set up PKI infra

6 files changed, 67 insertions, 11 deletions

diff --git a/.sops.yaml b/.sops.yaml
index 49cb169..6784734 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -1,20 +1,18 @@
 keys:
-  - &admin_miran age1l088h7umwuxp0sw8wk0stfup0empdnldczxvrhueu7n0vxd0c57q9zvwsk
-  - &machine_wonderland age1xzqshnlstewfha28sqjp4lf97mm43axyrhga0vkjmt5zx6eydqhsvlsasc
   - &machine_sagittarius age1jmpdssn7555g0pht7zwqq2dvrvzxyu65w6cf2su8pp2fz0zvaykq0jgern
   - &machine_underworld age1sffhunmeqmeey29lnvuds59mn74jfpctd3wm0t6svca0fztgvd4qnretc6
 creation_rules:
   - path_regex: secrets/[^/]+\.(yaml|json|env|ini|txt)$
     key_groups:
       - age:
-          - *admin_miran
-          - *machine_wonderland
           - *machine_sagittarius
           - *machine_underworld
   - path_regex: secrets/wireguard/[^/]+\.(txt)$
     key_groups:
       - age:
-          - *admin_miran
-          - *machine_wonderland
           - *machine_sagittarius
           - *machine_underworld
+  - path_regex: secrets/ca/[^/]+\.key$
+    key_groups:
+      - age:
+          - *machine_sagittarius
diff --git a/etc/certs/sagittarius.internal.crt b/etc/certs/sagittarius.internal.crt
new file mode 100644
index 0000000..78e927e
--- /dev/null
+++ b/etc/certs/sagittarius.internal.crt
@@ -0,0 +1,32 @@
+-----BEGIN CERTIFICATE-----
+MIIFjjCCA3agAwIBAgIUcj1eezajY29WH/Mglb+nmKLLrl0wDQYJKoZIhvcNAQEL
+BQAwPzEdMBsGA1UEAwwUc2FnaXR0YXJpdXMuaW50ZXJuYWwxHjAcBgNVBAoMFVNv
+cnJlIFdpcmVHdWFyZCBJbmZyYTAeFw0yNjA1MzExODA2MDFaFw0zNjA1MjgxODA2
+MDFaMD8xHTAbBgNVBAMMFHNhZ2l0dGFyaXVzLmludGVybmFsMR4wHAYDVQQKDBVT
+b3JyZSBXaXJlR3VhcmQgSW5mcmEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK
+AoICAQDNna4jIW+k0QmXkynime32J26BBxzn8Jy8EjT3l9Ejbi+pKNXOX8GvQA0d
+CEcAaWPvgWh8LB54A8re19uIhZxN+bgx5UNSFitPTS1TB/I7vHD/t7Xet3/cTrLX
+9Y8wswFelCy9YdhOJ6LWZdTB0oo8Tn2dd3xkBA3W50t/p+HpsuGEbydIOE4LfRZ4
+HtGElTsugh1HVvw0KjRuhaK4uvGvrZtUn1ylB/zCJiYA01JSwjEAi9v38urU90T2
+KfEkZg2kBmdVFg9jSNg030Wsu9jXtgwD80VD5cMTK7P6Kv0Eej2F5ZM12Mk+x3R7
+HrIpXMJvEDoaxOZZl9XtMyr4YvupYC8JSxpUdDGzHG2C3EnnGoG7LxTC5kCkdZZl
+2FvEsB/DwhrEdxo8k5Kpz6zz+aBW5KFEIOweYiSyXa79xjuA58cOlmkOp0SMnw2M
+MdmPzpENUGl95SbhFGHNW7q5ILrqJdOCkjybzq22i06ts4IL9iynCXXYuOIDuirM
