all repos — nixfiles @ 42b51878c262425ed425d6522ad5c658fd75b24d

System and user configuration, managed by nix and home-manager

extract local certificate authority setup to module

Alin
commit

42b51878c262425ed425d6522ad5c658fd75b24d

parent

b0958bfbbde80c9190a128fa8523514ceac71ac6

1 file changed, 52 insertions(+), 0 deletions(-)

changed files
A system/roles/local-ca.nix
@@ -0,0 +1,52 @@
+{
+  config,
+  ...
+}:
+let
+  inherit (config.networking) hostName domain;
+in
+{
+  services.caddy = {
+    enable = true;
+    globalConfig = ''
+      pki {
+        ca home {
+          name "Home CA"
+        }
+      }
+    '';
+    virtualHosts = {
+      "${hostName}.${domain}" = {
+        extraConfig = ''
+          tls {
+            issuer internal {
+              ca home
+            }
+          }
+        '';
+      };
+      "ca.${domain}" = {
+        # cd /var/lib/caddy && install -D -m 444 .local/share/caddy/pki/authorities/home/root.crt ca/root.crt
+        serverAliases = [ "http://ca.${domain}" ];
+        extraConfig = ''
+          tls {
+            issuer internal {
+              ca home
+            }
+          }
+          acme_server {
+            allow {
+              domains *.test *.${domain}
+            }
+          }
+          root /var/lib/caddy/ca
+          file_server browse
+        '';
+      };
+    };
+  };
+
+  services.dnsmasq.settings.cname = [
+    "ca.${domain},${hostName}.${domain}"
+  ];
+}