step-ca added

2026-06-15 22:41:52 +03:00 · 2026-06-13 23:08:34 +03:00
parent 6468c6583e
commit 544aafd919
5 changed files with 146 additions and 18 deletions
@@ -0,0 +1,83 @@
+{
+  config,
+  inputs,
+  pkgs,
+  xlib,
+  ...
+}:
+let
+  configDir = "${xlib.dirs.services-mnt-folder}/step-ca";
+  varDir = "/var/lib/step-ca";
+in
+{
+  services.step-ca = {
+    enable = true;
+    address = "0.0.0.0";
+    port = 9000;
+    openFirewall = true;
+    intermediatePasswordFile = config.sops.secrets.intermediate-password.path;
+    settings = {
+      root = "${varDir}/certs/root_ca.crt";
+      crt = "${varDir}/certs/intermediate_ca.crt";
+      key = "${varDir}/secrets/intermediate_ca_key";
+      # address = "0.0.0.0:9000";
+      dnsNames = [
+        "ca.zeroq.su"
+      ];
+      db = {
+        type = "badgerv2";
+        dataSource = "${varDir}/db";
+      };
+      authority = {
+        provisioners = [
+          {
+            type = "JWK";
+            name = "oqyude@zeroq.su";
+            key = {
+              use = "sig";
+              kty = "EC";
+              kid = "XEpzFJA-sedFf0ANCiEH1UDaSvrHiZabLahQOyoAYmc";
+              crv = "P-256";
+              alg = "ES256";
+              x = "AGHevH0UU7_abhE6d8JhNuNRgXBeVI7qCldZrFfkn5o";
+              y = "pLKOpAwUiGRv4HRQUyiXFAMqsywTjrjazeEkDOr29Sk";
+            };
+            encryptedKey = "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoibFlONzBwMWJiVzc0MDlGaS1EOEZVUSJ9.zBEsf2hAaj4yyy_Lk1Jss7h5Hn68kz6UMeg3Jz3X_VVeMWLvcoRVaw.tpY50S9CSzmcfWXz.u5ta_Yd3GLMz19RKA2WondVIwTGbGs3is5v7_D0aUOtQ0158d4GcjrOHFD2PexaackbTNuUPtqa2X38ypnFq5wh1uq3udWu-qWRjRSd_YkY4YJt_GWFvUHQ_jldx0NSfMDNGndU2IakR62-9WklEjU3UGmUeaPGP9DTuzmdJa36t2aLuPuNnmV-tEJIH3eQ5huU8nLy1ROZjdkrF-agHh78EG_Ss8P4vHuqOtTAjZW3YCtfSfb57iKAsbrk3nUTo6zhPc0ds8cPB7Rva0K8Rj2Pf3apB7qZnCVF5zBiu1icvhOYIfwVQAiqpdz6qMi42QSBWZ4ROu4Db2q5a6D0.AS7Dr3v_Niiwy7aHIR-0bw";
+          }
+        ];
+      };
+    };
+  };
+
+  fileSystems."${varDir}" = {
+    device = "${configDir}";
+    fsType = "none";
+    options = [
+      "bind"
+      "nofail"
+    ];
+  };
+
+  environment = {
+    systemPackages = with pkgs; [
+      step-cli
+    ];
+  };
+
+  systemd.tmpfiles.rules = [
+    "d ${configDir} 0755 nobody nogroup -"
+    "z ${configDir} 0755 nobody nogroup -"
+    "Z ${configDir}/ 0700 nobody nogroup -"
+  ];
+
+  sops.secrets = {
+    intermediate-password = {
+      format = "yaml";
+      key = "intermediate-password";
+      sopsFile = ./secrets/step-ca.yaml;
+      # owner = "nobody";
+      # group = "nogroup";
+      mode = "0600";
+    };
+  };
+}