22 lines
619 B
Nix
22 lines
619 B
Nix
{
|
|
khscodes.services.openssh.hostCertificate.path = "\${ vault_mount.ssh-host.path }";
|
|
khscodes.infrastructure.provisioning.post.modules = [
|
|
(
|
|
{ config, ... }:
|
|
{
|
|
khscodes.vault.mount.ssh-host = {
|
|
type = "ssh";
|
|
path = "ssh-host";
|
|
default_lease_ttl_seconds = 24 * 60 * 60;
|
|
max_lease_ttl_seconds = 24 * 60 * 60;
|
|
};
|
|
|
|
resource.vault_ssh_secret_backend_ca.ssh-host = {
|
|
backend = config.khscodes.vault.output.mount.ssh-host.path;
|
|
generate_signing_key = true;
|
|
key_type = "ed25519";
|
|
};
|
|
}
|
|
)
|
|
];
|
|
}
|