reorg ssh wrappers

2026-07-07 18:25:09 -05:00
parent 4f9e67208b
commit b60b91926a
5 changed files with 181 additions and 205 deletions
@@ -0,0 +1,68 @@
+{ lib, ... }: {
+  options.optionModules.ssh-certs = lib.mkOption {
+    type = lib.types.deferredModule;
+    description = "SSH certificate options";
+  };
+
+  config.optionModules.ssh-certs = { config, lib, pkgs, ... }: {
+    # Needed for some kind of de-duping when this module is used more than once?
+    key = "ssh-cert-config";
+    _file = "modules/features/ssh/config.nix";
+
+    options.ssh-new = {
+      user = {
+        keyFile = lib.mkOption {
+          type = lib.types.str;
+          default = "id_ed25519";
+        };
+      };
+      host = {
+        configDir = lib.mkOption {
+          type = lib.types.str;
+          default = "/etc/ssh";
+        };
+        keyFile = lib.mkOption {
+          description = "String path to the host private key file";
+          type = lib.types.str;
+          default = "ssh_host_ed25519_key";
+        };
+        keyType = lib.mkOption {
+          description = "OpenSSH host key type for ssh.hostKey.";
+          type = lib.types.enum [ "ed25519" "rsa" "ecdsa" ];
+          default = "ed25519";
+        };
+        extraSettings = lib.mkOption {
+          description = "Extra settings to merge";
+          type = lib.types.attrs;
+          default = { };
+        };
+        enable-scripts = lib.mkEnableOption "Enable SSH host cert management scripts";
+      };
+      certificates = {
+        provisioner = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+        };
+        host = {
+          enable = lib.mkEnableOption "Enable SSH host certs";
+          autoRenew = lib.mkEnableOption "Auto-renew the SSH host certs with a systemd service/timer";
+          extraPrincipals = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [ ];
+          };
+        };
+        user = {
+          enable = lib.mkEnableOption "Enable SSH user certs";
+          CAFile = lib.mkOption {
+            description = "Filename of the SSH user CA with the config directory";
+            type = lib.types.str;
+            default = "ssh_user_ca_key.pub";
+          };
+          extraPrincipals = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [ ];
+          };
+        };
+      };
+    };
+  };
+}