From ba7b36f16e13b5607d686d6462aced2390a5de68 Mon Sep 17 00:00:00 2001 From: oqyude Date: Tue, 23 Jun 2026 23:22:08 +0300 Subject: [PATCH] step-ca config --- configurations/server.nix | 3 +++ modules/essentials/secrets/settings.yaml | 17 ++++++++++++ modules/essentials/settings.nix | 34 ++++++++++++++++++++++++ modules/server/nginx.nix | 32 ++++++++++++++++++++++ modules/server/secrets/step-ca.yaml | 4 +-- modules/server/step-ca.nix | 7 ++++- 6 files changed, 94 insertions(+), 3 deletions(-) create mode 100644 modules/essentials/secrets/settings.yaml diff --git a/configurations/server.nix b/configurations/server.nix index 0fba112..560f098 100644 --- a/configurations/server.nix +++ b/configurations/server.nix @@ -113,6 +113,9 @@ let hostName = "${xlib.device.hostname}"; networkmanager.enable = true; firewall.enable = false; + nameservers = [ + "127.0.0.1" + ]; }; system = { diff --git a/modules/essentials/secrets/settings.yaml b/modules/essentials/secrets/settings.yaml new file mode 100644 index 0000000..f1bbd5a --- /dev/null +++ b/modules/essentials/secrets/settings.yaml @@ -0,0 +1,17 @@ +root-ca: ENC[AES256_GCM,data:5WxHCyp8sWl+XMpmMFQGfs+IhZx0r61JVFp7TJsn4pnCwV2KY/eyh6pEF+GF+P7eXALPEWGzdFYTzMJd6KJ+D+Ew0bLomIZ+KVhlxhgVzKG0xThrLpxSuyrrRFFfXzMz7C28v1HlBht6xtwKouPnxQcXDYTLyV52w7FrhWTXPuJ+TvaYDlHJcs3wHY5U+UiCoQZMcM8ddNkgbMqCu+/QC4G213EoJvjhQz+woXzIuqN8SYsOVmQ5su9Xy1sDMc8vIF+vl1Ax1E+T7ZqnE4E/7Y7HNzBQFpBGZjTb3JLUoyO4ALo0S36Yls12MWj/AZBmoBG8yL4wwA48FBHzGyH1aYtbWA/twJLDYzmu9saORW/TKIMrzeruxdufWU9sRs1f2BxpefAa2kZ8QTxhx2+3kUiOC1lipIjdMu9RSeq7q4HmKRTmuuXW087ere+IMhogh11RoshttB1W0/BU/dz6sYwAnCioSoOCd3n+WBGfuMNyeDjkpNJ4veg2HuU/K84rLFjNsxWnRfQML0BjUDHzFypA4dNIDo/FI0Z1cOrPojiqjwKt5Fb0XljTwfDQvkRtcZOQLVln7HfJlsU67YUCBMgJUJUTC3XKo82smZbz8JV1z8I9hVfnSfoEMiqNvDu3wKPGDpjWq0hAKD2R82keKe3Ji33Z2O4HK0e0Q7vSPP/Z5gIAay2S2aS2YLpqlvgzipqiLo2owzM2Mr4NrKRL9Vg36na7bLBPEoz+l9EK8EEiZaq+c8H2+dpmXpdmnUMQDF5yBxs4EU2M6Ga+X+2SYd1q9aZBT0yxykFkQrMUcA==,iv:Ee4tvSVLdk0Clh8vohbajEaKXJlQJjqOIu2lxfWueAI=,tag:oy99+HrMV1uGCdcAy7epug==,type:str] +intermediate-ca: ENC[AES256_GCM,data:NUMdfNy+Opi/UypY1N2N8pZZK99m3VouzLxA7EKwC2sd2Q24uEflRfucjWupAASp7duncfSjmC1jQxCQpSzwV7Qbq3+PkKD+MnrceVzz40G97C5jEKEJG6ln5RdwGX5FeIF9tZpb/gBvkWcyrPQ6wDEpzd9rCDGJgvPzg/PaFuluO6UXKpppyC9Zzl2x/dms+2pV2aQcR0rEPEuXKK7NKxc+Zk3HFgcfhe26mbayZXZxdxs44vwPqPKr6xmWRiERBlCoMEfjLSWAiVjau/RXsW+/5Mtu80rbiRUHUesdZYIX4hqfoj914Mp1gsQ+bihnfBQ3xYyxtskBfHO8+oZNvOcDhx7zl8Vo+giD4435EYEFWNxjzRtbXoR0CHu50obmDDjpPcUpkRNzjpJK3VEJM45SEA2EZyupmf+Y8o4uHmOg/xTciVHLFqVOnchb6pm9WPbkyMT9K/+O9XvN3yVJzab6se6DdnEB/8PeA4s51M0ONk6PrFXSGdfwos84BmD8uaAqGhp64sXpTuunhfcmo02b1pZ2OqlGnjam5ZJOuyJ6vPeVYB/o60Dl/w5QtdeWc93EgsxNRAOyxOsrtSKdQPuZgp7+/I4S6kYaRJS8S7mvqSNdtCdrov1vYSEoHDXtu2XaDaJrStHJsP1FmTAAmXhzeyfGosB9JX7sdOGRkskesREqkzJ5V7+O0k3cpHFJvIZIFyj12rwpPSnrB66BELAQVxkqeol2dfPWn+G1aG9dmtq3T7+C3M5wW7VE41mmVgUrx9o4/8Z3wkHkBxZXiUkN4LfFHcZXmvuHFqRYYBOUpTzxRCkW6dl/gvP0qedMR3/zplhe51Gux7IFW7/s0wvTWHqWrpxirpW+c4l/IGf53Ox7kt3D,iv:atbEM7iZALuT1UipYmxlH0k0FOPJ7VKrfPrmCs3X9Mo=,tag:w6l49PKgjlzTZa1mIVpI4A==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSamN6dkxYalBZc25EYThR + NnV0YW5oQWgrQWNhSE9Gemt3VGljaE0rTGcwCnYyV2JpdW1GbEZTRElDNFk2Y213 + bk1FY1grM2tuc0UzV21ROG5BanpjbFEKLS0tIG83dnpNQzEvYVZ1ODArRjlYSFRY + WHp0NktOQVF0UW1KajhYM3U5WkZCNmsKrN8T73fg7JoT+7WheveOC3Jlxa79EFjs + ePfVY07TKEHsycFhNyjcsFCWMF2ddE7q28A+Sjg+C3SA+/cHO8U9lw== + -----END AGE ENCRYPTED FILE----- + recipient: age13l2gtk0nzr484zprp7e0pkrt0ne0j4asyn2pjmlaw73nte7t7d8q4sqtxm + lastmodified: "2026-06-23T20:42:27Z" + mac: ENC[AES256_GCM,data:XftvodNnD0YXmd1GsNt2w820CWYY3v2pXOtlFYE0k25kuKNeKqqGDgN4geTA/xh6eYMrDut6mryNHOOoWXTuU9r/NvpXotwT5/vW2s4Nq+Cd9XySceJn/Ja6aN8R5ICbq3BhmpmC3SCVXDTce4+MwIHeBmp+Lrff+mXvZ5cT1A4=,iv:FqI/KdPJFHOMHykeZj0oEcuIZsCBWF1WCK4saz9Es7g=,tag:IZ1xHkB4eqkp04L2iAbkOw==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.1 diff --git a/modules/essentials/settings.nix b/modules/essentials/settings.nix index c1be027..fc24c65 100644 --- a/modules/essentials/settings.nix +++ b/modules/essentials/settings.nix @@ -64,6 +64,21 @@ }); ''; }; + pki.certificates = [ + '' + -----BEGIN CERTIFICATE----- + MIIBlDCCATmgAwIBAgIQUR+DM/LKIbokKxYPGZbCCjAKBggqhkjOPQQDAjAoMQ4w + DAYDVQQKEwVaZXJvUTEWMBQGA1UEAxMNWmVyb1EgUm9vdCBDQTAeFw0yNjA2MTMy + MjU2MDZaFw0zNjA2MTAyMjU2MDZaMCgxDjAMBgNVBAoTBVplcm9RMRYwFAYDVQQD + Ew1aZXJvUSBSb290IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgbhGtnlm + qd2Uv1B1VBSeg6NlXFMj4BG/k5gVu9bVFBK4cw9HVx21aHw9HhFW94P2KaySR6bu + K8tLDtzvs0xkyqNFMEMwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C + AQEwHQYDVR0OBBYEFH07/1blaqp0MVuSZIUHS9W3SjIrMAoGCCqGSM49BAMCA0kA + MEYCIQD1coTa7hqU1PAdnamAIgq1ApadDWpWfNaXPGiLCrkxTwIhAJhj/YSzqTJR + HvurdJ9m2glxV3rQHIUiVqKbQRcibObd + -----END CERTIFICATE----- + '' + ]; }; systemd.network.wait-online.enable = false; @@ -75,4 +90,23 @@ "ru_RU.UTF-8/UTF-8" ]; }; + + # sops.secrets = { + # intermediate-ca = { + # format = "yaml"; + # key = "intermediate-ca"; + # sopsFile = ./secrets/settings.yaml; + # # owner = "nobody"; + # # group = "nogroup"; + # mode = "0700"; + # }; + # root-ca = { + # format = "yaml"; + # key = "root-ca"; + # sopsFile = ./secrets/settings.yaml; + # # owner = "nobody"; + # # group = "nogroup"; + # mode = "0700"; + # }; + # }; } diff --git a/modules/server/nginx.nix b/modules/server/nginx.nix index 802908f..91c818c 100644 --- a/modules/server/nginx.nix +++ b/modules/server/nginx.nix @@ -73,6 +73,28 @@ in client_max_body_size 5G; ''; }; + "gitea.zeroq.su" = { + forceSSL = true; + enableACME = true; + locations."