john/dendritic
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

WIP

Browse Source
This commit is contained in:
John Lancaster
2026-07-07 18:56:29 -05:00
parent b60b91926a
commit addf175fef
3 changed files with 87 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/features/ssh/ssh-wrappers.nix
+32 -20
View File
@@ -1,13 +1,14 @@
{ self, inputs, config, ... }:
let
sshCertConfig = config.optionModules.ssh-certs;
mkHostKeyFile = cfg: "${cfg.host.configDir}/${cfg.host.keyFile}";
mkPrincipalArgs = principals:
builtins.concatLists (map (principal: [ "--principal" principal ]) principals);
in
{
flake.wrappers.signHostWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
imports = [ sshCertConfig ];
config = {
config = let cfg = config.ssh-new; in {
binName = "ssh-host-cert-sign";
package = config.pkgs.step-cli;
extraPackages = with config.pkgs; [ hostname iproute2 systemd ];
@@ -30,12 +31,14 @@ in
"--principal" "$HOSTNAME"
"--principal" "$IP_ADDRESS"
]
++ lib.optionals (config.provisioner != null) [ "--provisioner" "${config.provisioner}" ]
++ lib.optionals (config.provisionerPasswordFile != null) [
"--provisioner-password-file" "${config.provisionerPasswordFile}"
++ lib.optionals (cfg.certificates.provisioner != null) [
"--provisioner" "${cfg.certificates.provisioner}"
]
++ lib.optionals config.overwrite [ "-f" ]
++ mkPrincipalArgs config.extraPrincipals;
++ lib.optionals (cfg.certificates.provisionerPasswordFile != null) [
"--provisioner-password-file" "${cfg.certificates.provisionerPasswordFile}"
]
++ lib.optionals cfg.certificates.overwrite [ "-f" ]
++ mkPrincipalArgs cfg.certificates.host.extraPrincipals;
};
});
@@ -46,8 +49,9 @@ in
package = config.pkgs.step-cli;
extraPackages = with config.pkgs; [ systemd ];
args =
[ "ssh" "renew" "${config.sshHostKeyFile}-cert.pub" "${config.sshHostKeyFile}" ]
++ lib.optionals config.overwrite [ "-f" ];
let hostKeyFile = mkHostKeyFile config.ssh-new;
in [ "ssh" "renew" "${hostKeyFile}-cert.pub" "${hostKeyFile}" ]
++ lib.optionals config.ssh-new.certificates.overwrite [ "-f" ];
};
});
@@ -57,22 +61,24 @@ in
binName = "ssh-host-cert-check";
package = config.pkgs.openssh;
exePath = lib.getExe' config.pkgs.openssh "ssh-keygen";
args = [ "-Lf" "${config.certPath}" ];
args = [ "-Lf" "${mkHostKeyFile config.ssh-new}-cert.pub" ];
};
});
flake.wrappers.signUserWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
imports = [ sshCertConfig ];
config = {
config = let cfg = config.ssh-new; in {
binName = "ssh-user-cert-sign";
package = config.pkgs.step-cli;
args = [ "ssh" "certificate" "--sign" ]
++ lib.optionals (config.provisioner != null) [ "--provisioner" "${config.provisioner}" ]
++ lib.optionals (config.provisionerPasswordFile != null) [
"--provisioner-password-file" "${config.provisionerPasswordFile}"
++ lib.optionals (cfg.certificates.provisioner != null) [
"--provisioner" "${cfg.certificates.provisioner}"
]
++ lib.optionals config.overwrite [ "-f" ]
++ mkPrincipalArgs config.validUsers;
++ lib.optionals (cfg.certificates.provisionerPasswordFile != null) [
"--provisioner-password-file" "${cfg.certificates.provisionerPasswordFile}"
]
++ lib.optionals cfg.certificates.overwrite [ "-f" ]
++ mkPrincipalArgs cfg.certificates.user.extraPrincipals;
};
});
@@ -82,21 +88,27 @@ in
binName = "ssh-user-cert-check";
package = config.pkgs.openssh;
exePath = lib.getExe' config.pkgs.openssh "ssh-keygen";
args = [ "-Lf" "${config.certPath}" ];
args = [ "-Lf" "${config.ssh-new.user.keyFile}-cert.pub" ];
};
});
flake.wrappers.renewalCheck = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
imports = [ sshCertConfig ];
config = {
config =
let
cfg = config.ssh-new;
hostKeyFile = mkHostKeyFile cfg;
hostCertFile = "${hostKeyFile}-cert.pub";
in
{
binName = "ssh-renewal-check";
package = config.pkgs.step-cli;
preHook = ''
echo "Checking SSH cert at ${config.certPath}"
echo "Checking SSH cert at ${hostCertFile}"
'';
args = [
"ssh" "needs-renewal" "${config.certPath}"
"--expires-in" "${config.expires-in}"
"ssh" "needs-renewal" hostCertFile
"--expires-in" "${cfg.certificates.host.expires-in}"
];
};
});