move around

2024-03-28 14:55:31 +01:00
parent 6b1f2cf9de
commit 9b088ec40a
17 changed files with 79 additions and 78 deletions
--- a/modules/services/step-ca.nix
+++ b/modules/services/step-ca.nix
@@ -0,0 +1,91 @@
+{ pkgs, lib, config, ... }:
+let
+  root_ca =
+    ''
+-----BEGIN CERTIFICATE-----
+MIIBjTCCATKgAwIBAgIRAMVH2+JHZ3wm2fLUlKjTYDswCgYIKoZIzj0EAwIwJDEM
+MAoGA1UEChMDS29wMRQwEgYDVQQDEwtLb3AgUm9vdCBDQTAeFw0yMzEyMDgxNDUx
+MTZaFw0zMzEyMDUxNDUxMTZaMCQxDDAKBgNVBAoTA0tvcDEUMBIGA1UEAxMLS29w
+IFJvb3QgQ0EwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATdZBOkNynShXipzhuX
+f6dUByD3chNupNWsagYC5AlPRJT9fAeHEIK/bxWkFwRtLBDopWvBu9lHahBgpHc7
+y7rTo0UwQzAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBATAdBgNV
+HQ4EFgQU9AVtwipW5HDBLfZRH1KZCnIKCfowCgYIKoZIzj0EAwIDSQAwRgIhAMHj
+AipNdhQKIYPvMt/h1uW4xP3NTkitnmshM09+rIasAiEAlSalGddXDkqJBHhPD+Fr
+gpuVkfVkA8gQCXNs5F9TnxA=
+-----END CERTIFICATE-----
+    '';
+  intermediate_ca =
+    ''
+-----BEGIN CERTIFICATE-----
+MIIBtDCCAVqgAwIBAgIQbEVEV7LgtjVWO+qBrrmgETAKBggqhkjOPQQDAjAkMQww
+CgYDVQQKEwNLb3AxFDASBgNVBAMTC0tvcCBSb290IENBMB4XDTIzMTIwODE0NTEx
+N1oXDTMzMTIwNTE0NTExN1owLDEMMAoGA1UEChMDS29wMRwwGgYDVQQDExNLb3Ag
+SW50ZXJtZWRpYXRlIENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEmv7jg7Cs
+4L5v52+3yUmn79hZFS2vmm/5wwcUCL63dokEXQsHgbEjaRKsF/MW0yJDLTB6Sdhl
+pCvoNJqITWuEN6NmMGQwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C
+AQAwHQYDVR0OBBYEFDgVolMCmdrhDIXhuIs4q/KwRKNLMB8GA1UdIwQYMBaAFPQF
+bcIqVuRwwS32UR9SmQpyCgn6MAoGCCqGSM49BAMCA0gAMEUCIQCQa01E+UvAJ8KR
+DFfDducZUpW4tZRN35lqoge7T9nM2QIgK4FFt1NqDqcjOSabAXPOQ68bvdxlHW0y
+AgN9qNc3Jbo=
+-----END CERTIFICATE-----
+'';
+
+in
+{
+  security.pki.certificates = [ root_ca ];
+  age.secrets.step-ca-pw = {
+    file = ../../secrets/step-ca-pw.age;
+    owner = "step-ca";
+    group = "step-ca";
+  };
+  age.secrets.step-ca-key = {
+    file = ../../secrets/step-ca-key.age;
+    owner = "step-ca";
+    group = "step-ca";
+  };
+  services.step-ca = {
+    enable = true;
+    address = "127.0.0.1";
+    port = 8443;
+    intermediatePasswordFile = config.age.secrets.step-ca-pw.path;
+    settings = {
+      dnsNames = [ "localhost" "127.0.0.1" "*.home.arpa" ];
+      root = pkgs.writeTextFile {
+        name = "root.ca";
+        text = root_ca;
+      };
+      crt = pkgs.writeTextFile {
+        name = "intermediate.ca";
+        text = intermediate_ca;
+      };
+      key = config.age.secrets.step-ca-key.path;
+      db = {
+        type = "badger";
+        dataSource = "/var/lib/step-ca/db";
+      };
+      authority = {
+        claims = {
+          minTLSCertDuration = "5m";
+          maxTLSCertDuration = "72h";
+          defaultTLSCertDuration = "72h";
+        };
+        provisioners = [
+          {
+            type = "ACME";
+            name = "acme";
+            forceCN = true;
+          }
+        ];
+      };
+      tls = {
+        cipherSuites = [
+          "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
+          "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
+        ];
+	minVersion = 1.2;
+	maxVersion = 1.3;
+	renegotiation = false;
+      };
+    };
+  };
+}