130 lines
4.3 KiB
Nix
130 lines
4.3 KiB
Nix
{ inputs, ... }:
|
|
{
|
|
flake.modules.nixos.step-ca = { config, pkgs, ... }:
|
|
let
|
|
# Keep host-specific trust anchor in repo; secret/private keys come from sops.
|
|
rootCertPath = ../../hosts/janus/root_ca.crt;
|
|
caPasswordPath = config.sops.secrets."janus/ca_password".path;
|
|
intermediateCrtPath = config.sops.secrets."janus/intermediate_ca_crt".path;
|
|
intermediateKeyPath = config.sops.secrets."janus/intermediate_ca_key".path;
|
|
sshHostCaKeyPath = config.sops.secrets."janus/ssh_host_ca_key".path;
|
|
sshUserCaKeyPath = config.sops.secrets."janus/ssh_user_ca_key".path;
|
|
in
|
|
{
|
|
# Placeholders are expected initially until real material is inserted into sops.
|
|
sops.secrets."janus/ca_password" = {
|
|
sopsFile = ../../hosts/janus/secrets.yaml;
|
|
owner = "step-ca";
|
|
group = "step-ca";
|
|
mode = "0400";
|
|
};
|
|
sops.secrets."janus/intermediate_ca_crt" = {
|
|
sopsFile = ../../hosts/janus/secrets.yaml;
|
|
owner = "step-ca";
|
|
group = "step-ca";
|
|
mode = "0400";
|
|
};
|
|
sops.secrets."janus/intermediate_ca_key" = {
|
|
sopsFile = ../../hosts/janus/secrets.yaml;
|
|
owner = "step-ca";
|
|
group = "step-ca";
|
|
mode = "0400";
|
|
};
|
|
sops.secrets."janus/ssh_host_ca_key" = {
|
|
sopsFile = ../../hosts/janus/secrets.yaml;
|
|
owner = "step-ca";
|
|
group = "step-ca";
|
|
mode = "0400";
|
|
};
|
|
sops.secrets."janus/ssh_user_ca_key" = {
|
|
sopsFile = ../../hosts/janus/secrets.yaml;
|
|
owner = "step-ca";
|
|
group = "step-ca";
|
|
mode = "0400";
|
|
};
|
|
|
|
# https://github.com/NixOS/nixpkgs/blob/nixos-23.05/nixos/modules/services/security/step-ca.nix
|
|
services.step-ca = {
|
|
enable = true;
|
|
openFirewall = true;
|
|
address = "0.0.0.0";
|
|
port = 443;
|
|
intermediatePasswordFile = caPasswordPath;
|
|
|
|
# https://smallstep.com/docs/step-ca/configuration/#configuration-options
|
|
settings = {
|
|
root = rootCertPath;
|
|
crt = intermediateCrtPath;
|
|
key = intermediateKeyPath;
|
|
dnsNames = [
|
|
"janus.john-stream.com"
|
|
"192.168.1.244"
|
|
];
|
|
|
|
ssh = {
|
|
hostKey = sshHostCaKeyPath;
|
|
userKey = sshUserCaKeyPath;
|
|
};
|
|
|
|
db = {
|
|
type = "badgerv2";
|
|
dataSource = "/var/lib/step-ca/db";
|
|
};
|
|
|
|
authority = {
|
|
backdate = "1m0s";
|
|
provisioners = [
|
|
{
|
|
type = "ACME";
|
|
name = "acme";
|
|
}
|
|
{
|
|
type = "SSHPOP";
|
|
name = "sshpop";
|
|
claims.enableSSHCA = true;
|
|
}
|
|
{
|
|
type = "JWK";
|
|
name = "admin";
|
|
key = {
|
|
use = "sig";
|
|
kty = "EC";
|
|
kid = "xoxgOJFbveSLIL2gm1Yu5ZiRb9v8Jxe44F56i3v-Nf8";
|
|
crv = "P-256";
|
|
alg = "ES256";
|
|
x = "zFO8hPx_eH0Iyz7UJI-w8ODMusEKCZ28M76sGWmWYxA";
|
|
y = "XIWLLyKDzqxV9UH-2KeAkKPDrgLoPrxxW9-PzkXggME";
|
|
};
|
|
encryptedKey = "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoiUVJnTnJVTF9KcmxJYkJMVTlGNVRPZyJ9.DMu7xBNCq5pr-_--YTxNr5Hrcqy6ZmSVHsWurfVXL7Hk0Q3vyYRxiw.h-CnFiYc-DhxThI3.plx3_Qa_0kU-2TwnqFNfAfGnCpfQ2e0iiCMLruNHbLMnHeXQ1BysHBqps45_02zZXIRdHoDgYGtXRSfcdUYYoS0pLoPzC6m301ZFNSAFdRVlSZ3Q6VmWdixPXXnEB4EgSKTT_wxR33L8t9OpFzD85KfY-b_Un1l99ufjCnfg-EYkcICTn_G4-8bcW3eFIvJ6setzu-l0jHMhLQdIweqncn9on9xBXBD-ANhZfP95P2BJt-APqCi8eqiAvn_vClovdg0PxzRwOVDvWREz66FDw-HTU7xDtGO9hACopT5tfZOXDoykgZw1mJsq9NEq9ZzvKG2hvyk1UXtExxrNtFo.5q1OfGU4Amo4Si-vpeI42g";
|
|
claims = {
|
|
enableSSHCA = true;
|
|
disableRenewal = false;
|
|
allowRenewalAfterExpiry = false;
|
|
disableSmallstepExtensions = false;
|
|
};
|
|
options = {
|
|
x509 = { };
|
|
ssh = { };
|
|
};
|
|
}
|
|
];
|
|
};
|
|
|
|
tls = {
|
|
cipherSuites = [
|
|
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
|
|
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
|
|
];
|
|
minVersion = 1.2;
|
|
maxVersion = 1.3;
|
|
renegotiation = false;
|
|
};
|
|
};
|
|
};
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
step-ca
|
|
step-cli
|
|
];
|
|
};
|
|
} |