115 lines
4.0 KiB
Nix
115 lines
4.0 KiB
Nix
{ self, inputs, config, ... }:
|
|
let
|
|
sshCertConfig = config.optionModules.ssh-certs;
|
|
mkHostKeyFile = cfg: "${cfg.host.configDir}/${cfg.host.keyFile}";
|
|
mkPrincipalArgs = principals:
|
|
builtins.concatLists (map (principal: [ "--principal" principal ]) principals);
|
|
in
|
|
{
|
|
flake.wrappers.signHostWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
|
|
imports = [ sshCertConfig ];
|
|
config = let cfg = config.ssh-new; in {
|
|
binName = "ssh-host-cert-sign";
|
|
package = config.pkgs.step-cli;
|
|
extraPackages = with config.pkgs; [ hostname iproute2 systemd ];
|
|
preHook = ''
|
|
HOSTNAME=$(hostname -s)
|
|
IP_ADDRESS=$(ip -4 -o addr show scope global | while read -r _ _ _ addr _; do
|
|
case "$addr" in
|
|
192.168.1.*/*)
|
|
printf '%s\n' "''${addr%%/*}"
|
|
break
|
|
;;
|
|
esac
|
|
done)
|
|
echo "Signing SSH host cert for $HOSTNAME at $IP_ADDRESS"
|
|
'';
|
|
args =
|
|
[
|
|
"ssh" "certificate"
|
|
"--host" "--sign"
|
|
"--principal" "$HOSTNAME"
|
|
"--principal" "$IP_ADDRESS"
|
|
]
|
|
++ lib.optionals (cfg.certificates.provisioner != null) [
|
|
"--provisioner" "${cfg.certificates.provisioner}"
|
|
]
|
|
++ lib.optionals (cfg.certificates.provisionerPasswordFile != null) [
|
|
"--provisioner-password-file" "${cfg.certificates.provisionerPasswordFile}"
|
|
]
|
|
++ lib.optionals cfg.certificates.overwrite [ "-f" ]
|
|
++ mkPrincipalArgs cfg.certificates.host.extraPrincipals;
|
|
};
|
|
});
|
|
|
|
flake.wrappers.renewHostWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
|
|
imports = [ sshCertConfig ];
|
|
config = {
|
|
binName = "ssh-host-cert-renew";
|
|
package = config.pkgs.step-cli;
|
|
extraPackages = with config.pkgs; [ systemd ];
|
|
args =
|
|
let hostKeyFile = mkHostKeyFile config.ssh-new;
|
|
in [ "ssh" "renew" "${hostKeyFile}-cert.pub" "${hostKeyFile}" ]
|
|
++ lib.optionals config.ssh-new.certificates.overwrite [ "-f" ];
|
|
};
|
|
});
|
|
|
|
flake.wrappers.hostCheckWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
|
|
imports = [ sshCertConfig ];
|
|
config = {
|
|
binName = "ssh-host-cert-check";
|
|
package = config.pkgs.openssh;
|
|
exePath = lib.getExe' config.pkgs.openssh "ssh-keygen";
|
|
args = [ "-Lf" "${mkHostKeyFile config.ssh-new}-cert.pub" ];
|
|
};
|
|
});
|
|
|
|
flake.wrappers.signUserWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
|
|
imports = [ sshCertConfig ];
|
|
config = let cfg = config.ssh-new; in {
|
|
binName = "ssh-user-cert-sign";
|
|
package = config.pkgs.step-cli;
|
|
args = [ "ssh" "certificate" "--sign" ]
|
|
++ lib.optionals (cfg.certificates.provisioner != null) [
|
|
"--provisioner" "${cfg.certificates.provisioner}"
|
|
]
|
|
++ lib.optionals (cfg.certificates.provisionerPasswordFile != null) [
|
|
"--provisioner-password-file" "${cfg.certificates.provisionerPasswordFile}"
|
|
]
|
|
++ lib.optionals cfg.certificates.overwrite [ "-f" ]
|
|
++ mkPrincipalArgs cfg.certificates.user.extraPrincipals;
|
|
};
|
|
});
|
|
|
|
flake.wrappers.userCheckWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
|
|
imports = [ sshCertConfig ];
|
|
config = {
|
|
binName = "ssh-user-cert-check";
|
|
package = config.pkgs.openssh;
|
|
exePath = lib.getExe' config.pkgs.openssh "ssh-keygen";
|
|
args = [ "-Lf" "${config.ssh-new.user.keyFile}-cert.pub" ];
|
|
};
|
|
});
|
|
|
|
flake.wrappers.renewalCheck = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
|
|
imports = [ sshCertConfig ];
|
|
config =
|
|
let
|
|
cfg = config.ssh-new;
|
|
hostKeyFile = mkHostKeyFile cfg;
|
|
hostCertFile = "${hostKeyFile}-cert.pub";
|
|
in
|
|
{
|
|
binName = "ssh-renewal-check";
|
|
package = config.pkgs.step-cli;
|
|
preHook = ''
|
|
echo "Checking SSH cert at ${hostCertFile}"
|
|
'';
|
|
args = [
|
|
"ssh" "needs-renewal" hostCertFile
|
|
"--expires-in" "${cfg.certificates.host.expires-in}"
|
|
];
|
|
};
|
|
});
|
|
} |