|
| 1 | +{ |
| 2 | + config, |
| 3 | + pkgs, |
| 4 | + ... |
| 5 | +}: |
| 6 | +{ |
| 7 | + # mTLS binary cache for testing nix client certificate authentication |
| 8 | + # See: https://github.com/NixOS/nix/pull/13030 |
| 9 | + # |
| 10 | + # Usage with nix (once PR is merged): |
| 11 | + # nix-store --store https://cache2.thalheim.io?tls-certificate=/path/to/client.crt&tls-private-key=/path/to/client.key -r /nix/store/... |
| 12 | + |
| 13 | + # Generate CA and client certificates using clan vars |
| 14 | + clan.core.vars.generators.mtls-cache = { |
| 15 | + files = { |
| 16 | + # CA certificate and key - nginx needs to read the CA cert |
| 17 | + ca-cert.owner = "nginx"; |
| 18 | + ca-key.secret = true; |
| 19 | + # Client certificate and key (for testing) |
| 20 | + client-cert = { }; |
| 21 | + client-key.secret = true; |
| 22 | + }; |
| 23 | + |
| 24 | + runtimeInputs = [ pkgs.openssl ]; |
| 25 | + |
| 26 | + script = '' |
| 27 | + # Generate CA key and certificate |
| 28 | + openssl ecparam -genkey -name prime256v1 -out "$out/ca-key" |
| 29 | + openssl req -new -x509 -days 3650 -key "$out/ca-key" -out "$out/ca-cert" \ |
| 30 | + -subj "/CN=cache2.thalheim.io CA" |
| 31 | +
|
| 32 | + # Generate client key and certificate |
| 33 | + openssl ecparam -genkey -name prime256v1 -out "$out/client-key" |
| 34 | + openssl req -new -key "$out/client-key" -out /tmp/client.csr \ |
| 35 | + -subj "/CN=nix-client" |
| 36 | + openssl x509 -req -in /tmp/client.csr \ |
| 37 | + -CA "$out/ca-cert" -CAkey "$out/ca-key" -CAcreateserial \ |
| 38 | + -out "$out/client-cert" -days 3650 |
| 39 | + rm -f /tmp/client.csr |
| 40 | + ''; |
| 41 | + }; |
| 42 | + |
| 43 | + # Nginx virtual host with mTLS |
| 44 | + services.nginx.virtualHosts."cache2.thalheim.io" = { |
| 45 | + useACMEHost = "thalheim.io"; |
| 46 | + forceSSL = true; |
| 47 | + |
| 48 | + # mTLS configuration |
| 49 | + extraConfig = '' |
| 50 | + ssl_client_certificate ${config.clan.core.vars.generators.mtls-cache.files.ca-cert.path}; |
| 51 | + ssl_verify_client on; |
| 52 | + ''; |
| 53 | + |
| 54 | + # Proxy to harmonia (same backend as cache.thalheim.io) |
| 55 | + locations."/".extraConfig = '' |
| 56 | + proxy_pass http://127.0.0.1:5000; |
| 57 | + proxy_set_header Host $host; |
| 58 | + proxy_redirect http:// https://; |
| 59 | + proxy_http_version 1.1; |
| 60 | + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; |
| 61 | + proxy_set_header Upgrade $http_upgrade; |
| 62 | + proxy_set_header Connection $connection_upgrade; |
| 63 | +
|
| 64 | + # Pass client certificate info to backend (optional, for logging/debugging) |
| 65 | + proxy_set_header X-SSL-Client-Verify $ssl_client_verify; |
| 66 | + proxy_set_header X-SSL-Client-DN $ssl_client_s_dn; |
| 67 | + ''; |
| 68 | + }; |
| 69 | +} |
0 commit comments