john/dendritic
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

broke out certDir for home manager module

Browse Source
This commit is contained in:
John Lancaster
2026-03-15 22:03:42 -05:00
parent e72b27e59d
commit e4767ad30d
3 changed files with 17 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
modules/services/step-ca/mtls.nix
View File

@@ -10,11 +10,6 @@ let
description = "The Common Name, DNS Name, or IP address that will be set as the Subject Common Name for the certificate. If no Subject Alternative Names (SANs) are configured (via the --san flag) then the subject will be set as the only SAN.";
type = lib.types.str;
};
certDir = lib.mkOption {
description = "String path to where the mtls certs will be stored.";
type = lib.types.str;
default = "/etc/step";
};
keyFilename = lib.mkOption {
description = "String filename for the private key";
type = lib.types.str;
@@ -170,19 +165,27 @@ in
tlsKey = "${certDir}/${cfg.keyFilename}";
tlsCert = "${certDir}/${cfg.certFilename}";
mtlsBundle = "${certDir}/${cfg.bundleFilename}";
rootCA = "${certDir}/root_ca.crt";
sanArgs = lib.concatMapStringsSep " " (san: "--san \"${san}\"") cfg.san;
in
{
options.mtls = opts;
options.mtls = opts // {
certDir = lib.mkOption {
description = "String path to where the mtls certs will be stored.";
type = lib.types.str;
default ="${config.home.homeDirectory}/.step/certs";
};
};
config = {
home.packages = with pkgs; [
step-cli
(writeShellScriptBin "mtls-generate" ''
set -euo pipefail
${lib.getExe pkgs.step-cli} ca certificate \
john-pc-ubuntu ${tlsCert} ${tlsKey} \
--provisioner admin \
--san 192.168.1.85 \
--san spiffe://john-stream.com/ubuntu
--provisioner ${cfg.provisioner} \
${sanArgs}
cat ${tlsCert} ${tlsKey} > ${mtlsBundle}
'')
(writeShellScriptBin "mtls-check" ''