customized timing

modules/hosts/john-pc-ubuntu.nix

@@ -48,6 +48,8 @@ in
         "192.168.1.85"
         "spiffe://john-stream.com/ubuntu"
       ];
+      lifetime = "1h";
+      renew.onCalendar = "*:1/10";
     };
 
     # TODO: Add host-specific settings here:

modules/nixos/login-text.nix

@@ -22,9 +22,10 @@
         };
 
         service_status = {
-          SSH = "sshd.socket";
-          "SSH Certs" = "step-ssh-host-renew.timer";
           Docker = "docker";
+          SSH = "sshd.socket";
+          "SSH Cert Renewal" = "step-ssh-host-renew.timer";
+          "mTLS Renewal" = "mtls-renew.timer";
         };
 
         # This calculation is wrong for LXCs

modules/services/step-ca/mtls.nix

@@ -1,5 +1,6 @@
 { inputs, lib, ... }:
 let
+  # Options that will be in common between
   opts = {
     enable = lib.mkEnableOption "Enable mTLS";
     caURL = lib.mkOption {
@@ -34,6 +35,10 @@ let
       type = lib.types.str;
       default = "admin";
     };
+    lifetime = lib.mkOption {
+      type = lib.types.str;
+      default = "6h";
+    };
     renew = {
       enable = lib.mkOption {
         description = "Enable automatic mTLS certificate renewal using a systemd timer.";
@@ -50,6 +55,16 @@ let
         type = lib.types.str;
         default = "5m";
       };
+      user = lib.mkOption {
+        description = "User account to run the mTLS renewal service as.";
+        type = lib.types.str;
+        default = "root";
+      };
+      group = lib.mkOption {
+        description = "Group to run the mTLS renewal service as. Defaults to the configured renewal user when null.";
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+      };
       reloadUnits = lib.mkOption {
         description = "systemd units to try-reload-or-restart after a successful certificate renewal.";
         type = lib.types.listOf lib.types.str;
@@ -62,6 +77,134 @@ let
       };
     };
   };
+
+  mkMtlsRenewScript = {
+    pkgs,
+    tlsCert,
+    tlsKey,
+    mtlsBundle,
+    reloadUnits ? [ ],
+    postCommands ? [ ],
+    systemctlArgs ? [ ],
+  }:
+  let
+    renewReloadScript = lib.concatMapStringsSep "\n" (unit: ''
+      if ${lib.getExe' pkgs.systemd "systemctl"} ${lib.escapeShellArgs systemctlArgs} --quiet is-active "${unit}"; then
+        ${lib.getExe' pkgs.systemd "systemctl"} ${lib.escapeShellArgs systemctlArgs} try-reload-or-restart "${unit}"
+      fi
+    '') reloadUnits;
+    renewPostCommands = lib.concatStringsSep "\n" postCommands;
+  in
+    pkgs.writeShellScriptBin "mtls-renew" ''
+      set -euo pipefail
+
+      if ${lib.getExe pkgs.step-cli} certificate needs-renewal "${tlsCert}"; then
+        echo "Renewing mTLS certificate"
+      else
+        echo "Skipping renew"
+        exit "$?"
+      fi
+
+      ${lib.getExe pkgs.step-cli} ca renew --force "${tlsCert}" "${tlsKey}"
+
+      umask 077
+      ${lib.getExe' pkgs.coreutils "cat"} "${tlsCert}" "${tlsKey}" > "${mtlsBundle}"
+
+      ${renewReloadScript}
+      ${renewPostCommands}
+    '';
+
+  mkNixosMtlsRenewService = {
+    pkgs,
+    tlsCert,
+    tlsKey,
+    mtlsBundle,
+    reloadUnits ? [ ],
+    postCommands ? [ ],
+    user ? "root",
+    group ? null,
+  }:
+  let
+    serviceGroup = if group == null then user else group;
+    renewScript = mkMtlsRenewScript {
+      inherit pkgs tlsCert tlsKey mtlsBundle reloadUnits postCommands;
+    };
+  in
+  {
+    description = "Renew the mTLS certificate when Smallstep marks it ready";
+    wantedBy = [ ];
+    after = [ "network-online.target" ];
+    wants = [ "network-online.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      User = user;
+      Group = serviceGroup;
+      ExecStart = lib.getExe renewScript;
+    };
+  };
+
+  mkNixosMtlsRenewTimer = {
+    onCalendar,
+    randomizedDelaySec,
+    unit ? "mtls-renew.service",
+  }: {
+    description = "Periodic Smallstep renewal for the mTLS certificate";
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      Persistent = true;
+      OnCalendar = onCalendar;
+      AccuracySec = "1us";
+      RandomizedDelaySec = randomizedDelaySec;
+      Unit = unit;
+    };
+  };
+
+  mkHomeManagerMtlsRenewService = {
+    pkgs,
+    tlsCert,
+    tlsKey,
+    mtlsBundle,
+    reloadUnits ? [ ],
+    postCommands ? [ ],
+  }:
+  let
+    renewScript = mkMtlsRenewScript {
+      inherit pkgs tlsCert tlsKey mtlsBundle reloadUnits postCommands;
+      systemctlArgs = [ "--user" ];
+    };
+  in
+  {
+    Unit = {
+      Description = "Renew the mTLS certificate when Smallstep marks it ready";
+      After = [ "network-online.target" ];
+      Wants = [ "network-online.target" ];
+    };
+    Service = {
+      Type = "oneshot";
+      ExecStart = lib.getExe renewScript;
+    };
+  };
+
+  mkHomeManagerMtlsRenewTimer = {
+    onCalendar,
+    randomizedDelaySec,
+    unit ? "mtls-renew.service",
+  }: {
+    Unit = {
+      Description = "Periodic Smallstep renewal for the mTLS certificate";
+    };
+    Timer = {
+      Persistent = true;
+      OnCalendar = onCalendar;
+      AccuracySec = "1us";
+      RandomizedDelaySec = randomizedDelaySec;
+      Unit = unit;
+    };
+    Install = {
+      WantedBy = [ "timers.target" ];
+    };
+  };
+
 in
 {
   flake.modules.nixos.mtls = { config, lib, pkgs, ... }:
@@ -73,12 +216,6 @@ in
       mtlsBundle = "${certDir}/${cfg.bundleFilename}";
       rootCA = "${certDir}/root_ca.crt";
       sanArgs = lib.concatMapStringsSep " " (san: "--san \"${san}\"") cfg.san;
-    renewReloadScript = lib.concatMapStringsSep "\n" (unit: ''
-      if ${lib.getExe' pkgs.systemd "systemctl"} --quiet is-active "${unit}"; then
-        ${lib.getExe' pkgs.systemd "systemctl"} try-reload-or-restart "${unit}"
-      fi
-    '') cfg.renew.reloadUnits;
-    renewPostCommands = lib.concatStringsSep "\n" cfg.renew.postCommands;
     in
     {
       options.mtls = opts;
@@ -91,7 +228,9 @@ in
               --ca-url ${cfg.caURL} \
               --root ${rootCA} \
               --provisioner ${cfg.provisioner} \
-            ${sanArgs}
+              --not-before=-5m --not-after=${cfg.lifetime} \
+              ${sanArgs} \
+              "$@"
             cat ${tlsCert} ${tlsKey} > ${mtlsBundle}
           '')
           (writeShellScriptBin "mtls-check" ''
@@ -102,59 +241,14 @@ in
           '')
         ];
 
