john/dendritic
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

broke out certDir for home manager module

Browse Source
This commit is contained in:
John Lancaster
2026-03-15 22:03:42 -05:00
parent e72b27e59d
commit e4767ad30d
3 changed files with 17 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
modules/hosts/john-pc-ubuntu.nix
View File

@@ -8,11 +8,9 @@ in
flake.modules.homeManager."${hostname}" = { pkgs, config, ... }: flake.modules.homeManager."${hostname}" = { pkgs, config, ... }:
let let
flakeDir = "${config.xdg.configHome}/home-manager/jsl-dendritic"; flakeDir = "${config.xdg.configHome}/home-manager/jsl-dendritic";
certDir = "${config.home.homeDirectory}/.step/certs"; certDir = "${config.mtls.certDir}";
CACert = "${certDir}/root_ca.crt"; CACert = "${certDir}/root_ca.crt";
tlsKey = "${certDir}/key.pem"; mtlsBundle = "${certDir}/${config.mtls.bundleFilename}";
tlsCert = "${certDir}/cert.pem";
mtlsCert = "${certDir}/mtls.pem";
in in
{ {
imports = with inputs.self.modules.homeManager; [ imports = with inputs.self.modules.homeManager; [
@@ -41,9 +39,9 @@ in
mtls = { mtls = {
enable = true; enable = true;
subject = hostname;
caURL = "https://janus.john-stream.com/"; caURL = "https://janus.john-stream.com/";
provisioner = "admin"; provisioner = "admin";
subject = hostname;
san = [ san = [
"${hostname}" "${hostname}"
"192.168.1.85" "192.168.1.85"
@@ -87,7 +85,7 @@ in
"inherit" = "base"; "inherit" = "base";
repository = "rest:https://soteria.john-stream.com/john-ubuntu"; repository = "rest:https://soteria.john-stream.com/john-ubuntu";
cacert = "${CACert}"; cacert = "${CACert}";
tls-client-cert = "${mtlsCert}"; tls-client-cert = "${mtlsBundle}";
backup = { backup = {
source = [ source = [
"${config.xdg.userDirs.documents}" "${config.xdg.userDirs.documents}"

2
modules/programs/step-client.nix
View File

@@ -51,7 +51,7 @@ in
home.file.".step/config/defaults.json".text = builtins.toJSON { home.file.".step/config/defaults.json".text = builtins.toJSON {
"ca-url" = cfg.caURL; "ca-url" = cfg.caURL;
fingerprint = cfg.fingerprint; fingerprint = cfg.fingerprint;
root = "${cfg.rootCertFile.path}"; root = "${config.home.homeDirectory}/${cfg.rootCertFile.path}";
}; };
sops.secrets."janus/admin_jwk".mode = "0400"; sops.secrets."janus/admin_jwk".mode = "0400";
home.packages = with pkgs; [ home.packages = with pkgs; [

21
modules/services/step-ca/mtls.nix
View File

@@ -10,11 +10,6 @@ let
description = "The Common Name, DNS Name, or IP address that will be set as the Subject Common Name for the certificate. If no Subject Alternative Names (SANs) are configured (via the --san flag) then the subject will be set as the only SAN."; description = "The Common Name, DNS Name, or IP address that will be set as the Subject Common Name for the certificate. If no Subject Alternative Names (SANs) are configured (via the --san flag) then the subject will be set as the only SAN.";
type = lib.types.str; type = lib.types.str;
}; };
certDir = lib.mkOption {
description = "String path to where the mtls certs will be stored.";
type = lib.types.str;
default = "/etc/step";
};
keyFilename = lib.mkOption { keyFilename = lib.mkOption {
description = "String filename for the private key"; description = "String filename for the private key";
type = lib.types.str; type = lib.types.str;
@@ -170,19 +165,27 @@ in
tlsKey = "${certDir}/${cfg.keyFilename}"; tlsKey = "${certDir}/${cfg.keyFilename}";
tlsCert = "${certDir}/${cfg.certFilename}"; tlsCert = "${certDir}/${cfg.certFilename}";
mtlsBundle = "${certDir}/${cfg.bundleFilename}"; mtlsBundle = "${certDir}/${cfg.bundleFilename}";
rootCA = "${certDir}/root_ca.crt";
sanArgs = lib.concatMapStringsSep " " (san: "--san \"${san}\"") cfg.san;
in in
{ {
options.mtls = opts; options.mtls = opts // {
certDir = lib.mkOption {
description = "String path to where the mtls certs will be stored.";
type = lib.types.str;
default ="${config.home.homeDirectory}/.step/certs";
};
};
config = { config = {
home.packages = with pkgs; [ home.packages = with pkgs; [
step-cli step-cli
(writeShellScriptBin "mtls-generate" '' (writeShellScriptBin "mtls-generate" ''
set -euo pipefail
${lib.getExe pkgs.step-cli} ca certificate \ ${lib.getExe pkgs.step-cli} ca certificate \
john-pc-ubuntu ${tlsCert} ${tlsKey} \ john-pc-ubuntu ${tlsCert} ${tlsKey} \
--provisioner admin \ --provisioner ${cfg.provisioner} \
--san 192.168.1.85 \ ${sanArgs}
--san spiffe://john-stream.com/ubuntu
cat ${tlsCert} ${tlsKey} > ${mtlsBundle} cat ${tlsCert} ${tlsKey} > ${mtlsBundle}
'') '')
(writeShellScriptBin "mtls-check" '' (writeShellScriptBin "mtls-check" ''