WIP

modules/features/ssh/config.nix

@@ -41,15 +41,13 @@
       certificates = {
         provisioner = lib.mkOption {
           type = lib.types.nullOr lib.types.str;
+          default = null;
         };
-        host = {
+        provisionerPasswordFile = lib.mkOption {
-          enable = lib.mkEnableOption "Enable SSH host certs";
+          type = lib.types.nullOr lib.types.str;
-          autoRenew = lib.mkEnableOption "Auto-renew the SSH host certs with a systemd service/timer";
+          default = null;
-          extraPrincipals = lib.mkOption {
-            type = lib.types.listOf lib.types.str;
-            default = [ ];
-          };
         };
+        overwrite = lib.mkEnableOption "Overwrite existing certificate files";
         user = {
           enable = lib.mkEnableOption "Enable SSH user certs";
           CAFile = lib.mkOption {
@@ -57,10 +55,23 @@
             type = lib.types.str;
             default = "ssh_user_ca_key.pub";
           };
+          extraPrincipals = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [ "root" "john" "appdaemon" ];
+          };
+        };
+        host = {
+          enable = lib.mkEnableOption "Enable SSH host certs";
+          autoRenew = lib.mkEnableOption "Auto-renew the SSH host certs with a systemd service/timer";
           extraPrincipals = lib.mkOption {
             type = lib.types.listOf lib.types.str;
             default = [ ];
           };
+          expires-in = lib.mkOption {
+            description = "Duration passed to step ssh needs-renewal --expires-in.";
+            type = lib.types.str;
+            default = "4h";
+          };
         };
       };
     };

modules/features/ssh/default.nix

@@ -9,40 +9,47 @@ let
   mkHostScripts = { cfg, pkgs, provisionerPasswordFile ? null }: let
     hostKeyFile = "${cfg.host.configDir}/${cfg.host.keyFile}";
     hostCertFile = "${hostKeyFile}-cert.pub";
+    wrapperCfg = cfg // {
+      certificates = cfg.certificates // {
+        provisionerPasswordFile = provisionerPasswordFile;
+        overwrite = true;
+      };
+    };
   in {
     inherit hostKeyFile hostCertFile;
     sign = (wrappers.signHostWrapper.apply {
-      inherit pkgs provisionerPasswordFile;
+      inherit pkgs;
-      inherit (cfg.certificates) provisioner;
+      ssh-new = wrapperCfg;
-      inherit (cfg.certificates.host) extraPrincipals;
-      overwrite = true;
     }).wrapper;
     renew = (wrappers.renewHostWrapper.apply {
       inherit pkgs;
-      sshHostKeyFile = hostKeyFile;
+      ssh-new = wrapperCfg;
-      overwrite = true;
     }).wrapper;
     check = (wrappers.hostCheckWrapper.apply {
       inherit pkgs;
-      certPath = hostCertFile;
+      ssh-new = wrapperCfg;
     }).wrapper;
     renewalCheck = (wrappers.renewalCheck.apply {
       inherit pkgs;
-      certPath = hostCertFile;
+      ssh-new = wrapperCfg;
-      expires-in = "4h";
     }).wrapper;
   };
 
