customized timing

modules/hosts/john-pc-ubuntu.nix

@@ -48,6 +48,8 @@ in
         "192.168.1.85"
         "spiffe://john-stream.com/ubuntu"
       ];
+      lifetime = "1h";
+      renew.onCalendar = "*:1/10";
     };
 
     # TODO: Add host-specific settings here:

modules/nixos/login-text.nix

@@ -22,9 +22,10 @@
         };
 
         service_status = {
-          SSH = "sshd.socket";
-          "SSH Certs" = "step-ssh-host-renew.timer";
           Docker = "docker";
+          SSH = "sshd.socket";
+          "SSH Cert Renewal" = "step-ssh-host-renew.timer";
+          "mTLS Renewal" = "mtls-renew.timer";
         };
 
         # This calculation is wrong for LXCs

modules/services/step-ca/mtls.nix

@@ -1,5 +1,6 @@
 { inputs, lib, ... }:
 let
+  # Options that will be in common between
   opts = {
     enable = lib.mkEnableOption "Enable mTLS";
     caURL = lib.mkOption {
@@ -34,6 +35,10 @@ let
       type = lib.types.str;
       default = "admin";
     };
+    lifetime = lib.mkOption {
+      type = lib.types.str;
+      default = "6h";
+    };
     renew = {
       enable = lib.mkOption {
         description = "Enable automatic mTLS certificate renewal using a systemd timer.";
@@ -50,6 +55,16 @@ let
         type = lib.types.str;
         default = "5m";
       };
+      user = lib.mkOption {
+        description = "User account to run the mTLS renewal service as.";
+        type = lib.types.str;
+        default = "root";
+      };
+      group = lib.mkOption {
+        description = "Group to run the mTLS renewal service as. Defaults to the configured renewal user when null.";
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+      };
       reloadUnits = lib.mkOption {
         description = "systemd units to try-reload-or-restart after a successful certificate renewal.";
         type = lib.types.listOf lib.types.str;
@@ -62,139 +77,230 @@ let
       };
     };
   };
+
+  mkMtlsRenewScript = {
+    pkgs,
+    tlsCert,
+    tlsKey,
+    mtlsBundle,
+    reloadUnits ? [ ],
+    postCommands ? [ ],
+    systemctlArgs ? [ ],
+  }:
+  let
+    renewReloadScript = lib.concatMapStringsSep "\n" (unit: ''
+      if ${lib.getExe' pkgs.systemd "systemctl"} ${lib.escapeShellArgs systemctlArgs} --quiet is-active "${unit}"; then
+        ${lib.getExe' pkgs.systemd "systemctl"} ${lib.escapeShellArgs systemctlArgs} try-reload-or-restart "${unit}"
+      fi
+    '') reloadUnits;
+    renewPostCommands = lib.concatStringsSep "\n" postCommands;
+  in
+    pkgs.writeShellScriptBin "mtls-renew" ''
+      set -euo pipefail
+
+      if ${lib.getExe pkgs.step-cli} certificate needs-renewal "${tlsCert}"; then
+        echo "Renewing mTLS certificate"
+      else
+        echo "Skipping renew"
+        exit "$?"
+      fi
+
+      ${lib.getExe pkgs.step-cli} ca renew --force "${tlsCert}" "${tlsKey}"
+
+      umask 077
+      ${lib.getExe' pkgs.coreutils "cat"} "${tlsCert}" "${tlsKey}" > "${mtlsBundle}"
+
+      ${renewReloadScript}
+      ${renewPostCommands}
+    '';
+
+  mkNixosMtlsRenewService = {
+    pkgs,
+    tlsCert,
+    tlsKey,
+    mtlsBundle,
+    reloadUnits ? [ ],
+    postCommands ? [ ],
+    user ? "root",
+    group ? null,
+  }:
+  let
+    serviceGroup = if group == null then user else group;
+    renewScript = mkMtlsRenewScript {
+      inherit pkgs tlsCert tlsKey mtlsBundle reloadUnits postCommands;
+    };
+  in
+  {
+    description = "Renew the mTLS certificate when Smallstep marks it ready";
+    wantedBy = [ ];
+    after = [ "network-online.target" ];
+    wants = [ "network-online.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      User = user;
+      Group = serviceGroup;
+      ExecStart = lib.getExe renewScript;
+    };
+  };
+
+  mkNixosMtlsRenewTimer = {
+    onCalendar,
+    randomizedDelaySec,
+    unit ? "mtls-renew.service",
+  }: {
+    description = "Periodic Smallstep renewal for the mTLS certificate";
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      Persistent = true;
