john/dendritic
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

indentation

Browse Source
This commit is contained in:
John Lancaster
2026-03-16 12:05:06 -05:00
parent 4af0cf7ca7
commit a92fd22c65
1 changed files with 82 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files

164
modules/services/step-ca/mtls.nix
View File

@@ -218,94 +218,94 @@ let
in in
{ {
flake.modules.nixos.mtls = { config, lib, pkgs, ... }: flake.modules.nixos.mtls = { config, lib, pkgs, ... }:
let let
cfg = config.mtls; cfg = config.mtls;
certDir = "/etc/step/certs"; certDir = "/etc/step/certs";
tlsKey = "${certDir}/${cfg.keyFilename}"; tlsKey = "${certDir}/${cfg.keyFilename}";
tlsCert = "${certDir}/${cfg.certFilename}"; tlsCert = "${certDir}/${cfg.certFilename}";
mtlsBundle = "${certDir}/${cfg.bundleFilename}"; mtlsBundle = "${certDir}/${cfg.bundleFilename}";
rootCA = "${certDir}/root_ca.crt"; rootCA = "${certDir}/root_ca.crt";
sanArgs = lib.concatMapStringsSep " " (san: "--san \"${san}\"") cfg.san; sanArgs = lib.concatMapStringsSep " " (san: "--san \"${san}\"") cfg.san;
in in
{ {
options.mtls = opts; options.mtls = opts;
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
environment.systemPackages = with pkgs; lib.optionals cfg.enable [ environment.systemPackages = with pkgs; lib.optionals cfg.enable [
(writeShellScriptBin "mtls-generate" '' (writeShellScriptBin "mtls-generate" ''
set -euo pipefail set -euo pipefail
${lib.getExe pkgs.step-cli} ca certificate \ ${lib.getExe pkgs.step-cli} ca certificate \
${cfg.subject} ${tlsCert} ${tlsKey} \ ${cfg.subject} ${tlsCert} ${tlsKey} \
--ca-url ${cfg.caURL} \ --ca-url ${cfg.caURL} \
--root ${rootCA} \ --root ${rootCA} \
--provisioner ${cfg.provisioner} \ --provisioner ${cfg.provisioner} \
${sanArgs} ${sanArgs}
cat ${tlsCert} ${tlsKey} > ${mtlsBundle} cat ${tlsCert} ${tlsKey} > ${mtlsBundle}
'') '')
(writeShellScriptBin "mtls-check" '' (writeShellScriptBin "mtls-check" ''
${lib.getExe pkgs.openssl} x509 \ ${lib.getExe pkgs.openssl} x509 \
-noout -subject -issuer \ -noout -subject -issuer \
-ext subjectAltName,extendedKeyUsage \ -ext subjectAltName,extendedKeyUsage \
-enddate -in ${mtlsBundle} -enddate -in ${mtlsBundle}
'') '')
]; ];
systemd.services.mtls-renew = lib.mkIf cfg.renew.enable (mkNixosMtlsRenewService { systemd.services.mtls-renew = lib.mkIf cfg.renew.enable (mkNixosMtlsRenewService {
inherit pkgs tlsCert tlsKey mtlsBundle; inherit pkgs tlsCert tlsKey mtlsBundle;
inherit (cfg.renew) reloadUnits postCommands user group; inherit (cfg.renew) reloadUnits postCommands user group;
}); });
systemd.timers.mtls-renew = lib.mkIf cfg.renew.enable (mkNixosMtlsRenewTimer { systemd.timers.mtls-renew = lib.mkIf cfg.renew.enable (mkNixosMtlsRenewTimer {
inherit (cfg.renew) onCalendar randomizedDelaySec; inherit (cfg.renew) onCalendar randomizedDelaySec;
}); });
};
};
flake.modules.homeManager.mtls = { config, lib, pkgs, ... }:
let
cfg = config.mtls;
certDir = cfg.certDir;
tlsKey = "${certDir}/${cfg.keyFilename}";
tlsCert = "${certDir}/${cfg.certFilename}";
mtlsBundle = "${certDir}/${cfg.bundleFilename}";
rootCA = "${certDir}/root_ca.crt";
sanArgs = lib.concatMapStringsSep " " (san: "--san \"${san}\"") cfg.san;
in
{
options.mtls = opts // {
certDir = lib.mkOption {
description = "String path to where the mtls certs will be stored.";
type = lib.types.str;
default ="${config.home.homeDirectory}/.step/certs";
}; };
}; };
config = { flake.modules.homeManager.mtls = { config, lib, pkgs, ... }:
home.packages = with pkgs; lib.optionals cfg.enable [ let
step-cli cfg = config.mtls;
(writeShellScriptBin "mtls-generate" '' certDir = cfg.certDir;
set -euo pipefail tlsKey = "${certDir}/${cfg.keyFilename}";
${lib.getExe pkgs.step-cli} ca certificate \ tlsCert = "${certDir}/${cfg.certFilename}";
john-pc-ubuntu ${tlsCert} ${tlsKey} \ mtlsBundle = "${certDir}/${cfg.bundleFilename}";
--provisioner ${cfg.provisioner} \ rootCA = "${certDir}/root_ca.crt";
${sanArgs} sanArgs = lib.concatMapStringsSep " " (san: "--san \"${san}\"") cfg.san;
cat ${tlsCert} ${tlsKey} > ${mtlsBundle} in
'') {
(writeShellScriptBin "mtls-check" '' options.mtls = opts // {
${lib.getExe pkgs.openssl} x509 \ certDir = lib.mkOption {
-noout -subject -issuer \ description = "String path to where the mtls certs will be stored.";
-ext subjectAltName,extendedKeyUsage \ type = lib.types.str;
-enddate -in ${mtlsBundle} default ="${config.home.homeDirectory}/.step/certs";
'') };
]; };
systemd.user.services.mtls-renew = lib.mkIf cfg.renew.enable (mkHomeManagerMtlsRenewService { config = {
inherit pkgs tlsCert tlsKey mtlsBundle; home.packages = with pkgs; lib.optionals cfg.enable [
inherit (cfg.renew) reloadUnits postCommands; step-cli
}); (writeShellScriptBin "mtls-generate" ''
set -euo pipefail
${lib.getExe pkgs.step-cli} ca certificate \
john-pc-ubuntu ${tlsCert} ${tlsKey} \
--provisioner ${cfg.provisioner} \
${sanArgs}
cat ${tlsCert} ${tlsKey} > ${mtlsBundle}
'')
(writeShellScriptBin "mtls-check" ''
${lib.getExe pkgs.openssl} x509 \
-noout -subject -issuer \
-ext subjectAltName,extendedKeyUsage \
-enddate -in ${mtlsBundle}
'')
];
systemd.user.timers.mtls-renew = lib.mkIf cfg.renew.enable (mkHomeManagerMtlsRenewTimer { systemd.user.services.mtls-renew = lib.mkIf cfg.renew.enable (mkHomeManagerMtlsRenewService {
inherit (cfg.renew) onCalendar randomizedDelaySec; inherit pkgs tlsCert tlsKey mtlsBundle;
}); inherit (cfg.renew) reloadUnits postCommands;
});
systemd.user.timers.mtls-renew = lib.mkIf cfg.renew.enable (mkHomeManagerMtlsRenewTimer {
inherit (cfg.renew) onCalendar randomizedDelaySec;
});
};
}; };
};
} }