mtls scripts

modules/features/mtls.nix

@@ -1,4 +1,4 @@
-{ inputs, lib, ... }:
+{ self, inputs, lib, ... }:
 let
   # Options that will be in common between
   opts = {
@@ -7,6 +7,10 @@ let
       description = "The Common Name, DNS Name, or IP address that will be set as the Subject Common Name for the certificate. If no Subject Alternative Names (SANs) are configured (via the --san flag) then the subject will be set as the only SAN.";
       type = lib.types.str;
     };
+    certDir = lib.mkOption {
+      description = "String path to the directory where the certs will be stored";
+      type = lib.types.str;
+    };
     keyFilename = lib.mkOption {
       description = "String filename for the private key";
       type = lib.types.str;
@@ -74,6 +78,38 @@ let
     };
   };
 
+  mkMtlsGenerateScript = {
+    pkgs,
+    subject,
+    provisioner,
+    san,
+    tlsCert,
+    tlsKey,
+    mtlsBundle,
+    lifetime,
+  }:
+  let
+    stepCmd = lib.getExe pkgs.step-cli;
+    sanArgs = lib.concatMapStringsSep " " (s: "--san \"${s}\"") san;
+  in
+    pkgs.writeShellScriptBin "mtls-generate" ''
+      set -euo pipefail
+      ${stepCmd} ca certificate \
+        ${subject} ${tlsCert} ${tlsKey} \
+        --not-before=-5m --not-after=${lifetime} \
+        --provisioner ${provisioner} \
+        ${sanArgs} \
+        "$@"
+      cat ${tlsCert} ${tlsKey} > ${mtlsBundle}
+    '';
+  
+  mkMtlsCheckScript = mtlsBundle: pkgs.writeShellScriptBin "mtls-check" ''
+    ${lib.getExe pkgs.openssl} x509 \
+    -noout -subject -issuer \
+    -ext subjectAltName,extendedKeyUsage \
+    -enddate -in ${mtlsBundle}
+  ''
+
   mkMtlsRenewScript = {
     pkgs,
     tlsCert,
@@ -84,6 +120,7 @@ let
     systemctlArgs ? [ ],
   }:
   let
+    echoCmd = lib.getExe' pkgs.coreutils "echo";
     systemctl = lib.getExe' pkgs.systemd "systemctl";
     escapedArgs = lib.escapeShellArgs systemctlArgs;
     systemctlCommand = "${systemctl} ${escapedArgs}";
@@ -98,9 +135,9 @@ let
       set -euo pipefail
 
       if ${lib.getExe pkgs.step-cli} certificate needs-renewal "${tlsCert}"; then
-        echo "Renewing mTLS certificate"
+        ${echoCmd} "Renewing mTLS certificate"
       else
-        echo "Skipping renew"
+        ${echoCmd} "Skipping renew"
         exit "$?"
       fi
 
@@ -109,10 +146,10 @@ let
       umask 077
       ${lib.getExe' pkgs.coreutils "cat"} "${tlsCert}" "${tlsKey}" > "${mtlsBundle}"
 
-      echo "Reloading units:"
+      ${echoCmd} "Reloading units:"
       ${renewReloadScript}
 
-      echo "Post commands:"
+      ${echoCmd} "Post commands:"
       ${renewPostCommands}
     '';
 
@@ -212,32 +249,29 @@ in
   flake.modules.nixos.mtls = { config, lib, pkgs, ... }:
     let
       cfg = config.mtls;
-      certDir = "/etc/step/certs";
+      tlsKey = "${cfg.certDir}/${cfg.keyFilename}";
-      tlsKey = "${certDir}/${cfg.keyFilename}";
+      tlsCert = "${cfg.certDir}/${cfg.certFilename}";
-      tlsCert = "${certDir}/${cfg.certFilename}";
+      mtlsBundle = "${cfg.certDir}/${cfg.bundleFilename}";
-      mtlsBundle = "${certDir}/${cfg.bundleFilename}";
       sanArgs = lib.concatMapStringsSep " " (san: "--san \"${san}\"") cfg.san;
     in
     {
-      options.mtls = opts;
+      options.mtls = opts // {
+        certDir = lib.mkOption {
+          description = "String path to where the mtls certs will be stored.";
+          type = lib.types.str;
+          default = "/etc/step/certs";
+        };
+      };
+
       config = lib.mkIf cfg.enable {
         environment.systemPackages = with pkgs; lib.optionals cfg.enable [
-          (writeShellScriptBin "mtls-generate" ''
+          step-cli
-            set -euo pipefail
+          (mkMtlsGenerateScript {
-            ${lib.getExe pkgs.step-cli} ca certificate \
+            inherit (cfg) subject provisioner san lifetime;
-              ${cfg.subject} ${tlsCert} ${tlsKey} \
+            inherit pkgs tlsCert tlsKey mtlsBundle;
-              --provisioner ${cfg.provisioner} \
+          })
-              --not-before=-5m --not-after=${cfg.lifetime} \
+          (mkMtlsCheckScript { inherit (cfg) mtlsBundle; })
-              ${sanArgs} \
+          (mkMtlsRenewScript { inherit pkgs tlsCert tlsKey mtlsBundle; })
-              "$@"
-            cat ${tlsCert} ${tlsKey} > ${mtlsBundle}
-          '')
-          (writeShellScriptBin "mtls-check" ''
-            ${lib.getExe pkgs.openssl} x509 \
-            -noout -subject -issuer \
-            -ext subjectAltName,extendedKeyUsage \
-            -enddate -in ${mtlsBundle}
-          '')
         ];
 
         systemd.services.mtls-renew = lib.mkIf cfg.renew.enable (mkNixosMtlsRenewService {
@@ -271,22 +305,11 @@ in
       config = {
         home.packages = with pkgs; lib.optionals cfg.enable [
           step-cli
-          (writeShellScriptBin "mtls-generate" ''
+          (mkMtlsGenerateScript {
-            set -euo pipefail
+            inherit (cfg) subject provisioner san lifetime;
-            ${lib.getExe pkgs.step-cli} ca certificate \
+            inherit pkgs tlsCert tlsKey mtlsBundle;
-              ${cfg.subject} ${tlsCert} ${tlsKey} \
+          })
-              --not-before=-5m --not-after=${cfg.lifetime} \
+          (mkMtlsCheckScript { inherit (cfg) mtlsBundle; })
-              --provisioner ${cfg.provisioner} \
-              ${sanArgs} \
-              "$@"
-            cat ${tlsCert} ${tlsKey} > ${mtlsBundle}
-          '')
-          (writeShellScriptBin "mtls-check" ''
-            ${lib.getExe pkgs.openssl} x509 \
-            -noout -subject -issuer \
-            -ext subjectAltName,extendedKeyUsage \
-            -enddate -in ${mtlsBundle}
-          '')
           (mkMtlsRenewScript { inherit pkgs tlsCert tlsKey mtlsBundle; })
         ];