liminix

commit fb2ec4e2c13f3f2fbbc56e4d11ea6f28a93925ef
parent 42a315383f5c9499028c5327ba5908462611c432
Author: Daniel Barlow <dan@telent.net>
Date:   Wed,  5 Aug 2026 00:08:57 +0100

enable tls client certificates for outboard secrets service

Diffstat:
M
modules/secrets/default.nix
 | 
12
++++++++++++
M
modules/secrets/outboard.nix
 | 
10
++++++++++

2 files changed, 22 insertions(+), 0 deletions(-)
diff --git a/modules/secrets/default.nix b/modules/secrets/default.nix
@@ -43,6 +43,18 @@ in
         description = "password for HTTP basic auth";
         type = types.nullOr types.str;
       };
+      tlsCertificate = mkOption {
+        description = "client certificate to present for mTLS";
+        type = types.nullOr types.path;
+      };
+      tlsCaCertificate = mkOption {
+        description = "CA certificate";
+        type = types.nullOr types.path;
+      };
+      tlsPrivateKey = mkOption {
+        description = "client private key to use for mTLS";
+        type = types.nullOr types.path;
+      };
       name = mkOption {
         description = "service name";
         type = types.str;
diff --git a/modules/secrets/outboard.nix b/modules/secrets/outboard.nix
@@ -10,6 +10,9 @@
   interval,
   username,
   password,
+  tlsCaCertificate,
+  tlsCertificate,
+  tlsPrivateKey,
 }:
 let
   inherit (liminix.services) longrun;
@@ -23,6 +26,13 @@ longrun {
       export NETRC=$(mkstate ${name})/netrc
       (echo default ; echo login ${username} ; echo password ${password} ) > $NETRC
     ''}
+    ${optionalString (tlsCertificate != null) ''
+      export SSL_CLIENT_CERT_FILE=${tlsCertificate}
+      export SSL_CLIENT_KEY_FILE=${tlsPrivateKey}
+    ''}
+    ${optionalString (tlsCaCertificate != null) ''
+      export SSL_CA_CERT_FILE=${tlsCaCertificate}
+    ''}
     ( in_outputs ${name}
       while : ; do
         ${json-to-fstree}/bin/json-to-fstree ${url} .