git.scottworley.com Git - nixos-make-certs/blob - modules/make-certs.nix

   1 {
   2   lib,
   3   config,
   4   pkgs,
   5   ...
   6 }:
   7 let
   8   inherit (lib) escapeShellArg stringAfter;
   9   mkActvationScript =
  10     name: cert-cfg:
  11     let
  12       pem-path = "${cert-cfg.dir}/${name}.pem";
  13       key-path = "${cert-cfg.dir}/${name}.key";
  14     in
  15     {
  16       name = "make-cert-${name}";
  17       value = stringAfter [ "users" ] (
  18         ''
  19           if [[ ! -e ${escapeShellArg pem-path} ]];then
  20             ${pkgs.coreutils}/bin/mkdir -p ${escapeShellArg cert-cfg.dir}
  21             ${pkgs.openssl}/bin/openssl req -batch -x509 -newkey rsa:4096 \
  22               -keyout ${escapeShellArg key-path} \
  23               -out ${escapeShellArg pem-path} \
  24               -days ${escapeShellArg cert-cfg.lifetime} \
  25               -noenc
  26             ${pkgs.coreutils}/bin/chown ${escapeShellArg cert-cfg.user} ${escapeShellArg key-path}
  27           fi
  28         ''
  29         + lib.optionalString cert-cfg.print ''
  30           echo Public certificate for ${escapeShellArg name}: >&2
  31           ${pkgs.coreutils}/bin/cat ${escapeShellArg pem-path} >&2
  32         ''
  33       );
  34     };
  35 in
  36 {
  37   options = {
  38     chkno.make-certs = lib.mkOption {
  39       description = "Certificates to generate.";
  40       example = {
  41         send-email.user = "stunnel";
  42         send-print.user = "stunnel";
  43       };
  44       type = lib.types.attrsOf (
  45         lib.types.submodule {
  46           options = {
  47             dir = lib.mkOption {
  48               type = lib.types.str;
  49               description = "Where to put the certificate and key.";
  50               default = "/secrets";
  51             };
  52             lifetime = lib.mkOption {
  53               type = lib.types.str;
  54               description = "Lifetime of the generated certificate (in days).";
  55               # This doesn't yet include any notion of certificate rotation,
  56               # so just make really long-lived certificates for now.
  57               default = "99999";
  58             };
  59             print = lib.mkOption {
  60               type = lib.types.bool;
  61               description = "If set, print the certificate (public key) during activation.";
  62               default = false;
  63             };
  64             user = lib.mkOption {
  65               type = lib.types.str;
  66               description = "The username that owns (can read) the secret key.";
  67             };
  68           };
  69         }
  70       );
  71     };
  72   };
  73   config = {
  74     system.activationScripts = lib.mapAttrs' mkActvationScript config.chkno.make-certs;
  75   };
  76 }