john/dendritic
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

mtls file permissions

Browse Source
This commit is contained in:
John Lancaster
2026-04-03 18:16:12 -05:00
parent 32b7932916
commit ff74205c57
1 changed files with 29 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/features/mtls.nix
+29 -10
View File
@@ -66,9 +66,9 @@ let
default = "root"; default = "root";
}; };
group = lib.mkOption { group = lib.mkOption {
description = "Group to run the mTLS renewal service as. Defaults to the configured renewal user when null."; description = "Group to run the mTLS renewal service as. Defaults to the configured renewal user.";
type = lib.types.nullOr lib.types.str; type = lib.types.nullOr lib.types.str;
default = null; default = cfg.user;
}; };
reloadUnits = lib.mkOption { reloadUnits = lib.mkOption {
description = "systemd units to try-reload-or-restart after a successful certificate renewal."; description = "systemd units to try-reload-or-restart after a successful certificate renewal.";
@@ -92,8 +92,14 @@ let
keyFile, keyFile,
bundleFile, bundleFile,
lifetime, lifetime,
user,
group,
}: }:
let let
catCmd = lib.getExe' pkgs.coreutils "cat";
echoCmd = lib.getExe' pkgs.coreutils "echo";
chownCmd = lib.getExe' pkgs.coreutils "chown";
chmodCmd = lib.getExe' pkgs.coreutils "chmod";
stepCmd = lib.getExe pkgs.step-cli; stepCmd = lib.getExe pkgs.step-cli;
sanArgs = lib.concatMapStringsSep " " (s: "--san \"${s}\"") san; sanArgs = lib.concatMapStringsSep " " (s: "--san \"${s}\"") san;
in in
@@ -105,7 +111,9 @@ let
--provisioner ${provisioner} \ --provisioner ${provisioner} \
${sanArgs} \ ${sanArgs} \
"$@" "$@"
cat ${certFile} ${keyFile} > ${bundleFile} (umask 077; ${catCmd} ${certFile} ${keyFile} > ${bundleFile})
${chownCmd} ${user}:${group} ${certFile} ${keyFile} ${bundleFile}
${chmodCmd} 640 ${certFile} ${keyFile} ${bundleFile}
''; '';
mkMtlsCheckScript = { pkgs, bundleFile }: pkgs.writeShellScriptBin "mtls-check" '' mkMtlsCheckScript = { pkgs, bundleFile }: pkgs.writeShellScriptBin "mtls-check" ''
@@ -120,12 +128,17 @@ let
certFile, certFile,
keyFile, keyFile,
bundleFile, bundleFile,
user,
group,
reloadUnits ? [ ], reloadUnits ? [ ],
postCommands ? [ ], postCommands ? [ ],
systemctlArgs ? [ ], systemctlArgs ? [ ],
}: }:
let let
catCmd = lib.getExe' pkgs.coreutils "cat";
echoCmd = lib.getExe' pkgs.coreutils "echo"; echoCmd = lib.getExe' pkgs.coreutils "echo";
chownCmd = lib.getExe' pkgs.coreutils "chown";
chmodCmd = lib.getExe' pkgs.coreutils "chmod";
systemctl = lib.getExe' pkgs.systemd "systemctl"; systemctl = lib.getExe' pkgs.systemd "systemctl";
escapedArgs = lib.escapeShellArgs systemctlArgs; escapedArgs = lib.escapeShellArgs systemctlArgs;
systemctlCommand = "${systemctl} ${escapedArgs}"; systemctlCommand = "${systemctl} ${escapedArgs}";
@@ -147,9 +160,9 @@ let
fi fi
${lib.getExe pkgs.step-cli} ca renew --force "${certFile}" "${keyFile}" ${lib.getExe pkgs.step-cli} ca renew --force "${certFile}" "${keyFile}"
(umask 077; ${catCmd} "${certFile}" "${keyFile}" > "${bundleFile}")
umask 077 ${chownCmd} ${user}:${group} ${certFile} ${keyFile} ${bundleFile}
${lib.getExe' pkgs.coreutils "cat"} "${certFile}" "${keyFile}" > "${bundleFile}" ${chmodCmd} 640 ${certFile} ${keyFile} ${bundleFile}
${echoCmd} "Reloading units:" ${echoCmd} "Reloading units:"
${renewReloadScript} ${renewReloadScript}
@@ -171,7 +184,7 @@ let
let let
serviceGroup = if group == null then user else group; serviceGroup = if group == null then user else group;
renewScript = mkMtlsRenewScript { renewScript = mkMtlsRenewScript {
inherit pkgs certFile keyFile bundleFile reloadUnits postCommands; inherit pkgs certFile keyFile bundleFile reloadUnits postCommands user group;
}; };
in in
{ {
@@ -271,13 +284,18 @@ in
(mkMtlsGenerateScript { (mkMtlsGenerateScript {
inherit pkgs; inherit pkgs;
inherit (cfg) subject provisioner san certFile keyFile bundleFile lifetime; inherit (cfg) subject provisioner san certFile keyFile bundleFile lifetime;
inherit (cfg.renew) user group;
}) })
(mkMtlsCheckScript { inherit pkgs; inherit (cfg) bundleFile; }) (mkMtlsCheckScript { inherit pkgs; inherit (cfg) bundleFile; })
(mkMtlsRenewScript { inherit pkgs; inherit (cfg) certFile keyFile bundleFile; }) (mkMtlsRenewScript {
inherit pkgs;
inherit (cfg) certFile keyFile bundleFile;
inherit (cfg.renew) user group;
})
]; ];
systemd.tmpfiles.rules = [ systemd.tmpfiles.rules = [
"d ${cfg.certDir} 0750 ${cfg.renew.user} ${if cfg.renew.group == null then cfg.renew.user else cfg.renew.group} -" "d ${cfg.certDir} 0750 ${cfg.renew.user} ${cfg.renew.group} -"
]; ];
systemd.services.mtls-renew = lib.mkIf cfg.renew.enable (mkNixosMtlsRenewService { systemd.services.mtls-renew = lib.mkIf cfg.renew.enable (mkNixosMtlsRenewService {
@@ -314,10 +332,11 @@ in
# step-cli # step-cli
(mkMtlsGenerateScript { (mkMtlsGenerateScript {
inherit (cfg) subject provisioner san lifetime; inherit (cfg) subject provisioner san lifetime;
inherit (cfg.renew) user group;
inherit pkgs certFile keyFile bundleFile; inherit pkgs certFile keyFile bundleFile;
}) })
(mkMtlsCheckScript { inherit pkgs bundleFile; }) (mkMtlsCheckScript { inherit pkgs bundleFile; })
(mkMtlsRenewScript { inherit pkgs certFile keyFile bundleFile; }) (mkMtlsRenewScript { inherit pkgs certFile keyFile bundleFile; inherit (cfg.renew) user group; })
]; ];
systemd.user.tmpfiles.rules = lib.mkIf cfg.enable [ systemd.user.tmpfiles.rules = lib.mkIf cfg.enable [