nixos-config

commit 8a5094a11b98b263cdb41e80b70d48b5a2b00cb9
parent 1e0ed5586e3eae3b793b1ab00659aa3ee720c60a
Author: vin <vin@vineetk.net>
Date:   Sun, 23 Feb 2025 19:56:12 -0500

setup step-ca as my own TLS CA instead of using self-signed certs

It was getting very hard to try getting iOS to use my self-signed cert
in Safari even with it trusted as a root-level one because of some
hidden conditions I wasn't meeting apparently.

Diffstat:
M
hosts/demiurge/default.nix
 | 
82
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++---------
M
hosts/lappy/default.nix
 | 
20
++++++++++++++++++--

2 files changed, 91 insertions(+), 11 deletions(-)
diff --git a/hosts/demiurge/default.nix b/hosts/demiurge/default.nix
@@ -162,7 +162,11 @@
   # };
 
   security = {
-    sudo.enable = false;
+    acme = {
+      acceptTerms = true;
+      defaults.email = "me@vineetk.net";
+      defaults.server = "https://127.0.0.1:4433/acme/acme/directory";
+    };
 
     # I prefer doas over sudo for simplicity
     doas = {
@@ -173,6 +177,24 @@
         persist = true;
       }];
     };
+
+    pki.certificates = [
+      ''
+-----BEGIN CERTIFICATE-----
+MIIBoDCCAUagAwIBAgIRANI8aOT3LE+pzmsQWjcDOIgwCgYIKoZIzj0EAwIwLjER
+MA8GA1UEChMIZGVtaXVyZ2UxGTAXBgNVBAMTEGRlbWl1cmdlIFJvb3QgQ0EwHhcN
+MjUwMjE4MDUzNTA5WhcNMzUwMjE2MDUzNTA5WjAuMREwDwYDVQQKEwhkZW1pdXJn
+ZTEZMBcGA1UEAxMQZGVtaXVyZ2UgUm9vdCBDQTBZMBMGByqGSM49AgEGCCqGSM49
+AwEHA0IABMv8weeXJSDLygVlBxxAHLCvQCdf2COCk0QffNeDaVlIU/NFo3IyPSqG
+E3YtWEWamU/icgsJS999z3BZ5O+cTP6jRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNV
+HRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBRM51S3OgTxXwNhdSSHw6llz0APFzAK
+BggqhkjOPQQDAgNIADBFAiA9alHJ1XHLlKNRUGRL4tdFC3RZYHtoN8BmBHEfDa1S
+LQIhANgsvYmyCp/Nur2RKaV25CDg3kMYVBXED2HVDy8qa+3i
+-----END CERTIFICATE-----
+''
+    ];
+
+    sudo.enable = false;
   };
 
   services = {
@@ -227,34 +249,30 @@
 
       virtualHosts = {
         "searx.demiurge.vpn" = {
+          enableACME = true;
           forceSSL = true;
           locations."/".proxyPass = "http://127.0.0.1:8081";
-          sslCertificate = "/var/demiurge.vpn.crt";
-          sslCertificateKey = "/var/demiurge.vpn.key";
         };
 
         "redlib.demiurge.vpn" = {
+          enableACME = true;
           forceSSL = true;
           locations."/".proxyPass = "http://127.0.0.1:8082";
-          sslCertificate = "/var/demiurge.vpn.crt";
-          sslCertificateKey = "/var/demiurge.vpn.key";
         };
 
         "navidrome.demiurge.vpn" = {
+          enableACME = true;
           forceSSL = false;
           locations."/".proxyPass = "http://127.0.0.1:4533";
-          sslCertificate = "/var/demiurge.vpn.crt";
-          sslCertificateKey = "/var/demiurge.vpn.key";
         };
 
         "sdui.demiurge.vpn" = {
+          enableACME = true;
           forceSSL = true;
           locations."/" = {
             proxyPass = "http://127.0.0.1:7860";
             proxyWebsockets = true;
           };
-          sslCertificate = "/var/demiurge.vpn.crt";
-          sslCertificateKey = "/var/demiurge.vpn.key";
         };
       };
     };
@@ -720,6 +738,52 @@
       };
     };
 
+    # certificate authority
+    step-ca = {
+      enable = true;
+      address = "127.0.0.1";
+      port = 4433;
+      intermediatePasswordFile = "/run/keys/smallstep-password";
+
+      settings = {
+        root = "/var/lib/step-ca/certs/root_ca.crt";
+        federatedRoots = null;
+        crt = "/var/lib/step-ca/certs/intermediate_ca.crt";
+        key = "/var/lib/step-ca/secrets/intermediate_ca_key";
+        address = "127.0.0.1:4433";
+        insecureAddress = "";
+        dnsNames = [ "127.0.0.1" ];
+        logger.format = "text";
+
+        db = {
+          type = "badgerv2";
+          dataSource = "/var/lib/step-ca/db";
+          badgerFileLoadingmode = "";
+        };
+
+        authority.provisioners = [{
+          type = "ACME";
+          name = "acme";
+          claims = {
+            enableSSHCA = true;
+            disableRenewal = false;
+            allowRenewalAfterExpiry = false;
+            disableSmallstepExtensions = false;
+          };
+        }];
+
+        tls = {
+          cipherSuites = [
+            "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
+            "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
+          ];
+          minVersion = 1.2;
+          maxVersion = 1.3;
+          renegotiation = false;
+        };
+      };
+    };
+
     # torrents
     transmission = {
       enable = true;
diff --git a/hosts/lappy/default.nix b/hosts/lappy/default.nix
@@ -171,8 +171,6 @@
   # };
 
   security = {
-    sudo.enable = false;
-
     # I prefer doas over sudo for simplicity
     doas = {
       enable = true;
@@ -182,6 +180,24 @@
         persist = true;
       }];
     };
+
+    pki.certificates = [
+      ''
+-----BEGIN CERTIFICATE-----
+MIIBoDCCAUagAwIBAgIRANI8aOT3LE+pzmsQWjcDOIgwCgYIKoZIzj0EAwIwLjER
+MA8GA1UEChMIZGVtaXVyZ2UxGTAXBgNVBAMTEGRlbWl1cmdlIFJvb3QgQ0EwHhcN
+MjUwMjE4MDUzNTA5WhcNMzUwMjE2MDUzNTA5WjAuMREwDwYDVQQKEwhkZW1pdXJn
+ZTEZMBcGA1UEAxMQZGVtaXVyZ2UgUm9vdCBDQTBZMBMGByqGSM49AgEGCCqGSM49
+AwEHA0IABMv8weeXJSDLygVlBxxAHLCvQCdf2COCk0QffNeDaVlIU/NFo3IyPSqG
+E3YtWEWamU/icgsJS999z3BZ5O+cTP6jRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNV
+HRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBRM51S3OgTxXwNhdSSHw6llz0APFzAK
+BggqhkjOPQQDAgNIADBFAiA9alHJ1XHLlKNRUGRL4tdFC3RZYHtoN8BmBHEfDa1S
+LQIhANgsvYmyCp/Nur2RKaV25CDg3kMYVBXED2HVDy8qa+3i
+-----END CERTIFICATE-----
+''
+    ];
+
+    sudo.enable = false;
   };
 
   services = {