adriangl
566732a02c
Add a general environment.snakeoil-certs module that generates self-signed certs at runtime (oneshot service + daily timer, idempotent via x509 -checkend). Terminate TLS for vaultwarden with nginx on port 8001 -> 127.0.0.1:8000 using a snakeoil cert, so it's reachable over the tailnet IP without the broken public reverse proxy.
100 lines
2.9 KiB
Nix
100 lines
2.9 KiB
Nix
{
|
|
config,
|
|
pkgs,
|
|
lib,
|
|
...
|
|
}:
|
|
|
|
let
|
|
cfg = config.environment.snakeoil-certs;
|
|
in
|
|
{
|
|
options.environment.snakeoil-certs = lib.mkOption {
|
|
type = lib.types.attrsOf (
|
|
lib.types.submodule (
|
|
{ name, ... }:
|
|
{
|
|
options = {
|
|
certificate = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "/var/lib/snakeoil-certs/${name}.crt";
|
|
};
|
|
certificateKey = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "/var/lib/snakeoil-certs/${name}.key";
|
|
};
|
|
owner = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "root";
|
|
};
|
|
group = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "root";
|
|
};
|
|
mode = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "0660";
|
|
};
|
|
daysValid = lib.mkOption {
|
|
type = lib.types.int;
|
|
default = 3650;
|
|
};
|
|
subject = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "/CN=${name}";
|
|
};
|
|
extraOpenSSLArgs = lib.mkOption {
|
|
type = lib.types.listOf lib.types.str;
|
|
default = [ ];
|
|
};
|
|
};
|
|
}
|
|
)
|
|
);
|
|
default = { };
|
|
description = "Self-signed (snakeoil) certificates generated at runtime.";
|
|
};
|
|
|
|
config = lib.mkIf (cfg != { }) {
|
|
systemd.services.generate-snakeoil-certs = {
|
|
description = "Generate self-signed certificates";
|
|
after = [ "local-fs.target" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
serviceConfig.Type = "oneshot";
|
|
script =
|
|
let
|
|
openssl = lib.getExe pkgs.openssl;
|
|
in
|
|
lib.concatMapStringsSep "\n" (
|
|
{ value, ... }:
|
|
''
|
|
mkdir -p "$(dirname "${value.certificate}")" "$(dirname "${value.certificateKey}")"
|
|
if ! ${openssl} x509 -checkend 86400 -noout -in "${value.certificate}" 2>/dev/null; then
|
|
${openssl} req \
|
|
-newkey rsa:2048 \
|
|
-nodes \
|
|
-x509 \
|
|
-days ${toString value.daysValid} \
|
|
-subj "${value.subject}" \
|
|
-out "${value.certificate}" \
|
|
-keyout "${value.certificateKey}" \
|
|
${lib.escapeShellArgs value.extraOpenSSLArgs}
|
|
fi
|
|
chown "${value.owner}:${value.group}" "${value.certificate}" "${value.certificateKey}"
|
|
chmod "${value.mode}" "${value.certificate}" "${value.certificateKey}"
|
|
''
|
|
) (lib.attrsToList cfg);
|
|
};
|
|
|
|
systemd.timers.generate-snakeoil-certs = {
|
|
description = "Periodically ensure self-signed certificates exist";
|
|
wantedBy = [ "timers.target" ];
|
|
timerConfig = {
|
|
OnCalendar = "*-*-* 02:00:00";
|
|
Persistent = true;
|
|
Unit = "generate-snakeoil-certs.service";
|
|
};
|
|
};
|
|
};
|
|
}
|