all repos — nixfiles @ 42b51878c262425ed425d6522ad5c658fd75b24d

System and user configuration, managed by nix and home-manager

extract local certificate authority setup to module

Alin
commit

42b51878c262425ed425d6522ad5c658fd75b24d

parent

b0958bfbbde80c9190a128fa8523514ceac71ac6

4 files changed, 53 insertions(+), 78 deletions(-)

changed files
M system/hosts/r5.nix → system/hosts/r5.nix
@@ -14,6 +14,7 @@ imports = [
     ../roles/home.nix
     ../roles/server.nix
     ../roles/router.nix
+    ../roles/local-ca.nix
     ../roles/tailscale-subnet-router.nix
     ../settings/hardware/usb-serial-tty.nix
   ];

@@ -75,44 +76,6 @@ extraGroups = [ "wheel" ];
     openssh.authorizedKeys.keys = [
       "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBENXbdPPOq0mA+9bPklpUkikvIXjCEKE5IRwNPNMr5/Ta1J/ND737fexCjEb7YPoAJtaf0gD/JThQQi/RxDTvy4= alin@secretive.marvin.local"
     ];
-  };
-
-  services.caddy = {
-    globalConfig = ''
-      pki {
-        ca home {
-          name "Home CA"
-        }
-      }
-    '';
-    virtualHosts = {
-      "${hostName}.${domain}" = {
-        serverAliases = [ "${hostName}.${tailnet}" ];
-        extraConfig = ''
-          tls {
-            issuer internal {
-              ca home
-            }
-          }
-          root /var/lib/caddy/ca
-          file_server browse
-        '';
-      };
-      "ca.${domain}" = {
-        extraConfig = ''
-          tls {
-            issuer internal {
-              ca home
-            }
-          }
-          acme_server {
-            allow {
-              domains *.test *.${domain}
-            }
-          }
-        '';
-      };
-    };
   };
 
   nix = {
M system/hosts/r6.nix → system/hosts/r6.nix
@@ -106,45 +106,6 @@ "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJVREjPey2TOIPzfYJoG9yIR4Rui7tNJK2QIKa+pbgsyXg31hhPIw37LRRIic+l53mW8eahHxX3Y1IeTjcMw8IU= alan@secretive.marvin.local"
     ];
   };
 
-  services.caddy = {
-    enable = true;
-    globalConfig = ''
-      pki {
-        ca home {
-          name "Home CA"
-        }
-      }
-    '';
-    virtualHosts = {
-      "${hostName}.${domain}" = {
-        serverAliases = [ "${hostName}.${tailnet}" ];
-        extraConfig = ''
-          tls {
-            issuer internal {
-              ca home
-            }
-          }
-          root /var/lib/caddy/ca
-          file_server browse
-        '';
-      };
-      "ca.${domain}" = {
-        extraConfig = ''
-          tls {
-            issuer internal {
-              ca home
-            }
-          }
-          acme_server {
-            allow {
-              domains *.test *.${domain}
-            }
-          }
-        '';
-      };
-    };
-  };
-
   nix = {
     distributedBuilds = true;
     settings = {
A system/roles/local-ca.nix
@@ -0,0 +1,52 @@
+{
+  config,
+  ...
+}:
+let
+  inherit (config.networking) hostName domain;
+in
+{
+  services.caddy = {
+    enable = true;
+    globalConfig = ''
+      pki {
+        ca home {
+          name "Home CA"
+        }
+      }
+    '';
+    virtualHosts = {
+      "${hostName}.${domain}" = {
+        extraConfig = ''
+          tls {
+            issuer internal {
+              ca home
+            }
+          }
+        '';
+      };
+      "ca.${domain}" = {
+        # cd /var/lib/caddy && install -D -m 444 .local/share/caddy/pki/authorities/home/root.crt ca/root.crt
+        serverAliases = [ "http://ca.${domain}" ];
+        extraConfig = ''
+          tls {
+            issuer internal {
+              ca home
+            }
+          }
+          acme_server {
+            allow {
+              domains *.test *.${domain}
+            }
+          }
+          root /var/lib/caddy/ca
+          file_server browse
+        '';
+      };
+    };
+  };
+
+  services.dnsmasq.settings.cname = [
+    "ca.${domain},${hostName}.${domain}"
+  ];
+}
M system/roles/router.nix → system/roles/router.nix
@@ -202,7 +202,6 @@ expand-hosts = true;
       localise-queries = true;
       interface-name = [
         "${hostName}.${domain},${lan}"
-        "ca.${domain},${lan}"
         "wan.${domain},${wan}"
       ];
     };