84 lines
2.5 KiB
Nix
84 lines
2.5 KiB
Nix
{ inputs, ... }:
|
|
let
|
|
username = "john";
|
|
hostname = "janus";
|
|
ipv4 = "192.168.1.32";
|
|
ipv6 = "fded:fb16:653e:25da:be24:11ff:fe6b:4d57";
|
|
in
|
|
{
|
|
flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
|
|
modules = with inputs.self.modules; [
|
|
nixos.lxc
|
|
nixos.mysops
|
|
nixos.ssh-certs
|
|
nixos.step-client
|
|
nixos.step-ca
|
|
inputs.home-manager.nixosModules.home-manager
|
|
nixos."${username}"
|
|
nixos.docker
|
|
nixos.login-text
|
|
nixos.mtls
|
|
({ config, lib, pkgs, ... }: {
|
|
networking.hostName = hostname;
|
|
loginText.extraServiceStatus = {
|
|
"Step-CA" = "step-ca";
|
|
};
|
|
sops.defaultSopsFile = ./secrets.yaml;
|
|
ssh-certs = {
|
|
provisioner = "admin";
|
|
extraPrincipals = [ "janus.john-stream.com" ipv4 ipv6 ];
|
|
};
|
|
step-ca = {
|
|
rootCertPath = ./public/root_ca.crt;
|
|
intermediateCertPath = ./public/intermediate_ca.crt;
|
|
dnsNames = [
|
|
"${hostname}.john-stream.com"
|
|
ipv4
|
|
ipv6
|
|
];
|
|
secrets = {
|
|
sopsFile = ./secrets.yaml;
|
|
caPassword = "janus/ca_password";
|
|
intermediateKey = "janus/intermediate_ca_key";
|
|
sshHostCaKey = "janus/ssh_host_ca_key";
|
|
sshUserCaKey = "janus/ssh_user_ca_key";
|
|
adminProvisionerEncryptedKey = "janus/admin_provisioner_encrypted_key";
|
|
};
|
|
};
|
|
step-client.caUrl = "https://${ipv4}/";
|
|
mtls = {
|
|
enable = true;
|
|
subject = hostname;
|
|
san = [
|
|
"${hostname}.john-stream.com"
|
|
ipv4
|
|
];
|
|
bootstrap = {
|
|
enable = true;
|
|
after = [ "sops-nix.service" "step-ca.service" ];
|
|
wants = [ "step-ca.service" ];
|
|
provisionerPasswordFile = config.sops.secrets."janus/admin_jwk".path;
|
|
};
|
|
};
|
|
|
|
users.users."${username}" = {
|
|
shell = lib.mkForce (
|
|
lib.getExe inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.jsl-zsh
|
|
);
|
|
};
|
|
|
|
# users.users."${username}".openssh.authorizedKeys.keys = [
|
|
# "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMOkGLo4N/L3RYvaIZ1FmePlxa1HK0fMciZxKtRhN58F root@janus"
|
|
# ];
|
|
|
|
home-manager.users."${username}" = {
|
|
imports = with inputs.self.modules.homeManager; [
|
|
mysops
|
|
step-client
|
|
];
|
|
docker.enable = true;
|
|
};
|
|
})
|
|
];
|
|
};
|
|
} |