Reloading units:"
|
||||
${renewReloadScript}
|
||||
|
||||
echo "Post commands:"
|
||||
${renewPostCommands}
|
||||
'';
|
||||
|
||||
mkNixosMtlsRenewService = {
|
||||
pkgs,
|
||||
tlsCert,
|
||||
tlsKey,
|
||||
mtlsBundle,
|
||||
reloadUnits ? [ ],
|
||||
postCommands ? [ ],
|
||||
user ? "root",
|
||||
group ? null,
|
||||
}:
|
||||
let
|
||||
serviceGroup = if group == null then user else group;
|
||||
renewScript = mkMtlsRenewScript {
|
||||
inherit pkgs tlsCert tlsKey mtlsBundle reloadUnits postCommands;
|
||||
};
|
||||
in
|
||||
{
|
||||
description = "Renew the mTLS certificate when Smallstep marks it ready";
|
||||
wantedBy = [ ];
|
||||
after = [ "network-online.target" ];
|
||||
wants = [ "network-online.target" ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
User = user;
|
||||
Group = serviceGroup;
|
||||
ExecStart = lib.getExe renewScript;
|
||||
};
|
||||
};
|
||||
|
||||
mkNixosMtlsRenewTimer = {
|
||||
onCalendar,
|
||||
randomizedDelaySec,
|
||||
unit ? "mtls-renew.service",
|
||||
}: {
|
||||
description = "Periodic Smallstep renewal for the mTLS certificate";
|
||||
wantedBy = [ "timers.target" ];
|
||||
timerConfig = {
|
||||
Persistent = true;
|
||||
OnCalendar = onCalendar;
|
||||
AccuracySec = "1us";
|
||||
RandomizedDelaySec = randomizedDelaySec;
|
||||
Unit = unit;
|
||||
};
|
||||
};
|
||||
|
||||
mkHomeManagerMtlsRenewService = {
|
||||
pkgs,
|
||||
tlsCert,
|
||||
tlsKey,
|
||||
mtlsBundle,
|
||||
reloadUnits ? [ ],
|
||||
postCommands ? [ ],
|
||||
}:
|
||||
let
|
||||
renewScript = mkMtlsRenewScript {
|
||||
inherit pkgs tlsCert tlsKey mtlsBundle reloadUnits postCommands;
|
||||
systemctlArgs = [ "--user" ];
|
||||
};
|
||||
in
|
||||
{
|
||||
Unit = {
|
||||
Description = "Renew the mTLS certificate when Smallstep marks it ready";
|
||||
After = [ "network-online.target" ];
|
||||
Wants = [ "network-online.target" ];
|
||||
};
|
||||
Service = {
|
||||
Type = "oneshot";
|
||||
ExecStart = lib.getExe renewScript;
|
||||
};
|
||||
};
|
||||
|
||||
mkHomeManagerMtlsRenewTimer = {
|
||||
onCalendar,
|
||||
randomizedDelaySec,
|
||||
unit ? "mtls-renew.service",
|
||||
}: {
|
||||
Unit = {
|
||||
Description = "Periodic Smallstep renewal for the mTLS certificate";
|
||||
};
|
||||
Timer = {
|
||||
Persistent = true;
|
||||
OnCalendar = onCalendar;
|
||||
AccuracySec = "1us";
|
||||
RandomizedDelaySec = randomizedDelaySec;
|
||||
Unit = unit;
|
||||
};
|
||||
Install = {
|
||||
WantedBy = [ "timers.target" ];
|
||||
};
|
||||
};
|
||||
|
||||
in
|
||||
{
|
||||
flake.modules.nixos.mtls = { config, lib, pkgs, ... }:
|
||||
let
|
||||
cfg = config.mtls;
|
||||
certDir = "/etc/step/certs";
|
||||
tlsKey = "${certDir}/${cfg.keyFilename}";
|
||||
tlsCert = "${certDir}/${cfg.certFilename}";
|
||||
