68 lines
2.2 KiB
Nix
68 lines
2.2 KiB
Nix
{ lib, ... }: {
|
|
options.optionModules.ssh-certs = lib.mkOption {
|
|
type = lib.types.deferredModule;
|
|
description = "SSH certificate options";
|
|
};
|
|
|
|
config.optionModules.ssh-certs = { config, lib, pkgs, ... }: {
|
|
# Needed for some kind of de-duping when this module is used more than once?
|
|
key = "ssh-cert-config";
|
|
_file = "modules/features/ssh/config.nix";
|
|
|
|
options.ssh-new = {
|
|
user = {
|
|
keyFile = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "id_ed25519";
|
|
};
|
|
};
|
|
host = {
|
|
configDir = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "/etc/ssh";
|
|
};
|
|
keyFile = lib.mkOption {
|
|
description = "String path to the host private key file";
|
|
type = lib.types.str;
|
|
default = "ssh_host_ed25519_key";
|
|
};
|
|
keyType = lib.mkOption {
|
|
description = "OpenSSH host key type for ssh.hostKey.";
|
|
type = lib.types.enum [ "ed25519" "rsa" "ecdsa" ];
|
|
default = "ed25519";
|
|
};
|
|
extraSettings = lib.mkOption {
|
|
description = "Extra settings to merge";
|
|
type = lib.types.attrs;
|
|
default = { };
|
|
};
|
|
enable-scripts = lib.mkEnableOption "Enable SSH host cert management scripts";
|
|
};
|
|
certificates = {
|
|
provisioner = lib.mkOption {
|
|
type = lib.types.nullOr lib.types.str;
|
|
};
|
|
host = {
|
|
enable = lib.mkEnableOption "Enable SSH host certs";
|
|
autoRenew = lib.mkEnableOption "Auto-renew the SSH host certs with a systemd service/timer";
|
|
extraPrincipals = lib.mkOption {
|
|
type = lib.types.listOf lib.types.str;
|
|
default = [ ];
|
|
};
|
|
};
|
|
user = {
|
|
enable = lib.mkEnableOption "Enable SSH user certs";
|
|
CAFile = lib.mkOption {
|
|
description = "Filename of the SSH user CA with the config directory";
|
|
type = lib.types.str;
|
|
default = "ssh_user_ca_key.pub";
|
|
};
|
|
extraPrincipals = lib.mkOption {
|
|
type = lib.types.listOf lib.types.str;
|
|
default = [ ];
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
} |