john/dendritic
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

slight reorg

Browse Source
This commit is contained in:
John Lancaster
2026-03-15 15:44:24 -05:00
parent da2de12193
commit 9c26c962ff
3 changed files with 9 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
modules/hosts/janus.nix
View File

@@ -8,13 +8,13 @@ in
modules = with inputs.self.modules; [ modules = with inputs.self.modules; [
nixos.lxc nixos.lxc
nixos.sops nixos.sops
nixos.step-client nixos.step-ssh-host
inputs.home-manager.nixosModules.home-manager inputs.home-manager.nixosModules.home-manager
nixos."${username}" nixos."${username}"
nixos.zsh nixos.zsh
nixos.docker nixos.docker
{ {
step-client.hostname = hostname; step-ssh-host.hostname = hostname;
home-manager.users."${username}" = { home-manager.users."${username}" = {
imports = with inputs.self.modules.homeManager; [ imports = with inputs.self.modules.homeManager; [

2
modules/hosts/test-nix.nix
View File

@@ -8,7 +8,7 @@ in
modules = with inputs.self.modules; [ modules = with inputs.self.modules; [
nixos.lxc nixos.lxc
nixos.sops nixos.sops
nixos.step-client nixos.step-ssh-host
inputs.home-manager.nixosModules.home-manager inputs.home-manager.nixosModules.home-manager
nixos."${username}" nixos."${username}"
nixos.zsh nixos.zsh

20
modules/programs/step-client.nix
View File

@@ -7,9 +7,9 @@ in
# #
# NixOS Module # NixOS Module
# #
flake.modules.nixos.step-client = { config, pkgs, lib, ... }: flake.modules.nixos.step-ssh-host = { config, pkgs, lib, ... }:
let let
cfg = config.step-client; cfg = config.step-ssh-host;
stepBin = lib.getExe pkgs.step-cli; stepBin = lib.getExe pkgs.step-cli;
rootCertPath = "/etc/step/certs/root_ca.crt"; rootCertPath = "/etc/step/certs/root_ca.crt";
provisionerPasswordPath = config.sops.secrets."janus/admin_jwk".path; provisionerPasswordPath = config.sops.secrets."janus/admin_jwk".path;
@@ -18,7 +18,7 @@ in
in in
{ {
# NixOS Options # NixOS Options
options.step-client = { options.step-ssh-host = {
hostname = lib.mkOption { hostname = lib.mkOption {
type = lib.types.str; type = lib.types.str;
}; };
@@ -41,18 +41,15 @@ in
# NixOS Config # NixOS Config
config = { config = {
ssh.certificates.enable = true; ssh.certificates.enable = true;
home-manager.sharedModules = with inputs.self.modules; [
homeManager.step-client
];
sops.secrets."janus/admin_jwk" = { sops.secrets."janus/admin_jwk" = {
owner = "root"; owner = "root";
group = "root"; group = "root";
mode = "0400"; mode = "0400";
}; };
networking.nameservers = [ "192.168.1.150" ];
networking.dhcpcd.extraConfig = "nohook resolv.conf";
environment.etc."step/certs/root_ca.crt".source = cfg.rootCertFile; environment.etc."step/certs/root_ca.crt".source = cfg.rootCertFile;
environment.systemPackages = with pkgs; [ environment.systemPackages = with pkgs; [
step-cli step-cli
(writeShellScriptBin "ssh-host-cert-renew" '' (writeShellScriptBin "ssh-host-cert-renew" ''
@@ -66,13 +63,8 @@ in
--principal "${cfg.hostname}.john-stream.com" \ --principal "${cfg.hostname}.john-stream.com" \
"${cfg.hostname}" "${sshKeyPath}.pub" "${cfg.hostname}" "${sshKeyPath}.pub"
'') '')
(writeShellScriptBin "ssh-host-cert-check" '' (writeShellScriptBin "ssh-host-cert-check" "${lib.getExe' pkgs.openssh "ssh-keygen"} -Lf ${sshCertPath}")
ssh-keygen -Lf ${sshCertPath}
'')
]; ];
networking.nameservers = [ "192.168.1.150" ];
networking.dhcpcd.extraConfig = "nohook resolv.conf";
}; };
}; };