mtlsBundle = "${certDir}/${cfg.bundleFilename}";
|
||||
rootCA = "${certDir}/root_ca.crt";
|
||||
sanArgs = lib.concatMapStringsSep " " (san: "--san \"${san}\"") cfg.san;
|
||||
in
|
||||
{
|
||||
options.mtls = opts;
|
||||
config = lib.mkIf cfg.enable {
|
||||
environment.systemPackages = with pkgs; lib.optionals cfg.enable [
|
||||
(writeShellScriptBin "mtls-generate" ''
|
||||
set -euo pipefail
|
||||
${lib.getExe pkgs.step-cli} ca certificate \
|
||||
${cfg.subject} ${tlsCert} ${tlsKey} \
|
||||
--provisioner ${cfg.provisioner} \
|
||||
--not-before=-5m --not-after=${cfg.lifetime} \
|
||||
${sanArgs} \
|
||||
"$@"
|
||||
cat ${tlsCert} ${tlsKey} > ${mtlsBundle}
|
||||
'')
|
||||
(writeShellScriptBin "mtls-check" ''
|
||||
${lib.getExe pkgs.openssl} x509 \
|
||||
-noout -subject -issuer \
|
||||
-ext subjectAltName,extendedKeyUsage \
|
||||
-enddate -in ${mtlsBundle}
|
||||
'')
|
||||
];
|
||||
|
||||
systemd.services.mtls-renew = lib.mkIf cfg.renew.enable (mkNixosMtlsRenewService {
|
||||
inherit pkgs tlsCert tlsKey mtlsBundle;
|
||||
inherit (cfg.renew) reloadUnits postCommands user group;
|
||||
});
|
||||
|
||||
systemd.timers.mtls-renew = lib.mkIf cfg.renew.enable (mkNixosMtlsRenewTimer {
|
||||
inherit (cfg.renew) onCalendar randomizedDelaySec;
|
||||
});
|
||||
};
|
||||
};
|
||||
|
||||
flake.modules.homeManager.mtls = { config, lib, pkgs, ... }:
|
||||
let
|
||||
cfg = config.mtls;
|
||||
certDir = cfg.certDir;
|
||||
tlsKey = "${certDir}/${cfg.keyFilename}";
|
||||
tlsCert = "${certDir}/${cfg.certFilename}";
|
||||
mtlsBundle = "${certDir}/${cfg.bundleFilename}";
|
||||
rootCA = "${certDir}/root_ca.crt";
|
||||
sanArgs = lib.concatMapStringsSep " " (san: "--san \"${san}\"") cfg.san;
|
||||
in
|
||||
{
|
||||
options.mtls = opts // {
|
||||
certDir = lib.mkOption {
|
||||
description = "String path to where the mtls certs will be stored.";
|
||||
type = lib.types.str;
|
||||
default ="${config.home.homeDirectory}/.step/certs";
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
home.file.".step/config/defaults.json".text = builtins.toJSON {
|
||||
"ca-url" = cfg.ca.url;
|
||||
fingerprint = cfg.ca.fingerprint;
|
||||
root = "${cfg.certDir}/root_ca.crt";
|
||||
};
|
||||
|
||||
home.packages = with pkgs; lib.optionals cfg.enable [
|
||||
step-cli
|
||||
(writeShellScriptBin "mtls-generate" ''
|
||||
set -euo pipefail
|
||||
${lib.getExe pkgs.step-cli} ca certificate \
|
||||
${cfg.subject} ${tlsCert} ${tlsKey} \
|
||||
--not-before=-5m --not-after=${cfg.lifetime} \
|
||||
--provisioner ${cfg.provisioner} \
|
||||
${sanArgs} \
|
||||
"$@"
|
||||
cat ${tlsCert} ${tlsKey} > ${mtlsBundle}
|
||||
'')
|
||||
(writeShellScriptBin "mtls-check" ''
|
||||
${lib.getExe pkgs.openssl} x509 \
|
||||
-noout -subject -issuer \
|
||||
-ext subjectAltName,extendedKeyUsage \
