john/dendritic
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

mtls home manager module

Browse Source
This commit is contained in:
John Lancaster
2026-03-15 21:27:44 -05:00
parent 67688c2aa6
commit e72b27e59d
2 changed files with 117 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
modules/hosts/john-pc-ubuntu.nix
View File

@@ -23,6 +23,7 @@ in
docker
desktop
step-ssh-user
mtls
];
targets.genericLinux.enable = true;
@@ -36,21 +37,20 @@ in
(writeShellScriptBin "test-push" ''
nixos-rebuild switch --flake ${flakeDir}#janus --target-host root@${testTarget}
'')
(writeShellScriptBin "mtls-generate" ''
${lib.getExe pkgs.step-cli} ca certificate \
john-pc-ubuntu ${tlsCert} ${tlsKey} \
--provisioner admin \
--san 192.168.1.85 \
--san spiffe://john-stream.com/ubuntu
cat ${tlsCert} ${tlsKey} > ${mtlsCert}
'')
(writeShellScriptBin "mtls-check" ''
${lib.getExe pkgs.openssl} x509 \
-noout -subject -issuer \
-ext subjectAltName,extendedKeyUsage \
-enddate -in ${mtlsCert}
'')
];
mtls = {
enable = true;
subject = hostname;
caURL = "https://janus.john-stream.com/";
provisioner = "admin";
san = [
"${hostname}"
"192.168.1.85"
"spiffe://john-stream.com/ubuntu"
];
};
# TODO: Add host-specific settings here:
# - sops secret for `restic_password/john_ubuntu`
# - resticprofile profile definition

76
modules/services/step-ca/mtls.nix
View File

@@ -1,23 +1,6 @@
{ inputs, ... }:
{
flake.modules.nixos.mtls = { config, lib, pkgs, ... }:
let
cfg = config.mtls;
certDir = cfg.certDir;
tlsKey = "${certDir}/${cfg.keyFilename}";
tlsCert = "${certDir}/${cfg.certFilename}";
mtlsBundle = "${certDir}/${cfg.bundleFilename}";
rootCA = "${cfg.certDir}/certs/root_ca.crt";
sanArgs = lib.concatMapStringsSep " " (san: "--san \"${san}\"") cfg.san;
renewReloadScript = lib.concatMapStringsSep "\n" (unit: ''
if ${lib.getExe' pkgs.systemd "systemctl"} --quiet is-active "${unit}"; then
${lib.getExe' pkgs.systemd "systemctl"} try-reload-or-restart "${unit}"
fi
'') cfg.renew.reloadUnits;
renewPostCommands = lib.concatStringsSep "\n" cfg.renew.postCommands;
in
{
options.mtls = {
{ inputs, lib, ... }:
let
opts = {
enable = lib.mkEnableOption "Enable mTLS";
caURL = lib.mkOption {
description = "URL to the certificate authority";
@@ -84,7 +67,26 @@
};
};
};
in
{
flake.modules.nixos.mtls = { config, lib, pkgs, ... }:
let
cfg = config.mtls;
certDir = cfg.certDir;
tlsKey = "${certDir}/${cfg.keyFilename}";
tlsCert = "${certDir}/${cfg.certFilename}";
mtlsBundle = "${certDir}/${cfg.bundleFilename}";
rootCA = "${cfg.certDir}/certs/root_ca.crt";
sanArgs = lib.concatMapStringsSep " " (san: "--san \"${san}\"") cfg.san;
renewReloadScript = lib.concatMapStringsSep "\n" (unit: ''
if ${lib.getExe' pkgs.systemd "systemctl"} --quiet is-active "${unit}"; then
${lib.getExe' pkgs.systemd "systemctl"} try-reload-or-restart "${unit}"
fi
'') cfg.renew.reloadUnits;
renewPostCommands = lib.concatStringsSep "\n" cfg.renew.postCommands;
in
{
options.mtls = opts;
config = lib.mkIf cfg.enable {
environment.systemPackages = with pkgs; lib.optionals cfg.enable [
(writeShellScriptBin "mtls-generate" ''
@@ -160,4 +162,36 @@
};
};
};
flake.modules.homeManager.mtls = { config, lib, pkgs, ... }:
let
cfg = config.mtls;
certDir = cfg.certDir;
tlsKey = "${certDir}/${cfg.keyFilename}";
tlsCert = "${certDir}/${cfg.certFilename}";
mtlsBundle = "${certDir}/${cfg.bundleFilename}";
in
{
options.mtls = opts;
config = {
home.packages = with pkgs; [
step-cli
(writeShellScriptBin "mtls-generate" ''
${lib.getExe pkgs.step-cli} ca certificate \
john-pc-ubuntu ${tlsCert} ${tlsKey} \
--provisioner admin \
--san 192.168.1.85 \
--san spiffe://john-stream.com/ubuntu
cat ${tlsCert} ${tlsKey} > ${mtlsBundle}
'')
(writeShellScriptBin "mtls-check" ''
${lib.getExe pkgs.openssl} x509 \
-noout -subject -issuer \
-ext subjectAltName,extendedKeyUsage \
-enddate -in ${mtlsBundle}
'')
];
};
};
}