93 lines
2.8 KiB
Nix
93 lines
2.8 KiB
Nix
{ inputs, ... }: {
|
|
flake.modules.nixos.ssh-certs = { config, pkgs, lib, ... }:
|
|
let
|
|
cfg = config.ssh-certs;
|
|
wrappers = inputs.self.wrappers;
|
|
sshKeyPath = "/etc/ssh/ssh_host_ed25519_key";
|
|
sshCertPath = "${sshKeyPath}-cert.pub";
|
|
|
|
sshHostCertSign = (wrappers.signHostWrapper.apply {
|
|
inherit pkgs;
|
|
inherit (cfg) provisioner extraPrincipals;
|
|
provisionerPasswordFile = config.sops.secrets."janus/admin_jwk".path;
|
|
}).wrapper;
|
|
sshHostCertRenew = (wrappers.renewHostWrapper.apply {
|
|
inherit pkgs;
|
|
sshHostKeyFile = sshKeyPath;
|
|
overwrite = true;
|
|
}).wrapper;
|
|
sshHostCertCheck = (wrappers.hostCheckWrapper.apply {
|
|
inherit pkgs;
|
|
certPath = sshCertPath;
|
|
}).wrapper;
|
|
sshHostRenewalCheck = (wrappers.renewalCheck.apply {
|
|
inherit pkgs;
|
|
certPath = sshCertPath;
|
|
expires-in = "4h";
|
|
}).wrapper;
|
|
in
|
|
{
|
|
# NixOS Options
|
|
options.ssh-certs = {
|
|
provisioner = lib.mkOption {
|
|
description = "Provisioner inside Step CA to use for the SSH certificates";
|
|
type = lib.types.str;
|
|
default = "admin";
|
|
};
|
|
extraPrincipals = lib.mkOption {
|
|
description = "Additional SSH host certificate principals to include per host";
|
|
type = with lib.types; listOf str;
|
|
default = [ ];
|
|
};
|
|
};
|
|
|
|
# imports = with inputs.self.modules.nixos; [ ssh ];
|
|
|
|
# NixOS Config
|
|
config = {
|
|
# ssh.certificates.enable = true;
|
|
sops.secrets."janus/admin_jwk" = {
|
|
# Shared provisioner credential is intentionally centralized.
|
|
sopsFile = ../../../keys/secrets.yaml;
|
|
owner = "root";
|
|
group = "root";
|
|
mode = "0400";
|
|
};
|
|
networking.nameservers = [ "192.168.1.150" ];
|
|
networking.dhcpcd.extraConfig = "nohook resolv.conf";
|
|
environment.systemPackages = [
|
|
sshHostCertSign
|
|
sshHostCertRenew
|
|
sshHostRenewalCheck
|
|
sshHostCertCheck
|
|
];
|
|
|
|
systemd.services.ssh-certs-renew = {
|
|
description = "SSH host certificate renewal";
|
|
wantedBy = [ "multi-user.target" ];
|
|
after = [ "network-online.target" ];
|
|
wants = [ "network-online.target" ];
|
|
path = with pkgs; [ step-cli systemd ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
User = "root";
|
|
Group = "root";
|
|
ExecCondition = lib.getExe sshHostRenewalCheck;
|
|
ExecStart = lib.getExe sshHostCertRenew;
|
|
};
|
|
};
|
|
|
|
systemd.timers.ssh-certs-renew = {
|
|
description = "Periodic Step SSH host certificate renewal";
|
|
wantedBy = [ "timers.target" ];
|
|
timerConfig = {
|
|
OnBootSec = "5m";
|
|
OnUnitActiveSec = "4h";
|
|
RandomizedDelaySec = "15m";
|
|
Persistent = true;
|
|
Unit = "ssh-certs-renew.service";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
} |