|
||||
-enddate -in ${mtlsBundle}
|
||||
'')
|
||||
(mkMtlsRenewScript { inherit pkgs tlsCert tlsKey mtlsBundle; })
|
||||
];
|
||||
|
||||
systemd.user.services.mtls-renew = lib.mkIf cfg.renew.enable (mkHomeManagerMtlsRenewService {
|
||||
inherit pkgs tlsCert tlsKey mtlsBundle;
|
||||
inherit (cfg.renew) reloadUnits postCommands;
|
||||
});
|
||||
|
||||
systemd.user.timers.mtls-renew = lib.mkIf cfg.renew.enable (mkHomeManagerMtlsRenewTimer {
|
||||
inherit (cfg.renew) onCalendar randomizedDelaySec;
|
||||
});
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -2,7 +2,6 @@
|
||||
flake.modules.nixos.step-ssh-host = { config, pkgs, lib, ... }:
|
||||
let
|
||||
cfg = config.step-ssh-host;
|
||||
rootCertPath = "/etc/step/certs/root_ca.crt";
|
||||
provisionerPasswordPath = config.sops.secrets."janus/admin_jwk".path;
|
||||
sshKeyPath = "/etc/ssh/ssh_host_ed25519_key";
|
||||
sshCertPath = "${sshKeyPath}-cert.pub";
|
||||
@@ -11,25 +10,9 @@
|
||||
# NixOS Options
|
||||
options.step-ssh-host = {
|
||||
hostname = lib.mkOption {
|
||||
description = "Networking host name";
|
||||
description = "Networking host name to register with the CA";
|
||||
type = lib.types.str;
|
||||
};
|
||||
caURL = lib.mkOption {
|
||||
description = "URL for the certificate authority";
|
||||
type = lib.types.str;
|
||||
};
|
||||
rootCertFile = {
|
||||
path = lib.mkOption {
|
||||
description = "String path to where the root_ca.crt file will be stored for the user";
|
||||
type = lib.types.str;
|
||||
default = "step/certs/root_ca.crt";
|
||||
};
|
||||
source = lib.mkOption {
|
||||
description = "Nix path to the root cert file within the repo";
|
||||
type = lib.types.path;
|
||||
default = ../../../keys/root_ca.crt;
|
||||
};
|
||||
};
|
||||
provisioner = lib.mkOption {
|
||||
description = "Provisioner inside Step CA to use for the SSH certificates";
|
||||
type = lib.types.str;
|
||||
@@ -38,6 +21,7 @@
|
||||
};
|
||||
|
||||
imports = with inputs.self.modules.nixos; [ ssh ];
|
||||
|
||||
# NixOS Config
|
||||
config = {
|
||||
ssh.certificates.enable = true;
|
||||
@@ -48,15 +32,11 @@
|
||||
};
|
||||
networking.nameservers = [ "192.168.1.150" ];
|
||||
networking.dhcpcd.extraConfig = "nohook resolv.conf";
|
||||
|
||||
environment.etc."${cfg.rootCertFile.path}".source = cfg.rootCertFile.source;
|
||||
environment.systemPackages = with pkgs; [
|
||||
step-cli
|
||||
(writeShellScriptBin "ssh-host-cert-renew" ''
|
||||
${lib.getExe pkgs.step-cli} ssh certificate \
|
||||
--host --sign \
|
||||
--root "${rootCertPath}" \
|
||||
--ca-url ${cfg.caURL} \
|
||||
--provisioner "${cfg.provisioner}" \
|
||||
--provisioner-password-file "${provisionerPasswordPath}" \
|
||||
--principal "${cfg.hostname}" \
|
||||
|
||||
Reference in New Issue
Block a user