john/dendritic
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

working mtls for janus system

Browse Source
This commit is contained in:
John Lancaster
2026-03-15 20:52:34 -05:00
parent 3800ae7502
commit a8a9a73e08
2 changed files with 24 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
modules/hosts/janus.nix
View File

@@ -21,6 +21,11 @@ in
hostname = hostname; hostname = hostname;
caURL = "https://janus.john-stream.com/"; caURL = "https://janus.john-stream.com/";
}; };
mtls = {
enable = true;
subject = hostname;
caURL = "https://janus.john-stream.com/";
};
home-manager.users."${username}" = { home-manager.users."${username}" = {
imports = with inputs.self.modules.homeManager; [ imports = with inputs.self.modules.homeManager; [

26
modules/services/step-ca/mtls.nix
View File

@@ -2,18 +2,27 @@
{ {
flake.modules.nixos.mtls = { config, lib, pkgs, ... }: flake.modules.nixos.mtls = { config, lib, pkgs, ... }:
let let
certDir = config.mtls.certDir; cfg = config.mtls;
tlsKey = "${certDir}/${config.mtls.keyFilename}"; certDir = cfg.certDir;
tlsCert = "${certDir}/${config.mtls.certFilename}"; tlsKey = "${certDir}/${cfg.keyFilename}";
mtlsBundle = "${certDir}/${config.mtls.bundleFilename}"; tlsCert = "${certDir}/${cfg.certFilename}";
mtlsBundle = "${certDir}/${cfg.bundleFilename}";
in in
{ {
options.mtls = { options.mtls = {
enable = lib.mkEnableOption "Enable mTLS"; enable = lib.mkEnableOption "Enable mTLS";
caURL = lib.mkOption {
description = "URL to the certificate authority";
type = lib.types.str;
};
subject = lib.mkOption {
description = "The Common Name, DNS Name, or IP address that will be set as the Subject Common Name for the certificate. If no Subject Alternative Names (SANs) are configured (via the --san flag) then the subject will be set as the only SAN.";
type = lib.types.str;
};
certDir = lib.mkOption { certDir = lib.mkOption {
description = "String path to where the mtls certs will be stored."; description = "String path to where the mtls certs will be stored.";
type = lib.types.str; type = lib.types.str;
default = "/var/lib/tls"; default = "/etc/step";
}; };
keyFilename = lib.mkOption { keyFilename = lib.mkOption {
description = "String filename for the private key"; description = "String filename for the private key";
@@ -33,10 +42,13 @@
}; };
config = { config = {
environment.systemPackages = with pkgs; [ environment.systemPackages = with pkgs; lib.optionals cfg.enable [
(writeShellScriptBin "mtls-generate" '' (writeShellScriptBin "mtls-generate" ''
set -euo pipefail
${lib.getExe pkgs.step-cli} ca certificate \ ${lib.getExe pkgs.step-cli} ca certificate \
john-pc-ubuntu ${tlsCert} ${tlsKey} \ ${cfg.subject} ${tlsCert} ${tlsKey} \
--ca-url ${cfg.caURL} \
--root ${cfg.certDir}/certs/root_ca.crt \
--provisioner admin \ --provisioner admin \
--san 192.168.1.85 \ --san 192.168.1.85 \
--san spiffe://john-stream.com/ubuntu --san spiffe://john-stream.com/ubuntu