+      OnCalendar = onCalendar;
+      AccuracySec = "1us";
+      RandomizedDelaySec = randomizedDelaySec;
+      Unit = unit;
+    };
+  };
+
+  mkHomeManagerMtlsRenewService = {
+    pkgs,
+    tlsCert,
+    tlsKey,
+    mtlsBundle,
+    reloadUnits ? [ ],
+    postCommands ? [ ],
+  }:
+  let
+    renewScript = mkMtlsRenewScript {
+      inherit pkgs tlsCert tlsKey mtlsBundle reloadUnits postCommands;
+      systemctlArgs = [ "--user" ];
+    };
+  in
+  {
+    Unit = {
+      Description = "Renew the mTLS certificate when Smallstep marks it ready";
+      After = [ "network-online.target" ];
+      Wants = [ "network-online.target" ];
+    };
+    Service = {
+      Type = "oneshot";
+      ExecStart = lib.getExe renewScript;
+    };
+  };
+
+  mkHomeManagerMtlsRenewTimer = {
+    onCalendar,
+    randomizedDelaySec,
+    unit ? "mtls-renew.service",
+  }: {
+    Unit = {
+      Description = "Periodic Smallstep renewal for the mTLS certificate";
+    };
+    Timer = {
+      Persistent = true;
+      OnCalendar = onCalendar;
+      AccuracySec = "1us";
+      RandomizedDelaySec = randomizedDelaySec;
+      Unit = unit;
+    };
+    Install = {
+      WantedBy = [ "timers.target" ];
+    };
+  };
+
 in
 {
   flake.modules.nixos.mtls = { config, lib, pkgs, ... }:
-  let
+    let
-    cfg = config.mtls;
+      cfg = config.mtls;
-    certDir = "/etc/step/certs";
+      certDir = "/etc/step/certs";
-    tlsKey = "${certDir}/${cfg.keyFilename}";
+      tlsKey = "${certDir}/${cfg.keyFilename}";
-    tlsCert = "${certDir}/${cfg.certFilename}";
+      tlsCert = "${certDir}/${cfg.certFilename}";
-    mtlsBundle = "${certDir}/${cfg.bundleFilename}";
+      mtlsBundle = "${certDir}/${cfg.bundleFilename}";
-    rootCA = "${certDir}/root_ca.crt";
+      rootCA = "${certDir}/root_ca.crt";
-    sanArgs = lib.concatMapStringsSep " " (san: "--san \"${san}\"") cfg.san;
+      sanArgs = lib.concatMapStringsSep " " (san: "--san \"${san}\"") cfg.san;
-    renewReloadScript = lib.concatMapStringsSep "\n" (unit: ''
+    in
-      if ${lib.getExe' pkgs.systemd "systemctl"} --quiet is-active "${unit}"; then
+    {
-        ${lib.getExe' pkgs.systemd "systemctl"} try-reload-or-restart "${unit}"
+      options.mtls = opts;
-      fi
+      config = lib.mkIf cfg.enable {
-    '') cfg.renew.reloadUnits;
+        environment.systemPackages = with pkgs; lib.optionals cfg.enable [
-    renewPostCommands = lib.concatStringsSep "\n" cfg.renew.postCommands;
+          (writeShellScriptBin "mtls-generate" ''
-  in
+            set -euo pipefail
-  {
+            ${lib.getExe pkgs.step-cli} ca certificate \
-    options.mtls = opts;
+              ${cfg.subject} ${tlsCert} ${tlsKey} \
-    config = lib.mkIf cfg.enable {
+              --ca-url ${cfg.caURL} \
-      environment.systemPackages = with pkgs; lib.optionals cfg.enable [
+              --root ${rootCA} \
-        (writeShellScriptBin "mtls-generate" ''
+              --provisioner ${cfg.provisioner} \
-          set -euo pipefail
+              --not-before=-5m --not-after=${cfg.lifetime} \
-          ${lib.getExe pkgs.step-cli} ca certificate \
+              ${sanArgs} \
-            ${cfg.subject} ${tlsCert} ${tlsKey} \
+              "$@"
-            --ca-url ${cfg.caURL} \
+            cat ${tlsCert} ${tlsKey} > ${mtlsBundle}
-            --root ${rootCA} \
+          '')
-            --provisioner ${cfg.provisioner} \
+          (writeShellScriptBin "mtls-check" ''
-            ${sanArgs}
+            ${lib.getExe pkgs.openssl} x509 \
-          cat ${tlsCert} ${tlsKey} > ${mtlsBundle}
+            -noout -subject -issuer \
-        '')
+            -ext subjectAltName,extendedKeyUsage \
-        (writeShellScriptBin "mtls-check" ''
+            -enddate -in ${mtlsBundle}
-          ${lib.getExe pkgs.openssl} x509 \
+          '')
-          -noout -subject -issuer \
+        ];
-          -ext subjectAltName,extendedKeyUsage \
-          -enddate -in ${mtlsBundle}
-        '')
-      ];
 