   mkUserScripts = { cfg, pkgs, provisionerPasswordFile ? null }: {
-    sign = (wrappers.signUserWrapper.apply {
+    sign = let
-      inherit pkgs provisionerPasswordFile;
+      wrapperCfg = cfg // {
-      inherit (cfg.certificates) provisioner;
+        certificates = cfg.certificates // {
-      validUsers = [ "root" "john" "appdaemon" ];
+          provisionerPasswordFile = provisionerPasswordFile;
-      overwrite = true;
+          overwrite = true;
+        };
+      };
+    in (wrappers.signUserWrapper.apply {
+      inherit pkgs;
+      ssh-new = wrapperCfg;
     }).wrapper;
     check = (wrappers.userCheckWrapper.apply {
       inherit pkgs;
-      certPath = "${cfg.user.keyFile}-cert.pub";
+      ssh-new = cfg;
     }).wrapper;
   };
 in
@@ -50,15 +57,17 @@ in
   flake.modules.nixos.ssh-new = { config, pkgs, lib, ... }:
     let
       cfg = config.ssh-new;
+      hasAdminJwk = lib.hasAttrByPath [ "sops" "secrets" "janus/admin_jwk" ] config;
+      adminJwkPath = if hasAdminJwk then config.sops.secrets."janus/admin_jwk".path else null;
       hostScripts = mkHostScripts {
         inherit cfg pkgs;
         provisionerPasswordFile = if cfg.certificates.host.autoRenew
-          then config.sops.secrets."janus/admin_jwk".path
+          then adminJwkPath
           else null;
       };
       userScripts = mkUserScripts {
         inherit cfg pkgs;
-        provisionerPasswordFile = config.sops.secrets."janus/admin_jwk".path;
+        provisionerPasswordFile = adminJwkPath;
       };
       CAknownHosts = (lib.genAttrs caPatterns (_: {
         certAuthority = true;
@@ -160,11 +169,17 @@ in
   flake.modules.homeManager.ssh-new = { config, pkgs, lib, ... }:
     let
       cfg = config.ssh-new;
+      hasAdminJwk = lib.hasAttrByPath [ "sops" "secrets" "janus/admin_jwk" ] config;
+      adminJwkPath = if hasAdminJwk then config.sops.secrets."janus/admin_jwk".path else null;
       hostScripts = mkHostScripts { inherit cfg pkgs; };
       sshHostCAContent = lib.removeSuffix "\n" (builtins.readFile sshHostCAPath);
       knownHostsText = lib.concatMapStrings
         (pattern: "@cert-authority ${pattern} ${sshHostCAContent}\n")
         caPatterns;
+      userScripts = mkUserScripts {
+        inherit cfg pkgs;
+        provisionerPasswordFile = adminJwkPath;
+      };
     in
     {
       imports = [ sshCertConfig ];
@@ -172,7 +187,11 @@ in
         home.file.".ssh/known_hosts" = lib.mkIf cfg.certificates.user.enable {
           text = knownHostsText;
         };
-        home.packages = lib.optionals cfg.host.enable-scripts [
+        home.packages = [
+          userScripts.sign
+          userScripts.check
+        ]
+        ++ lib.optionals cfg.host.enable-scripts [
           hostScripts.sign
           hostScripts.renew
           hostScripts.renewalCheck

modules/features/ssh/ssh-wrappers.nix

@@ -1,13 +1,14 @@
 { self, inputs, config, ... }:
 let
   sshCertConfig = config.optionModules.ssh-certs;
+  mkHostKeyFile = cfg: "${cfg.host.configDir}/${cfg.host.keyFile}";
   mkPrincipalArgs = principals:
     builtins.concatLists (map (principal: [ "--principal" principal ]) principals);
 in
 {
   flake.wrappers.signHostWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
     imports = [ sshCertConfig ];
-    config = {
+    config = let cfg = config.ssh-new; in {
       binName = "ssh-host-cert-sign";
       package = config.pkgs.step-cli;
       extraPackages = with config.pkgs; [ hostname iproute2 systemd ];
@@ -30,12 +31,14 @@ in
           "--principal" "$HOSTNAME"
           "--principal" "$IP_ADDRESS"
         ]
-        ++ lib.optionals (config.provisioner != null) [ "--provisioner" "${config.provisioner}" ]
+        ++ lib.optionals (cfg.certificates.provisioner != null) [
-        ++ lib.optionals (config.provisionerPasswordFile != null) [
+          "--provisioner" "${cfg.certificates.provisioner}"
-          "--provisioner-password-file" "${config.provisionerPasswordFile}"
         ]
-        ++ lib.optionals config.overwrite [ "-f" ]
+        ++ lib.optionals (cfg.certificates.provisionerPasswordFile != null) [
-        ++ mkPrincipalArgs config.extraPrincipals;
+          "--provisioner-password-file" "${cfg.certificates.provisionerPasswordFile}"
+        ]
+        ++ lib.optionals cfg.certificates.overwrite [ "-f" ]
+        ++ mkPrincipalArgs cfg.certificates.host.extraPrincipals;
     };
   });
 
