mtls home manager module

modules/hosts/john-pc-ubuntu.nix

@@ -23,6 +23,7 @@ in
       docker
       desktop
       step-ssh-user
+      mtls
     ];
     targets.genericLinux.enable = true;
 
@@ -36,21 +37,20 @@ in
       (writeShellScriptBin "test-push" ''
         nixos-rebuild switch --flake ${flakeDir}#janus --target-host root@${testTarget}
       '')
-      (writeShellScriptBin "mtls-generate" ''
-        ${lib.getExe pkgs.step-cli} ca certificate \
-          john-pc-ubuntu ${tlsCert} ${tlsKey} \
-          --provisioner admin \
-          --san 192.168.1.85 \
-          --san spiffe://john-stream.com/ubuntu
-        cat ${tlsCert} ${tlsKey} > ${mtlsCert}
-      '')
-      (writeShellScriptBin "mtls-check" ''
-        ${lib.getExe pkgs.openssl} x509 \
-        -noout -subject -issuer \
-        -ext subjectAltName,extendedKeyUsage \
-        -enddate -in ${mtlsCert}
-      '')
     ];
+
+    mtls = {
+      enable = true;
+      subject = hostname;
+      caURL = "https://janus.john-stream.com/";
+      provisioner = "admin";
+      san = [
+        "${hostname}"
+        "192.168.1.85"
+        "spiffe://john-stream.com/ubuntu"
+      ];
+    };
+
     # TODO: Add host-specific settings here:
     # - sops secret for `restic_password/john_ubuntu`
     # - resticprofile profile definition

modules/services/step-ca/mtls.nix

@@ -1,23 +1,6 @@
-{ inputs, ... }:
+{ inputs, lib, ... }:
-{
+let
-  flake.modules.nixos.mtls = { config, lib, pkgs, ... }:
+  opts = {
-  let
-    cfg = config.mtls;
-    certDir = cfg.certDir;
-    tlsKey = "${certDir}/${cfg.keyFilename}";
-    tlsCert = "${certDir}/${cfg.certFilename}";
-    mtlsBundle = "${certDir}/${cfg.bundleFilename}";
-    rootCA = "${cfg.certDir}/certs/root_ca.crt";
-    sanArgs = lib.concatMapStringsSep " " (san: "--san \"${san}\"") cfg.san;
-    renewReloadScript = lib.concatMapStringsSep "\n" (unit: ''
-      if ${lib.getExe' pkgs.systemd "systemctl"} --quiet is-active "${unit}"; then
-        ${lib.getExe' pkgs.systemd "systemctl"} try-reload-or-restart "${unit}"
-      fi
-    '') cfg.renew.reloadUnits;
-    renewPostCommands = lib.concatStringsSep "\n" cfg.renew.postCommands;
-  in
-  {
-    options.mtls = {
     enable = lib.mkEnableOption "Enable mTLS";
     caURL = lib.mkOption {
       description = "URL to the certificate authority";
@@ -84,7 +67,26 @@
       };
     };
   };
-
+in
+{
+  flake.modules.nixos.mtls = { config, lib, pkgs, ... }:
+  let
+    cfg = config.mtls;
+    certDir = cfg.certDir;
+    tlsKey = "${certDir}/${cfg.keyFilename}";
+    tlsCert = "${certDir}/${cfg.certFilename}";
+    mtlsBundle = "${certDir}/${cfg.bundleFilename}";
+    rootCA = "${cfg.certDir}/certs/root_ca.crt";
+    sanArgs = lib.concatMapStringsSep " " (san: "--san \"${san}\"") cfg.san;
+    renewReloadScript = lib.concatMapStringsSep "\n" (unit: ''
+      if ${lib.getExe' pkgs.systemd "systemctl"} --quiet is-active "${unit}"; then
+        ${lib.getExe' pkgs.systemd "systemctl"} try-reload-or-restart "${unit}"
+      fi
+    '') cfg.renew.reloadUnits;
+    renewPostCommands = lib.concatStringsSep "\n" cfg.renew.postCommands;
+  in
+  {
+    options.mtls = opts;
     config = lib.mkIf cfg.enable {
       environment.systemPackages = with pkgs; lib.optionals cfg.enable [
         (writeShellScriptBin "mtls-generate" ''
@@ -160,4 +162,36 @@
       };
     };
   };
+
+  flake.modules.homeManager.mtls = { config, lib, pkgs, ... }:
+  let
+    cfg = config.mtls;
+    certDir = cfg.certDir;
+    tlsKey = "${certDir}/${cfg.keyFilename}";
+    tlsCert = "${certDir}/${cfg.certFilename}";
+    mtlsBundle = "${certDir}/${cfg.bundleFilename}";
+  in
+  {
+    options.mtls = opts;
+
+    config = {
+      home.packages = with pkgs; [
+        step-cli
+        (writeShellScriptBin "mtls-generate" ''
+          ${lib.getExe pkgs.step-cli} ca certificate \
+            john-pc-ubuntu ${tlsCert} ${tlsKey} \
+            --provisioner admin \
+            --san 192.168.1.85 \
+            --san spiffe://john-stream.com/ubuntu
+          cat ${tlsCert} ${tlsKey} > ${mtlsBundle}
+        '')
+        (writeShellScriptBin "mtls-check" ''
+          ${lib.getExe pkgs.openssl} x509 \
+          -noout -subject -issuer \
+          -ext subjectAltName,extendedKeyUsage \
+          -enddate -in ${mtlsBundle}
+        '')
+      ];
+    };
+  };
 }