103 lines
3.5 KiB
Nix
103 lines
3.5 KiB
Nix
{ self, inputs, config, ... }:
|
|
let
|
|
sshCertConfig = config.optionModules.ssh-certs;
|
|
mkPrincipalArgs = principals:
|
|
builtins.concatLists (map (principal: [ "--principal" principal ]) principals);
|
|
in
|
|
{
|
|
flake.wrappers.signHostWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
|
|
imports = [ sshCertConfig ];
|
|
config = {
|
|
binName = "ssh-host-cert-sign";
|
|
package = config.pkgs.step-cli;
|
|
extraPackages = with config.pkgs; [ hostname iproute2 systemd ];
|
|
preHook = ''
|
|
HOSTNAME=$(hostname -s)
|
|
IP_ADDRESS=$(ip -4 -o addr show scope global | while read -r _ _ _ addr _; do
|
|
case "$addr" in
|
|
192.168.1.*/*)
|
|
printf '%s\n' "''${addr%%/*}"
|
|
break
|
|
;;
|
|
esac
|
|
done)
|
|
echo "Signing SSH host cert for $HOSTNAME at $IP_ADDRESS"
|
|
'';
|
|
args =
|
|
[
|
|
"ssh" "certificate"
|
|
"--host" "--sign"
|
|
"--principal" "$HOSTNAME"
|
|
"--principal" "$IP_ADDRESS"
|
|
]
|
|
++ lib.optionals (config.provisioner != null) [ "--provisioner" "${config.provisioner}" ]
|
|
++ lib.optionals (config.provisionerPasswordFile != null) [
|
|
"--provisioner-password-file" "${config.provisionerPasswordFile}"
|
|
]
|
|
++ lib.optionals config.overwrite [ "-f" ]
|
|
++ mkPrincipalArgs config.extraPrincipals;
|
|
};
|
|
});
|
|
|
|
flake.wrappers.renewHostWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
|
|
imports = [ sshCertConfig ];
|
|
config = {
|
|
binName = "ssh-host-cert-renew";
|
|
package = config.pkgs.step-cli;
|
|
extraPackages = with config.pkgs; [ systemd ];
|
|
args =
|
|
[ "ssh" "renew" "${config.sshHostKeyFile}-cert.pub" "${config.sshHostKeyFile}" ]
|
|
++ lib.optionals config.overwrite [ "-f" ];
|
|
};
|
|
});
|
|
|
|
flake.wrappers.hostCheckWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
|
|
imports = [ sshCertConfig ];
|
|
config = {
|
|
binName = "ssh-host-cert-check";
|
|
package = config.pkgs.openssh;
|
|
exePath = lib.getExe' config.pkgs.openssh "ssh-keygen";
|
|
args = [ "-Lf" "${config.certPath}" ];
|
|
};
|
|
});
|
|
|
|
flake.wrappers.signUserWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
|
|
imports = [ sshCertConfig ];
|
|
config = {
|
|
binName = "ssh-user-cert-sign";
|
|
package = config.pkgs.step-cli;
|
|
args = [ "ssh" "certificate" "--sign" ]
|
|
++ lib.optionals (config.provisioner != null) [ "--provisioner" "${config.provisioner}" ]
|
|
++ lib.optionals (config.provisionerPasswordFile != null) [
|
|
"--provisioner-password-file" "${config.provisionerPasswordFile}"
|
|
]
|
|
++ lib.optionals config.overwrite [ "-f" ]
|
|
++ mkPrincipalArgs config.validUsers;
|
|
};
|
|
});
|
|
|
|
flake.wrappers.userCheckWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
|
|
imports = [ sshCertConfig ];
|
|
config = {
|
|
binName = "ssh-user-cert-check";
|
|
package = config.pkgs.openssh;
|
|
exePath = lib.getExe' config.pkgs.openssh "ssh-keygen";
|
|
args = [ "-Lf" "${config.certPath}" ];
|
|
};
|
|
});
|
|
|
|
flake.wrappers.renewalCheck = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
|
|
imports = [ sshCertConfig ];
|
|
config = {
|
|
binName = "ssh-renewal-check";
|
|
package = config.pkgs.step-cli;
|
|
preHook = ''
|
|
echo "Checking SSH cert at ${config.certPath}"
|
|
'';
|
|
args = [
|
|
"ssh" "needs-renewal" "${config.certPath}"
|
|
"--expires-in" "${config.expires-in}"
|
|
];
|
|
};
|
|
});
|
|
} |