64 lines
2.0 KiB
Nix
64 lines
2.0 KiB
Nix
{ inputs, ... }:
|
|
let
|
|
username = "john";
|
|
hostname = "janus";
|
|
ipv4 = "192.168.1.32";
|
|
ipv6 = "fded:fb16:653e:25da:be24:11ff:fe6b:4d57";
|
|
names = [ "${hostname}.john-stream.com" ipv4 ipv6 ];
|
|
in
|
|
{
|
|
flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
|
|
modules = with inputs.self.modules; [
|
|
nixos.lxc
|
|
nixos.login-text
|
|
inputs.home-manager.nixosModules.home-manager
|
|
nixos."${username}"
|
|
nixos.ssh-new
|
|
nixos.mysops
|
|
nixos.step-ca # Runs the step-ca server
|
|
nixos.step-client # Uses the step-ca server as a client
|
|
nixos.mtls
|
|
({ config, lib, pkgs, ... }: {
|
|
networking.hostName = hostname;
|
|
loginText.extraServiceStatus = {
|
|
"Step-CA" = "step-ca";
|
|
};
|
|
sops.defaultSopsFile = ./secrets.yaml;
|
|
ssh-new.certificates = {
|
|
provisioner = "admin";
|
|
host = {
|
|
enable = true;
|
|
extraPrincipals = names;
|
|
autoRenew = true;
|
|
};
|
|
user.enable = true;
|
|
};
|
|
step-ca = {
|
|
rootCertPath = ./public/root_ca.crt;
|
|
intermediateCertPath = ./public/intermediate_ca.crt;
|
|
dnsNames = names;
|
|
secrets = {
|
|
sopsFile = ./secrets.yaml;
|
|
caPassword = "janus/ca_password";
|
|
intermediateKey = "janus/intermediate_ca_key";
|
|
sshHostCaKey = "janus/ssh_host_ca_key";
|
|
sshUserCaKey = "janus/ssh_user_ca_key";
|
|
adminProvisionerEncryptedKey = "janus/admin_provisioner_encrypted_key";
|
|
};
|
|
};
|
|
step-client.caUrl = "https://${ipv4}/";
|
|
mtls = {
|
|
enable = true;
|
|
subject = hostname;
|
|
san = names;
|
|
bootstrap = {
|
|
enable = true;
|
|
after = [ "sops-nix.service" "step-ca.service" ];
|
|
wants = [ "step-ca.service" ];
|
|
provisionerPasswordFile = config.sops.secrets."janus/admin_jwk".path;
|
|
};
|
|
};
|
|
})
|
|
];
|
|
};
|
|
} |