54 lines
1.8 KiB
Nix
54 lines
1.8 KiB
Nix
{ lib, ... }: {
|
|
options.optionModules.mtls = lib.mkOption {
|
|
type = lib.types.deferredModule;
|
|
description = "Shared mTLS certificate option definitions, imported by the mTLS wrapper modules.";
|
|
};
|
|
|
|
config.optionModules.mtls = { config, lib, pkgs, ... }: {
|
|
key = "mtls-config";
|
|
_file = "modules/features/mtls/config.nix";
|
|
options = {
|
|
certDir = lib.mkOption {
|
|
description = "String path to the directory where the certs will be stored";
|
|
type = lib.types.str;
|
|
default = "/etc/mtls";
|
|
};
|
|
keyFile = lib.mkOption {
|
|
description = "String path for the private key";
|
|
type = lib.types.str;
|
|
default = "${config.certDir}/key.pem";
|
|
};
|
|
certFile = lib.mkOption {
|
|
description = "String path for the public cert";
|
|
type = lib.types.str;
|
|
default = "${config.certDir}/cert.pem";
|
|
};
|
|
bundleFile = lib.mkOption {
|
|
description = "String path for the mTLS key bundle";
|
|
type = lib.types.str;
|
|
default = "${config.certDir}/mtls.pem";
|
|
};
|
|
certGroup = lib.mkOption {
|
|
description = "Group that should be granted read access to generated certificate material.";
|
|
type = lib.types.str;
|
|
default = "mtls";
|
|
};
|
|
subject = lib.mkOption {
|
|
description = "Subject for the cert";
|
|
type = lib.types.str;
|
|
};
|
|
provisioner = lib.mkOption {
|
|
type = lib.types.nullOr lib.types.str;
|
|
};
|
|
provisionerPasswordFile = lib.mkOption {
|
|
type = lib.types.nullOr lib.types.str;
|
|
};
|
|
overwrite = lib.mkEnableOption "Overwrite existing cert file?";
|
|
SANs = lib.mkOption {
|
|
description = "A list of Subject Alternative Names";
|
|
type = lib.types.listOf lib.types.str;
|
|
default = [ ];
|
|
};
|
|
};
|
|
};
|
|
} |