99 lines
3.0 KiB
Nix
99 lines
3.0 KiB
Nix
{ inputs, ... }:
|
|
let
|
|
username = "john";
|
|
hostname = "janus";
|
|
in
|
|
{
|
|
flake.modules.nixos.janus-ca =
|
|
{ config, pkgs, lib, ... }:
|
|
let
|
|
cfg = config.janus-ca;
|
|
johnHome = lib.attrByPath [ "users" "users" username "home" ] "/home/${username}" config;
|
|
johnGroup = lib.attrByPath [ "users" "users" username "group" ] username config;
|
|
cfgInEtc = lib.hasPrefix "/etc/" cfg.certDir;
|
|
certDirEtcPath =
|
|
if cfgInEtc then
|
|
lib.removePrefix "/etc/" cfg.certDir
|
|
else
|
|
cfg.certDir;
|
|
mkStepRules = home: user: group: [
|
|
"d ${home}/.step 0700 ${user} ${group} -"
|
|
"d ${home}/.step/config 0700 ${user} ${group} -"
|
|
"d ${home}/.step/certs 0700 ${user} ${group} -"
|
|
"L+ ${home}/.step/config/defaults.json - - - - /etc/step-ca/defaults.json"
|
|
"L+ ${home}/.step/certs/root_ca.crt - - - - ${cfg.certDir}/root_ca.crt"
|
|
];
|
|
in
|
|
{
|
|
options.janus-ca = {
|
|
certDir = lib.mkOption {
|
|
description = "String path to where the mtls certs will be stored.";
|
|
type = lib.types.str;
|
|
default = "/etc/step-ca/certs";
|
|
};
|
|
};
|
|
|
|
config = {
|
|
environment.etc = lib.mkIf cfgInEtc {
|
|
"step-ca/defaults.json".text = builtins.toJSON {
|
|
ca-url = "https://janus.john-stream.com/";
|
|
fingerprint = "2036c44f7b5901566ff7611ea6c927291ecc6d2dd00779c0eead70ec77fa10d6";
|
|
root = ./root_ca.crt;
|
|
};
|
|
};
|
|
systemd.tmpfiles.rules =
|
|
mkStepRules johnHome username johnGroup
|
|
++ mkStepRules "/root" "root" "root";
|
|
};
|
|
};
|
|
|
|
flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
|
|
modules = with inputs.self.modules; [
|
|
nixos.lxc
|
|
nixos.mysops
|
|
nixos.step-ssh-host
|
|
nixos.janus-ca
|
|
inputs.home-manager.nixosModules.home-manager
|
|
nixos."${username}"
|
|
nixos.docker
|
|
nixos.login-text
|
|
nixos.mtls
|
|
({ lib, pkgs, ... }: {
|
|
networking.hostName = hostname;
|
|
sops.defaultSopsFile = ../../../keys/secrets.yaml;
|
|
step-ssh-host = {
|
|
hostname = hostname;
|
|
extraPrincipals = [
|
|
"192.168.1.244"
|
|
"fded:fb16:653e:25da:be24:11ff:fea0:753f"
|
|
];
|
|
};
|
|
mtls = {
|
|
enable = true;
|
|
subject = hostname;
|
|
san = [
|
|
"${hostname}.john-stream.com"
|
|
"192.168.1.244"
|
|
];
|
|
};
|
|
|
|
users.users."${username}" = {
|
|
shell = lib.mkForce (
|
|
lib.getExe inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.jsl-zsh
|
|
);
|
|
};
|
|
|
|
# users.users."${username}".openssh.authorizedKeys.keys = [
|
|
# "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMOkGLo4N/L3RYvaIZ1FmePlxa1HK0fMciZxKtRhN58F root@janus"
|
|
# ];
|
|
|
|
home-manager.users."${username}" = {
|
|
imports = with inputs.self.modules.homeManager; [
|
|
mysops
|
|
];
|
|
docker.enable = true;
|
|
};
|
|
})
|
|
];
|
|
};
|
|
} |