default.nix (1552B)
1 { 2 lib, 3 pkgs, 4 config, 5 ... 6 }: 7 let 8 inherit (lib) mkOption types; 9 inherit (pkgs) liminix; 10 in 11 { 12 options = { 13 system.service.tls-certificate = { 14 certifix-client = mkOption { 15 type = liminix.lib.types.serviceDefn; 16 }; 17 }; 18 }; 19 config.system.service.tls-certificate.certifix-client = 20 config.system.callService ./certifix-client.nix 21 { 22 # this is probably read from files on the build machine, 23 # but are not named with ...File suffix because they are 24 # not files on the device (they get embedded into the store) 25 caCertificate = mkOption { 26 description = "CA certificate in PEM format. This must be the same CA as that which signed the certificate of the Certifix server"; 27 type = types.str; 28 }; 29 secret = mkOption { 30 description = "The shared secret to embed in signing request. This must match the secret configured in the Certifix service, otherwise it will refuse to sign the CSR."; 31 type = types.str; 32 }; 33 subject = mkOption { 34 description = "Subject of the certificate request, as an X509 DN. The CN ('Common Name') you provide here is also used as the value of the SubjectAlternativeName extension."; 35 type = types.str; 36 example = "C=GB,ST=London,O=Liminix,OU=IT,CN=myhostname"; 37 }; 38 serviceUrl = mkOption { 39 description = "Certifix server endpoint URL"; 40 type = types.str; 41 example = "https://certifix.lan:19613/sign"; 42 }; 43 }; 44 45 }