@@ -46,8 +49,9 @@ in
       package = config.pkgs.step-cli;
       extraPackages = with config.pkgs; [ systemd ];
       args =
-        [ "ssh" "renew" "${config.sshHostKeyFile}-cert.pub" "${config.sshHostKeyFile}" ]
+        let hostKeyFile = mkHostKeyFile config.ssh-new;
-        ++ lib.optionals config.overwrite [ "-f" ];
+        in [ "ssh" "renew" "${hostKeyFile}-cert.pub" "${hostKeyFile}" ]
+        ++ lib.optionals config.ssh-new.certificates.overwrite [ "-f" ];
     };
   });
 
@@ -57,22 +61,24 @@ in
       binName = "ssh-host-cert-check";
       package = config.pkgs.openssh;
       exePath = lib.getExe' config.pkgs.openssh "ssh-keygen";
-      args = [ "-Lf" "${config.certPath}" ];
+      args = [ "-Lf" "${mkHostKeyFile config.ssh-new}-cert.pub" ];
     };
   });
 
   flake.wrappers.signUserWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
     imports = [ sshCertConfig ];
-    config = {
+    config = let cfg = config.ssh-new; in {
       binName = "ssh-user-cert-sign";
       package = config.pkgs.step-cli;
       args = [ "ssh" "certificate" "--sign" ]
-        ++ lib.optionals (config.provisioner != null) [ "--provisioner" "${config.provisioner}" ]
+        ++ lib.optionals (cfg.certificates.provisioner != null) [
-        ++ lib.optionals (config.provisionerPasswordFile != null) [
+          "--provisioner" "${cfg.certificates.provisioner}"
-          "--provisioner-password-file" "${config.provisionerPasswordFile}"
         ]
-        ++ lib.optionals config.overwrite [ "-f" ]
+        ++ lib.optionals (cfg.certificates.provisionerPasswordFile != null) [
-        ++ mkPrincipalArgs config.validUsers;
+          "--provisioner-password-file" "${cfg.certificates.provisionerPasswordFile}"
+        ]
+        ++ lib.optionals cfg.certificates.overwrite [ "-f" ]
+        ++ mkPrincipalArgs cfg.certificates.user.extraPrincipals;
     };
   });
 
@@ -82,21 +88,27 @@ in
       binName = "ssh-user-cert-check";
       package = config.pkgs.openssh;
       exePath = lib.getExe' config.pkgs.openssh "ssh-keygen";
-      args = [ "-Lf" "${config.certPath}" ];
+        args = [ "-Lf" "${config.ssh-new.user.keyFile}-cert.pub" ];
     };
   });
 
   flake.wrappers.renewalCheck = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
     imports = [ sshCertConfig ];
-    config = {
+    config =
+    let
+      cfg = config.ssh-new;
+      hostKeyFile = mkHostKeyFile cfg;
+      hostCertFile = "${hostKeyFile}-cert.pub";
+    in
+    {
       binName = "ssh-renewal-check";
       package = config.pkgs.step-cli;
       preHook = ''
-        echo "Checking SSH cert at ${config.certPath}"
+        echo "Checking SSH cert at ${hostCertFile}"
       '';
       args = [
-        "ssh" "needs-renewal" "${config.certPath}"
+        "ssh" "needs-renewal" hostCertFile
-        "--expires-in" "${config.expires-in}"
+        "--expires-in" "${cfg.certificates.host.expires-in}"
       ];
     };
   });