ssh-ca-vault: init
This commit is contained in:
parent
86a6191a56
commit
ac0c6eccef
5 changed files with 48 additions and 1 deletions
|
@ -20,6 +20,7 @@ in
|
||||||
./vault-agent.nix
|
./vault-agent.nix
|
||||||
./vault-agent-acme.nix
|
./vault-agent-acme.nix
|
||||||
./vault-agent-secrets.nix
|
./vault-agent-secrets.nix
|
||||||
|
./ssh-ca-vault.nix
|
||||||
];
|
];
|
||||||
|
|
||||||
options.my.specialisationName = lib.mkOption {
|
options.my.specialisationName = lib.mkOption {
|
||||||
|
|
41
ops/nixos/lib/ssh-ca-vault.nix
Normal file
41
ops/nixos/lib/ssh-ca-vault.nix
Normal file
|
@ -0,0 +1,41 @@
|
||||||
|
# SPDX-FileCopyrightText: 2020 Luke Granger-Brown <depot@lukegb.com>
|
||||||
|
#
|
||||||
|
# SPDX-License-Identifier: Apache-2.0
|
||||||
|
|
||||||
|
{ config, lib, ... }:
|
||||||
|
let
|
||||||
|
inherit (lib) listToAttrs nameValuePair mkAfter concatMapStrings;
|
||||||
|
|
||||||
|
keyTypes = [ "ed25519" "rsa" ];
|
||||||
|
hostKeyForKeyType = keyType: "/etc/ssh/ssh_host_${keyType}_key.pub";
|
||||||
|
secretNameForKeyType = keyType: "openssh-cert-${keyType}";
|
||||||
|
|
||||||
|
signedPaths = map (keyType: config.my.vault.secrets.${secretNameForKeyType keyType}.path) keyTypes;
|
||||||
|
in {
|
||||||
|
config = {
|
||||||
|
my.vault.secrets = let
|
||||||
|
hostname = config.networking.hostName;
|
||||||
|
fromKey = keyType: {
|
||||||
|
template = ''
|
||||||
|
{{ with file "${hostKeyForKeyType keyType}" | printf "public_key=%s" | secret "ssh-host/sign/${hostname}" "cert_type=host" "valid_principals=${hostname}.as205479.net,${hostname}.int.as205479.net" }}
|
||||||
|
{{ .Data.signed_key }}
|
||||||
|
{{ end }}
|
||||||
|
'';
|
||||||
|
group = "root";
|
||||||
|
reloadOrRestartUnits = [ "sshd.service" ];
|
||||||
|
};
|
||||||
|
in listToAttrs (map (keyType: nameValuePair (secretNameForKeyType keyType) (fromKey keyType)) keyTypes);
|
||||||
|
|
||||||
|
systemd.services.vault-agent.serviceConfig.ReadOnlyPaths = mkAfter (map hostKeyForKeyType keyTypes);
|
||||||
|
|
||||||
|
services.openssh.extraConfig = concatMapStrings (c: "HostCertificate ${c}\n") signedPaths + ''
|
||||||
|
TrustedUserCAKeys ${../../secrets/client-ca.pub}
|
||||||
|
AuthorizedPrincipalsFile %h/.ssh/authorized_principals
|
||||||
|
AuthorizedPrincipalsFile /etc/ssh/authorized_principals.d/%u
|
||||||
|
'';
|
||||||
|
|
||||||
|
environment.etc."ssh/authorized_principals.d/root".text = ''
|
||||||
|
lukegb
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
}
|
|
@ -39,7 +39,10 @@ in
|
||||||
my.vault.enable = mkDefault true;
|
my.vault.enable = mkDefault true;
|
||||||
my.vault.settings = {
|
my.vault.settings = {
|
||||||
pid_file = mkDefault "/run/vault-agent/pid";
|
pid_file = mkDefault "/run/vault-agent/pid";
|
||||||
vault.address = mkDefault "https://vault.int.lukegb.com";
|
vault = {
|
||||||
|
address = mkDefault "https://vault.int.lukegb.com";
|
||||||
|
retry.num_retries = mkDefault 1;
|
||||||
|
};
|
||||||
auto_auth.method = mkDefault [{
|
auto_auth.method = mkDefault [{
|
||||||
type = "approle";
|
type = "approle";
|
||||||
config = {
|
config = {
|
||||||
|
|
1
ops/secrets/client-ca.pub
Normal file
1
ops/secrets/client-ca.pub
Normal file
|
@ -0,0 +1 @@
|
||||||
|
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEqNOwlR7Qa8cbGpDfSCOweDPbAGQOZIcoRgh6s/J8DR vault-clients
|
1
ops/secrets/server-ca.pub
Normal file
1
ops/secrets/server-ca.pub
Normal file
|
@ -0,0 +1 @@
|
||||||
|
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINpQayDIvvBUCc1roNzDwT04tG7JuXQg1QlvvNyb/CHT vault-server
|
Loading…
Reference in a new issue