+UncYhdxap9cvkscXTUGnftqjrHUvGvljUD3hthtReRs4050xy7Oga/ex9Vvbw/iT
+WJUUH/VhQr1vMKqC4GKGBpLr33XCw5M+3QQMstm0bzwVaMHyd5hFyngFUb4mkTvH
+oHMjasbkx+9OyPd2wdVYo1GQtavGAPwRpeM6UjTF9FO1uXm+4wIDAQABo4GBMH8w
+MQYDVR0RBCowKIcQIwENuKytAAoAAAAAAAAAAYIUc2FnaXR0YXJpdXMuaW50ZXJu
+YWwwCQYDVR0TBAIwADALBgNVHQ8EBAMCBaAwEwYDVR0lBAwwCgYIKwYBBQUHAwEw
+HQYDVR0OBBYEFAeDtPB0OMwGPfl963TTZpo5D2IGMA0GCSqGSIb3DQEBCwUAA4IC
+AQCjA/XU7hUCoy5CqlZuGjFTvZRfLK9XZV/63KvGVtJEgGjo+MAXIV14xNA89EDg
+J/seqapx82LfqBXe72KtI1cc+2PkEZS+yzqJuhp4Cj2hOpvvmZM8Mm8ZpkCbXTsq
+1fQAkkqeJnE7OBzABduR8NuWo6RvROnVm3Jk/ZeBeLil3rMDA136MIc1v/XE3z3j
+f3MTt7f3TN/qV811cnc+Yary+qhtjKdiDqF0cq7JDbgK8PtZ1Gkc/cy9+idAM1gx
+RsnSjY1zBi47gIBfmyAC22fnbBT7M+2KzWcEuWaBsZIjazxEFI8GTtHLI+LhSyqP
+k7qbCw0IsujFXqm4EvRPLih2oIErq7I6K7YLFcvpdlf32Pi7cJi58n8MKs23m5dA
+dhMWvNmFKv+iWSy41Aovk/YrPsU3ZyYCVTSbDiFCEtZKdtHdzvtIppMKRJhI35Yv
+iE/3/E9HPEnb/W6V/rATD6hyIgl3NK17kjTlqb2aFFQaaibIypRCMJXPZ5Bi8j1W
+BubFU3ccmsmo8cFZ+dUdIVCnVzHieSFgduKzGGh6sWzkyK3QxFxa6ExzOaD5kCMd
+hn4BB8CltM6P3R1zc+aGlvz6shpKDgcz+Evv+Tj1BygOepSO1JYJhlQGM1MBkkp4
+/slKfexLIPOxySZI5jTaIlXP7beHdSAT0WFkn6M2/Gc4Tw==
+-----END CERTIFICATE-----
diff --git a/hosts/nyaan/network.nix b/hosts/nyaan/network.nix
index e855f6d..617b769 100644
--- a/hosts/nyaan/network.nix
+++ b/hosts/nyaan/network.nix
@@ -15,6 +15,10 @@ in
     };
   };
 
+  security.pki.certificateFiles = [
+    ../../etc/certs/sagittarius.internal.crt
+  ];
+
   networking = {
     hostName = "nyaan";
     useNetworkd = true;
@@ -72,7 +76,6 @@ in
         "KopsiNet-5".pskRaw = "ext:kopsinet_psk";
         "Pixel_3139" = {
           pskRaw = "ext:phone_hotspot_psk";
-          hidden = true;
         };
         "eduroam" = {
           authProtocols = [ "WPA-EAP" ];
diff --git a/hosts/sagittarius/sops.nix b/hosts/sagittarius/sops.nix
index 7ba7536..2d08b24 100644
--- a/hosts/sagittarius/sops.nix
+++ b/hosts/sagittarius/sops.nix
@@ -18,6 +18,11 @@
         owner = "nginx";
         format = "binary";
       };
+      "wg-ca-key" = {
+        sopsFile = ../../secrets/ca/sagittarius.key;
+        owner = "nginx";
+        format = "binary";
+      };
     };
   };
 }
diff --git a/hosts/sagittarius/web/vaultwarden.nix b/hosts/sagittarius/web/vaultwarden.nix
index d17e006..90e22f3 100644