-      systemd.services.mtls-renew = lib.mkIf cfg.renew.enable {
-        description = "Renew the mTLS certificate when Smallstep marks it ready";
-        wantedBy = [ ];
-        after = [ "network-online.target" ];
-        wants = [ "network-online.target" ];
-        path = [ pkgs.coreutils pkgs.step-cli pkgs.systemd ];
-        serviceConfig = {
-          Type = "oneshot";
-          User = "root";
-          Group = "root";
-        };
-        script = ''
-          set -euo pipefail
+        systemd.services.mtls-renew = lib.mkIf cfg.renew.enable (mkNixosMtlsRenewService {
+          inherit pkgs tlsCert tlsKey mtlsBundle;
+          inherit (cfg.renew) reloadUnits postCommands user group;
+        });
 
-          if ${lib.getExe pkgs.step-cli} certificate needs-renewal "${tlsCert}"; then
-            echo "Renewing mTLS certificate"
-          else
-            rc=$?
-            if [ "$rc" -eq 1 ]; then
-              echo "mTLS certificate does not need renewal"
-              exit 0
-            fi
-
-            if [ "$rc" -eq 2 ]; then
-              echo "mTLS certificate missing: ${tlsCert}" >&2
-              exit 1
-            fi
-
-            echo "step certificate needs-renewal failed with rc=$rc" >&2
-            exit "$rc"
-          fi
-
-          ${lib.getExe pkgs.step-cli} ca renew --force "${tlsCert}" "${tlsKey}"
-
-          umask 077
-          cat "${tlsCert}" "${tlsKey}" > "${mtlsBundle}"
-
-          ${renewReloadScript}
-          ${renewPostCommands}
-        '';
-      };
-
-      systemd.timers.mtls-renew = lib.mkIf cfg.renew.enable {
-        description = "Periodic Smallstep renewal for the mTLS certificate";
-        wantedBy = [ "timers.target" ];
-        timerConfig = {
-          Persistent = true;
-          OnCalendar = cfg.renew.onCalendar;
-          AccuracySec = "1us";
-          RandomizedDelaySec = cfg.renew.randomizedDelaySec;
-          Unit = "mtls-renew.service";
-        };
-      };
+        systemd.timers.mtls-renew = lib.mkIf cfg.renew.enable (mkNixosMtlsRenewTimer {
+          inherit (cfg.renew) onCalendar randomizedDelaySec;
+        });
       };
     };
 
@@ -178,14 +272,16 @@ in
       };
 
       config = {
-      home.packages = with pkgs; [
+        home.packages = with pkgs; lib.optionals cfg.enable [
           step-cli
           (writeShellScriptBin "mtls-generate" ''
             set -euo pipefail
             ${lib.getExe pkgs.step-cli} ca certificate \
-            john-pc-ubuntu ${tlsCert} ${tlsKey} \
+              ${cfg.subject} ${tlsCert} ${tlsKey} \
+              --not-before=-5m --not-after=${cfg.lifetime} \
               --provisioner ${cfg.provisioner} \
-            ${sanArgs}
+              ${sanArgs} \
+              "$@"
             cat ${tlsCert} ${tlsKey} > ${mtlsBundle}
           '')
           (writeShellScriptBin "mtls-check" ''
@@ -194,7 +290,17 @@ in
             -ext subjectAltName,extendedKeyUsage \
             -enddate -in ${mtlsBundle}
           '')
+          (mkMtlsRenewScript { inherit pkgs tlsCert tlsKey mtlsBundle; })
         ];
+
+        systemd.user.services.mtls-renew = lib.mkIf cfg.renew.enable (mkHomeManagerMtlsRenewService {
+          inherit pkgs tlsCert tlsKey mtlsBundle;
+          inherit (cfg.renew) reloadUnits postCommands;
+        });
+
+        systemd.user.timers.mtls-renew = lib.mkIf cfg.renew.enable (mkHomeManagerMtlsRenewTimer {
+          inherit (cfg.renew) onCalendar randomizedDelaySec;
+        });
       };
     };
 }