-      systemd.services.mtls-renew = lib.mkIf cfg.renew.enable {
+        systemd.services.mtls-renew = lib.mkIf cfg.renew.enable (mkNixosMtlsRenewService {
-        description = "Renew the mTLS certificate when Smallstep marks it ready";
+          inherit pkgs tlsCert tlsKey mtlsBundle;
-        wantedBy = [ ];
+          inherit (cfg.renew) reloadUnits postCommands user group;
-        after = [ "network-online.target" ];
+        });
-        wants = [ "network-online.target" ];
-        path = [ pkgs.coreutils pkgs.step-cli pkgs.systemd ];
-        serviceConfig = {
-          Type = "oneshot";
-          User = "root";
-          Group = "root";
-        };
-        script = ''
-          set -euo pipefail
 
-          if ${lib.getExe pkgs.step-cli} certificate needs-renewal "${tlsCert}"; then
+        systemd.timers.mtls-renew = lib.mkIf cfg.renew.enable (mkNixosMtlsRenewTimer {
-            echo "Renewing mTLS certificate"
+          inherit (cfg.renew) onCalendar randomizedDelaySec;
-          else
+        });
-            rc=$?
-            if [ "$rc" -eq 1 ]; then
-              echo "mTLS certificate does not need renewal"
-              exit 0
-            fi
-
-            if [ "$rc" -eq 2 ]; then
-              echo "mTLS certificate missing: ${tlsCert}" >&2
-              exit 1
-            fi
-
-            echo "step certificate needs-renewal failed with rc=$rc" >&2
-            exit "$rc"
-          fi
-
-          ${lib.getExe pkgs.step-cli} ca renew --force "${tlsCert}" "${tlsKey}"
-
-          umask 077
-          cat "${tlsCert}" "${tlsKey}" > "${mtlsBundle}"
-
-          ${renewReloadScript}
-          ${renewPostCommands}
-        '';
-      };
-
-      systemd.timers.mtls-renew = lib.mkIf cfg.renew.enable {
-        description = "Periodic Smallstep renewal for the mTLS certificate";
-        wantedBy = [ "timers.target" ];
-        timerConfig = {
-          Persistent = true;
-          OnCalendar = cfg.renew.onCalendar;
-          AccuracySec = "1us";
-          RandomizedDelaySec = cfg.renew.randomizedDelaySec;
-          Unit = "mtls-renew.service";
-        };
       };
     };
-  };
 
