john/dendritic
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

reorg ssh wrappers

Browse Source
This commit is contained in:
John Lancaster
2026-07-07 18:25:09 -05:00
parent 4f9e67208b
commit b60b91926a
5 changed files with 181 additions and 205 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/features/ssh/ssh-wrappers.nix
+8 -64
View File
@@ -1,25 +1,12 @@
{ self, inputs, ... }:
{ self, inputs, config, ... }:
let
sshCertConfig = config.optionModules.ssh-certs;
mkPrincipalArgs = principals:
builtins.concatLists (map (principal: [ "--principal" principal ]) principals);
in
{
flake.wrappers.signHostWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
options = {
provisioner = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = "admin";
};
provisionerPasswordFile = lib.mkOption {
type = lib.types.nullOr lib.types.str;
};
extraPrincipals = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ ];
};
overwrite = lib.mkEnableOption "Overwrite existing cert file?";
};
imports = [ sshCertConfig ];
config = {
binName = "ssh-host-cert-sign";
package = config.pkgs.step-cli;
@@ -53,14 +40,7 @@ in
});
flake.wrappers.renewHostWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
options = {
sshHostKeyFile = lib.mkOption {
type = lib.types.str;
default = "/etc/ssh/ssh_host_ed25519_key";
};
overwrite = lib.mkEnableOption "Overwrite existing cert file?";
};
imports = [ sshCertConfig ];
config = {
binName = "ssh-host-cert-renew";
package = config.pkgs.step-cli;
@@ -72,13 +52,7 @@ in
});
flake.wrappers.hostCheckWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
options = {
certPath = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = "/etc/ssh/ssh_host_ed25519_key-cert.pub";
};
};
imports = [ sshCertConfig ];
config = {
binName = "ssh-host-cert-check";
package = config.pkgs.openssh;
@@ -88,22 +62,7 @@ in
});
flake.wrappers.signUserWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
options = {
provisioner = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = "admin";
};
provisionerPasswordFile = lib.mkOption {
type = lib.types.nullOr lib.types.str;
};
validUsers = lib.mkOption {
description = "A list of the user names that this cert will be valid for";
type = lib.types.listOf lib.types.str;
default = [ ];
};
overwrite = lib.mkEnableOption "Overwrite existing cert file?";
};
imports = [ sshCertConfig ];
config = {
binName = "ssh-user-cert-sign";
package = config.pkgs.step-cli;
@@ -118,13 +77,7 @@ in
});
flake.wrappers.userCheckWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
options = {
certPath = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = "$HOME/.ssh/id_ed25519-cert.pub";
};
};
imports = [ sshCertConfig ];
config = {
binName = "ssh-user-cert-check";
package = config.pkgs.openssh;
@@ -134,16 +87,7 @@ in
});
flake.wrappers.renewalCheck = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
options = {
certPath = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = "$HOME/.ssh/id_ed25519-cert.pub";
};
expires-in = lib.mkOption {
type = lib.types.str;
default = "4h";
};
};
imports = [ sshCertConfig ];
config = {
binName = "ssh-renewal-check";
package = config.pkgs.step-cli;