--- a/hosts/sagittarius/web/vaultwarden.nix
+++ b/hosts/sagittarius/web/vaultwarden.nix
@@ -2,15 +2,15 @@
 let
   hostname = config.networking.hostName;
   cfg = config.services.vaultwarden.config;
+  secrets = config.sops.secrets;
 in
 {
   services.vaultwarden = {
     enable = true;
     configureNginx = false;
     dbBackend = "sqlite";
-    # domain = "${hostname}.internal";
+    domain = "${hostname}.internal";
     config = {
-      DOMAIN = "http://${hostname}.internal";
       SIGNUPS_ALLOWED = true;
 
       ROCKET_ADDRESS = "127.0.0.1";
@@ -21,14 +21,18 @@ in
 
   services.nginx.virtualHosts."vaultwarden" = {
     serverName = "${hostname}.internal";
+    forceSSL = true;
     listen = [
       {
         addr = "[2301:db8:acad:a::1]"; # TODO: extract from topology instead of hardcoding
-        port = 80;
-        ssl = false;
+        port = 443;
+        ssl = true;
       }
     ];
 
+    sslCertificateKey = secrets."wg-ca-key".path;
+    sslCertificate = ../../../etc/certs/sagittarius.internal.crt;
+
     locations."/" = {
       proxyPass = "http://127.0.0.1:${toString cfg.ROCKET_PORT}";
       recommendedProxySettings = true;
diff --git a/secrets/ca/sagittarius.key b/secrets/ca/sagittarius.key
new file mode 100644
index 0000000..77e1908
--- /dev/null
+++ b/secrets/ca/sagittarius.key
@@ -0,0 +1,14 @@
+{
+	"data": "ENC[AES256_GCM,data:kKX+ziNwusQUtUvD/KKw3pSdx3pY/qASxqjRm5LBJTkswhgOsn5lJ50iU/YtqnAGBNktoe8zchTuk4d2Om81P87TsMd/cSLXeWKz+qXcUOeJ5Dguk1Jzj+2D84+mp4k78xrQS0qYPlC9sCsNzV9YTm0KALGdHjkQH1E6Y0sNkVy7jgsztwMrotObYNXVSnmzmS4H6CNfZju9E8pVNRDzPfudDRVjlPsfqYWDtLB/Qpq/w3J9zoFWxBoBHND2P81/iRaIESh8rGirrcgJITo6/AsDIegTkcGR3Jxip0RogM+Bf3dLbJTcj1HgrE1U44L7LS1p+Ci9WS8oE1oMOn9aXZyvy1TAy5IwonGDAjwKsQVzxIBOWMYlFccXt7ifhiFKu22U34p6iu2Tf7lYBZl1iYSp2swunQeRkP4Cy5Pk20X7ouSnqIhs0vBs9pusK68J2mj20fj2oL/0Qzq5bWCXpo9wmgZ4e+rPMtTeYkb4bVWH9YkyaDmOSEmyW65tJA3UrG625oLWbuu9v/1kTjgeBv0gGdEAMbK9Jtp/wCyDbazHkK4xJq4GCGbhE0276YDbNoFJTxwOOYQEunKErm9Bhx5ciCchAGxmmtfUYAWlnLg6fHRe7rprYKHO82DBm4u0Rl8VVacwezfKMQqY8g5cb6V6AKg5EFhTwC/bs7oPytWKOYudr9rpT2b3mT/KGZXOoi4M2JRsRJGRiTOgAuZiD+E8ZWObdYkb5q6Sl07gkxuCBBhgjxcBJ4V5FbEHbUT+mXqeNbRLdJalMWksn8uY21du0M/LuLLrh9xnkPnWd5NIaaRmdfd81aPqxlspe1xTevUJgyZ1rV9yqySNjUc8ZRu3VWG62qbuYd1c4OigHlW6rZk/VsFS3qV10/APUvyy6DgPnG8EPOEYnikh2J7ygv1p9g1gA0AUIDoB2zCM+bhEHdbUVkFKvcwi/D4nZ5u9n0tCqLvCMg6FSZ2llvvFkpZWeLWyCibNZHxeWHgHZSTfnsgoI5o378HxQsbo9vMw3A93XboPChfqLFW7M/HCeqmVMXJR/9SvXDlKSpXQsGr/+KBy8dXRc0HPOa4YUkT/3R6oNoffC5bwj2Fi1J23MQuKXl1HaS27U/fR4FX22hmCJiagH3NHX8XLA5hxivEZnz+BGBPyyjRYLRQH/NhzfXMsAHg+1CgvbzUyIjPsnNrQ2tOTjAhCGJa0XAgQj7R9KZtGHYeLkKrouIhx/jmziQOBqbjzbQHjNtyjWEQToMG/3gXwIQE5wS3zERKyyBAYHHA687ygYAhql765ur5LU1WqTNzOexS+sPCXqHSI7pCylz/IhSPszkcIAWjnmZLj6SIHIoWcJSvtIbbz5yf/SgWtGiiiig071H10Zd0dydMTuXM/6sbqMOAzripBZhnbal/NpLhBYiLy1crd+2ynR+1ZyLWTSynFx/CTo7/M2sJy9dQQ4KCVvUo7qRdhF/VItyHIyv+OLRAGmlFKARQPTgnJGZvh8u46u79hEKOUSiW/999qTK14vZMPwc6LRVn4b0Z48fmW+SzhEaTkrzILNURcdaYBsWEY0daC/qsoxWvfKcBmU9srHLY2rZ2K5VoBjQjDO7Zu7Nj4Zll46cpBETlTjlK30gMejJU10PFp3z24lvkXcRmN3o4Md4WCGAKsAq8RYkNjbRXVTtwACT1yBTj9d3mraZ50SBBlkXzHacnjnzh7nndRj2bVGMwbij2JHOUIfEiOJ1CtA3lm+7/P6x2AzDVO/FuufJFsrb6WiSxt7Eh6u1iVeVPzI18KNE/YSUxT7zFGpVtkgfqnCmfBxjjDmP2qged/TCrJwVuC5FgyC1AOMf5L35wzXqrIr+zSsh5USsZKnc19Vo7lNYkYgDBKH7dGFyy+beIjBux/admyrEZkZD0yi/aJwzGNDFMnC4kYqmhEzIAa3g9lpiho2yWYPA6/0rPnZPleQm+LP3gM2GaZqPkvU8XNPsa8fmoZIr3KCyfz6owyb3uBHzOoQi9FsGzP717F9RLyvg6+LoEvhTumoW8A1ejkqYas5iJzVdY3tndpAoSQavJTY+TNhG15enI4cwX/AZqKj2Ugu/yex4dAzyZHemPNtIzlBK4oh+wiER3jruDXik/689C0UG8rGyZIIDetnDWDyN0LkMwcBNLuK5oni4dOk0G87eKePyvGVsq8fZCl7MwFg0t1y5KumVk69pkarmW41TUj2LrkQ11qzlrUVs+TyuHGUt74OJQF7PmGiHoDUfdtS2AObchs6TJYvbpdJY+5jmqlXdMEND4yRL5vmC8z5K6vhImrrozHHje9vrb0GPFWOzQe79DsMTovkXuglCt6q8XU0SakwQn+Xb2xLzgpFGFPhiIORgnSbcoVli5CP+jm7Z6wuhEo2b0UG2jAIlkZC3JcG+yHq6divxt53wNi0SImcuRQnDOMMPo2zKicx0kKiQfUURz3tNhGaT0/H4eInE0fpaB0sFkDQMNJ5ITdcmIk64UNqnf5XHpTm8//1leF/Sdu+8g+GUR5Bd1pi2JIwtlKjowKwOx+0ZOzzfuL5no0QcShv48AVTwXCPK2dxhbopx/spIQ8GgG06zzONzo0hLQahADUTif6RJoq7EGUPITD0I2Zv2E+MyLiay+g2vekG7eKjKOf7xItFMGWJFnjRNw4mLGVIBKhqPLBh7JlIqkDf4gcMIhEM/292fzfNFunuRykuivsw2Z3GbGSI4T8IA8tf3mu8Wu5Ih4d+08LZh2LLVg/2iYM555yyBKcQoxSlZBvPK6wij6CgufQ721xM1sdu7pK2rLIGpYXpZbjunpQSggPsrYcjp0oAp8yCphopbphoZdZK6ZyOduSbH+Ap+crDB5fzOttRzbIj7qLOqJkbbK/HIesPUIIh+NEi1PSrTxJj8Amg9PAPHozaMO30fCnjSxv7NcB6QZBa9xnRvXxVOHmUMZYfwUNwapXHi+PwX1r72VTnp04qkISu+8aEqdILEAvR8+IzCYe+vEbyp+cCZUgm2IM+Ml2LpL944ovNNLouZZkl1xymPr6u44Bb6pv7pBbhM5WRXNDu+RQGASlIS7Ns/22MQaOnpvuvSlY3QaZpdNfZdF6ecSQv/WzK0jH72QZqj2l5rh12+63rVk8EioKKcE9HHe6O2QI4FTcRgWGH02PITn1wwxHDQGWfgm43l4obpkK7ZqNjDEUMhtpGBJqJ/Ka88wgwO4tmfz7HlEfe8Hnpg1mO4Wl/XwCwnkniLp+FIZEvOeg9OFg7FYo4wExHOpkzomTrJVUW3f7Zchu4pKrCrtPwgkScONgVfGXpFgVE/T7Qt3LGmkwe0Y05f21JmsBtOWiIZTBbnRubmEGmKgGtfoKL1FSeeXhJkESIW8965IzrtrVna9hDN8X4D7i1uGGHEUJPEDfy6dSRbme9v3qz2tGeZEpMLUvVC4czHKw9cKvVK//reVvVPsBQ2DJ3YVD20wugGBIWOyYppYc1sD3gkKYu10MRa0kVls/kWjmONCkhMez3wVX3vPJ44DAF2vwqSnP//J702DrC1jjhDT5VmePcHNoeJS4wiuMtUMEDeHwtEugNKACdeTmLP1Z+he9q+rvrMziRCs108QDBuAKOZrYVHj9caOwTKOw5iGDHeaC4Pu3NDrEp991L5PuaAZbeTQMHH9UAakFEeq+6Dlas3VNbbGp1qYuM5m9j7DATeaS214++5UF6MNbhD07zjyloervmzUfU99xza12juPcNhV5a3z6kPtsF9Ho/+syi83foc+KV75n6Fzq6miQMM1vHZ1uA57K9GWIeVrRHPtOqtbFQ/Vn8QlRTixPNakpzITH8v3FgQUkE9wEqTdvaOMKf5tFkJ0DSgDg1pUZ+wMREra3lk1+vI/vBpbMplxgaMFcBziqmoKvQFwOxAfvrDjk2jpVJH0IqFPOC8EcLPUYmFd6zAG/C0bHMpWdmVKT8REPHQT2yQrPTfVMhee3IhIAq5nUGMXu/454jJH9SPuY1nKBS6Wod373LufUd1s8AnLBaMALY0+3tzjupHauUCoGsCp7OY/e+yC199uZHikcZhahdtmQWuCt7LmsxlUxHfVlDM5A+p/SvLripwOdMENqpT+d0jun0rhU2rbC67cj5WFhGut2Fykoz2L6ARW/Uny4LzKQYapwLZ8jSLILPgtiX2ecEX5mfc7V3333T07eGy4cOt+cwW04riSfUgUpHFQZBwD1SPmYRRSG44WwIQY2XDT/7VojI+LWtRRIR4d+QPEHBe+AXBe+PZKaDzET4U46iUIPQB26dkql5ngtlmYaKc4uSV6+R2rdPBSTNtBUpduP6CRaQIeAR3BGBPYS+ZQM/OTSR2lxjr9YYoEnn4PCUB33Wk=,iv:Vr8aMvSwxbs2f6V/uTFeCFJq0WYmPN3pmA2CvAdvH7k=,tag:A8/WStcJBkFOnp9+bxjr0Q==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyQ2M3QWpMOGFzNmg3ck9k\nVitPOHpMUW82ZGg2S0NNazZwSXZ2ZVVWN0ZBCmpLaFBQN2QrQ3VSZjN4VWlpVW9q\nVWtaV1BYZDVEWWdwK1o4UVVXdDN4aDAKLS0tIE00SUo5R2NaelhKQ1FWQmhBSWlR\nZXJQZGQzWVUvem10MHFjbmZZRkQ4dVkKYENxtxshpsm2azFfuFaaiTvilMXEWQH1\nhKFPOOTwglqcLX1TSMKttAFQQtDmpKkMRqMvk8gSN3Zi0YclgfsAaw==\n-----END AGE ENCRYPTED FILE-----\n",
+				"recipient": "age1jmpdssn7555g0pht7zwqq2dvrvzxyu65w6cf2su8pp2fz0zvaykq0jgern"
+			}
+		],
+		"lastmodified": "2026-05-31T18:07:37Z",
+		"mac": "ENC[AES256_GCM,data:OQN9Eb3f5O0qdPd6QqJ60FPuSdxr5yY28woculw2ND3l+thmcUn6Hln2BmKsgrFqMdAWGbDqL6BXaaJja5bMKpCZL2+0Fs6NE4++oCwthNjfkooXeE3EI8WrMEl7+QP4AoLDBlHR2HFcTYqDAjemo/ezTMWq3easIiknhXtka0I=,iv:kI1PEoLDlpBmWYgnPlokl461JWLgMggafLiDfqud5Nk=,tag:GVGeMGFHyYf7w7kuRtporg==,type:str]",
+		"version": "3.13.1"
+	}
+}