   flake.modules.homeManager.mtls = { config, lib, pkgs, ... }:
-  let
+    let
-    cfg = config.mtls;
+      cfg = config.mtls;
-    certDir = cfg.certDir;
+      certDir = cfg.certDir;
-    tlsKey = "${certDir}/${cfg.keyFilename}";
+      tlsKey = "${certDir}/${cfg.keyFilename}";
-    tlsCert = "${certDir}/${cfg.certFilename}";
+      tlsCert = "${certDir}/${cfg.certFilename}";
-    mtlsBundle = "${certDir}/${cfg.bundleFilename}";
+      mtlsBundle = "${certDir}/${cfg.bundleFilename}";
-    rootCA = "${certDir}/root_ca.crt";
+      rootCA = "${certDir}/root_ca.crt";
-    sanArgs = lib.concatMapStringsSep " " (san: "--san \"${san}\"") cfg.san;
+      sanArgs = lib.concatMapStringsSep " " (san: "--san \"${san}\"") cfg.san;
-  in
+    in
-  {
+    {
-    options.mtls = opts // {
+      options.mtls = opts // {
-      certDir = lib.mkOption {
+        certDir = lib.mkOption {
-        description = "String path to where the mtls certs will be stored.";
+          description = "String path to where the mtls certs will be stored.";
-        type = lib.types.str;
+          type = lib.types.str;
-        default ="${config.home.homeDirectory}/.step/certs";
+          default ="${config.home.homeDirectory}/.step/certs";
+        };
+      };
+
+      config = {
+        home.packages = with pkgs; lib.optionals cfg.enable [
+          step-cli
+          (writeShellScriptBin "mtls-generate" ''
+            set -euo pipefail
+            ${lib.getExe pkgs.step-cli} ca certificate \
+              ${cfg.subject} ${tlsCert} ${tlsKey} \
+              --not-before=-5m --not-after=${cfg.lifetime} \
+              --provisioner ${cfg.provisioner} \
+              ${sanArgs} \
+              "$@"
+            cat ${tlsCert} ${tlsKey} > ${mtlsBundle}
+          '')
+          (writeShellScriptBin "mtls-check" ''
+            ${lib.getExe pkgs.openssl} x509 \
+            -noout -subject -issuer \
+            -ext subjectAltName,extendedKeyUsage \
+            -enddate -in ${mtlsBundle}
+          '')
+          (mkMtlsRenewScript { inherit pkgs tlsCert tlsKey mtlsBundle; })
+        ];
+
+        systemd.user.services.mtls-renew = lib.mkIf cfg.renew.enable (mkHomeManagerMtlsRenewService {
+          inherit pkgs tlsCert tlsKey mtlsBundle;
+          inherit (cfg.renew) reloadUnits postCommands;
+        });
+
+        systemd.user.timers.mtls-renew = lib.mkIf cfg.renew.enable (mkHomeManagerMtlsRenewTimer {
+          inherit (cfg.renew) onCalendar randomizedDelaySec;
+        });
       };
     };
-
-    config = {
-      home.packages = with pkgs; [
-        step-cli
-        (writeShellScriptBin "mtls-generate" ''
-          set -euo pipefail
-          ${lib.getExe pkgs.step-cli} ca certificate \
-            john-pc-ubuntu ${tlsCert} ${tlsKey} \
-            --provisioner ${cfg.provisioner} \
-            ${sanArgs}
-          cat ${tlsCert} ${tlsKey} > ${mtlsBundle}
-        '')
-        (writeShellScriptBin "mtls-check" ''
-          ${lib.getExe pkgs.openssl} x509 \
-          -noout -subject -issuer \
-          -ext subjectAltName,extendedKeyUsage \
-          -enddate -in ${mtlsBundle}
-        '')
-      ];
-    };
-  };
 }