91 lines
2.8 KiB
Nix
91 lines
2.8 KiB
Nix
{ inputs, ... }:
|
|
let
|
|
username = "john";
|
|
hostname = "janus";
|
|
in
|
|
{
|
|
flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
|
|
modules = with inputs.self.modules; [
|
|
nixos.lxc
|
|
nixos.mysops
|
|
nixos.step-ssh-host
|
|
nixos.step-client
|
|
nixos.step-ca
|
|
inputs.home-manager.nixosModules.home-manager
|
|
nixos."${username}"
|
|
nixos.docker
|
|
nixos.login-text
|
|
nixos.mtls
|
|
({ config, lib, pkgs, ... }: {
|
|
networking.hostName = hostname;
|
|
loginText.extraServiceStatus = {
|
|
"Step-CA" = "step-ca";
|
|
};
|
|
sops.defaultSopsFile = ./secrets.yaml;
|
|
sops.secrets."janus/ssh_host_ed25519_key" = {
|
|
sopsFile = ./secrets.yaml;
|
|
owner = "root";
|
|
group = "root";
|
|
mode = "0600";
|
|
path = "/etc/ssh/ssh_host_ed25519_key";
|
|
restartUnits = [ "sshd.service" "step-ssh-host-renew.service" ];
|
|
};
|
|
step-ssh-host = {
|
|
hostname = hostname;
|
|
extraPrincipals = [
|
|
"192.168.1.244"
|
|
"fded:fb16:653e:25da:be24:11ff:fea0:753f"
|
|
];
|
|
};
|
|
step-ca = {
|
|
rootCertPath = ./root_ca.crt;
|
|
intermediateCertPath = ./intermediate_ca.crt;
|
|
dnsNames = [
|
|
"${hostname}.john-stream.com"
|
|
"192.168.1.244"
|
|
];
|
|
secrets = {
|
|
sopsFile = ./secrets.yaml;
|
|
caPassword = "janus/ca_password";
|
|
intermediateKey = "janus/intermediate_ca_key";
|
|
sshHostCaKey = "janus/ssh_host_ca_key";
|
|
sshUserCaKey = "janus/ssh_user_ca_key";
|
|
adminProvisionerEncryptedKey = "janus/admin_provisioner_encrypted_key";
|
|
};
|
|
};
|
|
mtls = {
|
|
enable = true;
|
|
subject = hostname;
|
|
san = [
|
|
"${hostname}.john-stream.com"
|
|
"192.168.1.244"
|
|
];
|
|
bootstrap = {
|
|
enable = true;
|
|
after = [ "network-online.target" "sops-nix.service" "step-ca.service" ];
|
|
wants = [ "network-online.target" "step-ca.service" ];
|
|
provisionerPasswordFile = config.sops.secrets."janus/admin_jwk".path;
|
|
};
|
|
};
|
|
|
|
users.users."${username}" = {
|
|
shell = lib.mkForce (
|
|
lib.getExe inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.jsl-zsh
|
|
);
|
|
};
|
|
|
|
# users.users."${username}".openssh.authorizedKeys.keys = [
|
|
# "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMOkGLo4N/L3RYvaIZ1FmePlxa1HK0fMciZxKtRhN58F root@janus"
|
|
# ];
|
|
|
|
home-manager.users."${username}" = {
|
|
imports = with inputs.self.modules.homeManager; [
|
|
mysops
|
|
step-client
|
|
];
|
|
docker.enable = true;
|
|
};
|
|
})
|
|
];
|
|
};
|
|
} |