/" = { + proxyPass = "http://${server}:3000"; + proxyWebsockets = true; + }; + extraConfig = '' + client_max_body_size 5G; + ''; + }; + "ca.zeroq.su" = { + forceSSL = false; + enableACME = false; + locations."/" = { + proxyPass = "http://${server}:9000"; + proxyWebsockets = true; + }; + extraConfig = '' + client_max_body_size 5G; + ''; + }; "gitea.local" = { forceSSL = false; enableACME = false; @@ -191,4 +213,14 @@ in }; }; }; + security = { + acme = { + acceptTerms = true; + defaults = { + email = "oqyude@zeroq.su"; + server = "https://localhost:9000/acme/acme/directory"; + dnsProvider = null; + }; + }; + }; } diff --git a/modules/server/secrets/step-ca.yaml b/modules/server/secrets/step-ca.yaml index 4ecf494..2da2580 100644 --- a/modules/server/secrets/step-ca.yaml +++ b/modules/server/secrets/step-ca.yaml @@ -10,7 +10,7 @@ sops: IUYmiWPlPd1IDV1NeMtlSYtO8exzB22XL9DqW4x/tJ7DeSZaBsjcOw== -----END AGE ENCRYPTED FILE----- recipient: age13l2gtk0nzr484zprp7e0pkrt0ne0j4asyn2pjmlaw73nte7t7d8q4sqtxm - lastmodified: "2026-06-13T22:59:34Z" - mac: ENC[AES256_GCM,data:72E73xauS1Xrfw6tcyN/PHSJZ4ZZnIeKp8JVUPFGPBvIzaD6ZThYZwQ10FDD4JF+YOwn3QhCEh3t0ozcSNNnJFkyBgSqFtRMkym0ede12VAOPu2wQFoNvMdkT7+n14lJ/9OOz6KDyMf0BQDJKlSfDBkt+mLi61zte5iUxPsWsp4=,iv:xuOwFBEnlRgbaVdMq4O6w9T2edpS6uEPh9yhNbYBJIk=,tag:Y+dtcU17Q83o/9Nt1LGCcg==,type:str] + lastmodified: "2026-06-23T20:42:29Z" + mac: ENC[AES256_GCM,data:pyayAQOBIBKwfpTCykHtVELGKmhrpS9Mu18wwl3aYyvEwdqqhfSbzt2fXURgWAbrsax6KzrTfi2bgixy8NxRibI+o5/magGAXdk0N5RUP68/FPe1cSL6ZRry+00WjJp8x75wbSp64GU0xY7uUuq+oUKfckGCsY/m4AODbZWU1Ic=,iv:jEpnTyllRd46vPiGG2VlZkFOgwcKQNSov1W813uLQEM=,tag:B7BNlVvhgm9HI/zUQneVQw==,type:str] unencrypted_suffix: _unencrypted version: 3.13.1 diff --git a/modules/server/step-ca.nix b/modules/server/step-ca.nix index f14dea3..de41a45 100644 --- a/modules/server/step-ca.nix +++ b/modules/server/step-ca.nix @@ -22,7 +22,8 @@ in key = "${varDir}/secrets/intermediate_ca_key"; # address = "0.0.0.0:9000"; dnsNames = [ - "ca.zeroq.su" + "*.zeroq.su" + "localhost" ]; db = { type = "badgerv2"; @@ -30,6 +31,10 @@ in }; authority = { provisioners = [ + { + type = "ACME"; + name = "acme"; + } { type = "JWK"; name = "oqyude@zeroq.su";