pyrox.dev
1{ config, lib, pkgs, ... }:
2
3with lib;
4
5let
6
7 cfg = config.security.pki;
8
9 cacertPackage = pkgs.cacert.override {
10 blacklist = cfg.caCertificateBlacklist;
11 extraCertificateFiles = cfg.certificateFiles;
12 extraCertificateStrings = cfg.certificates;
13 };
14 caBundleName = if cfg.useCompatibleBundle then "ca-no-trust-rules-bundle.crt" else "ca-bundle.crt";
15 caBundle = "${cacertPackage}/etc/ssl/certs/${caBundleName}";
16
17in
18
19{
20
21 options = {
22 security.pki.installCACerts = mkEnableOption "installing CA certificates to the system" // {
23 default = true;
24 internal = true;
25 };
26
27 security.pki.useCompatibleBundle = mkEnableOption ''usage of a compatibility bundle.
28
29 Such a bundle consist exclusively of `BEGIN CERTIFICATE` and no `BEGIN TRUSTED CERTIFICATE`,
30 which is a OpenSSL specific PEM format.
31
32 It is known to be incompatible with certain software stacks.
33
34 Nevertheless, enabling this will strip all additional trust rules provided by the
35 certificates themselves, this can have security consequences depending on your usecases.
36 '';
37
38 security.pki.certificateFiles = mkOption {
39 type = types.listOf types.path;
40 default = [];
41 example = literalExpression ''[ "''${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt" ]'';
42 description = ''
43 A list of files containing trusted root certificates in PEM
44 format. These are concatenated to form
45 {file}`/etc/ssl/certs/ca-certificates.crt`, which is
46 used by many programs that use OpenSSL, such as
47 {command}`curl` and {command}`git`.
48 '';
49 };
50
51 security.pki.certificates = mkOption {
52 type = types.listOf types.str;
53 default = [];
54 example = literalExpression ''
55 [ '''
56 NixOS.org
57 =========
58 -----BEGIN CERTIFICATE-----
59 MIIGUDCCBTigAwIBAgIDD8KWMA0GCSqGSIb3DQEBBQUAMIGMMQswCQYDVQQGEwJJ
60 TDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0
61 ...
62 -----END CERTIFICATE-----
63 '''
64 ]
65 '';
66 description = ''
67 A list of trusted root certificates in PEM format.
68 '';
69 };
70
71 security.pki.caCertificateBlacklist = mkOption {
72 type = types.listOf types.str;
73 default = [];
74 example = [
75 "WoSign" "WoSign China"
76 "CA WoSign ECC Root"
77 "Certification Authority of WoSign G2"
78 ];
79 description = ''
80 A list of blacklisted CA certificate names that won't be imported from
81 the Mozilla Trust Store into
82 {file}`/etc/ssl/certs/ca-certificates.crt`. Use the
83 names from that file.
84 '';
85 };
86
87 };
88
89 config = mkIf cfg.installCACerts {
90
91 # NixOS canonical location + Debian/Ubuntu/Arch/Gentoo compatibility.
92 environment.etc."ssl/certs/ca-certificates.crt".source = caBundle;
93
94 # Old NixOS compatibility.
95 environment.etc."ssl/certs/ca-bundle.crt".source = caBundle;
96
97 # CentOS/Fedora compatibility.
98 environment.etc."pki/tls/certs/ca-bundle.crt".source = caBundle;
99
100 # P11-Kit trust source.
101 environment.etc."ssl/trust-source".source = "${cacertPackage.p11kit}/etc/ssl/trust-source";
102
103 };
104
105}