all repos — nixfiles @ 42b51878c262425ed425d6522ad5c658fd75b24d

System and user configuration, managed by nix and home-manager

extract local certificate authority setup to module

Alin
commit

42b51878c262425ed425d6522ad5c658fd75b24d

parent

b0958bfbbde80c9190a128fa8523514ceac71ac6

1 file changed, 1 insertion(+), 38 deletions(-)

changed files
M system/hosts/r5.nix → system/hosts/r5.nix
@@ -14,6 +14,7 @@ imports = [
     ../roles/home.nix
     ../roles/server.nix
     ../roles/router.nix
+    ../roles/local-ca.nix
     ../roles/tailscale-subnet-router.nix
     ../settings/hardware/usb-serial-tty.nix
   ];

@@ -75,44 +76,6 @@ extraGroups = [ "wheel" ];
     openssh.authorizedKeys.keys = [
       "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBENXbdPPOq0mA+9bPklpUkikvIXjCEKE5IRwNPNMr5/Ta1J/ND737fexCjEb7YPoAJtaf0gD/JThQQi/RxDTvy4= alin@secretive.marvin.local"
     ];
-  };
-
-  services.caddy = {
-    globalConfig = ''
-      pki {
-        ca home {
-          name "Home CA"
-        }
-      }
-    '';
-    virtualHosts = {
-      "${hostName}.${domain}" = {
-        serverAliases = [ "${hostName}.${tailnet}" ];
-        extraConfig = ''
-          tls {
-            issuer internal {
-              ca home
-            }
-          }
-          root /var/lib/caddy/ca
-          file_server browse
-        '';
-      };
-      "ca.${domain}" = {
-        extraConfig = ''
-          tls {
-            issuer internal {
-              ca home
-            }
-          }
-          acme_server {
-            allow {
-              domains *.test *.${domain}
-            }
-          }
-        '';
-      };
-    };
   };
 
   nix = {