wip: adding spire module

modules/nixos/spire/agent.nix

@@ -0,0 +1,34 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}: let
+  topConfig = config.services.spire;
+  cfg = config.services.spire-agent;
+  # Ref: https://github.com/spiffe/spire/blob/main/conf/agent/agent_full.conf
+  agentConfig = {
+    server = {
+      trust_domain = "";
+      bind_address = "";
+      bind_port = "";
+    };
+    telemetry = {
+      Prometheus = {
+        port = 9090;
+      };
+    };
+  };
+  agentConfigFile = pkgs.writeText "spire-agent-config" (builtins.toJSON agentConfig);
+in {
+  options.services.spire-agent = {
+    enable = lib.options.mkOption {
+      description = "Enable Spire agent";
+      default = false;
+      type = lib.types.bool;
+    };
+  };
+  config =
+    lib.mkIf cfg.enable {
+    };
+}

modules/nixos/spire/default.nix

@@ -0,0 +1,19 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  foo = "";
+in {
+  imports = [./server.nix ./agent.nix];
+  options.services.spire = {
+    trustDomain = lib.options.mkOption {
+      description = "Spire trust domain";
+      default = "example.org";
+      type = lib.types.str;
+    };
+  };
+  config = {
+  };
+}

modules/nixos/spire/server.nix

@@ -0,0 +1,107 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}: let
+  topConfig = config.services.spire;
+  cfg = config.services.spire-server;
+  # Ref: https://github.com/spiffe/spire/blob/main/conf/server/server_full.conf
+  serverConfig = {
+    server = {
+      admin_ids = ["spiffe://${topConfig.trustDomain}/admin"];
+      bind_address = "[::1]";
+      # bind_port = "";
+      # ca_key_type = "";
+      ca_subject = {
+        country = ["AU"];
+        organization = ["Richtman"];
+        common_name = "Spire";
+      };
+      # ca_ttl = "5m";
+      data_dir = "./.data";
+      jwt_issue = "spire.services.richtman.au";
+      # TODO: get a writable directory for logs, maybe systemd tmpDir
+      log_file = "/tmp/spire-server.log";
+      # log_file = "/var/log/spire-server.log";
+      log_level = "DEBUG";
+      # agent_ttl = "5m";
+      default_x509_svid_ttl = "5m";
+      # default_jwt_svid_ttl = "5m";
+      trust_domain = topConfig.trustDomain;
+    };
+    plugins = {
+      "CredentialComposer \"uniqueid\"" = {};
+      "DataStore \"sql\"" = {
+        plugin_data = {
+          # TODO: Revisit this, postgres might be better uniformity
+          #   though they may only support AWS options?
+          database_type = "sqlite3";
+          connection_string = "./.data/datastore.sqlite3";
+        };
+      };
+      "KeyManager \"disk\"" = {
+        plugin_data = {
+          keys_path = "/opt/spire/data/server/keys.json";
+        };
+      };
+      "KeyManager \"memory\"" = {
+        plugin_data = {};
+      };
+    };
+    telemetry = {
+      Prometheus = {
+        port = 9090;
+      };
+    };
+  };
+  serverConfigFile = pkgs.writeText "spire-server-config" (builtins.toJSON serverConfig);
+in {
+  options.services.spire-server = {
+    enable = lib.options.mkOption {
+      description = "Enable Spire server";
+      default = false;
+      type = lib.types.bool;
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    users = {
+      users = {
+        spire-server = {
+          # TODO: See about using DynamicUser and StateDirectory
+          description = "Spire server user";
+          # TODO: See about automatic group creation
+          group = "spire";
+          home = "/var/lib/spire";
+          createHome = true; # TODO: make this a systemd tmpfile like etcd's dir?
+          homeMode = "755";
+          isSystemUser = true;
+        };
+      };
+      # Required to create the kubernetes group
+      groups.spire = {};
+    };
+    systemd.services.spire-server = {
+      description = "Spire server";
+      # Required to activate the service.
+      wantedBy = ["spire.target" "multi-user.target"];
+      # Wait on networking.
+      after = ["network.target"];
+      serviceConfig = {
+        # For managing resources of groups of services
+        Slice = "spire.slice";
+        ExecStart = "${pkgs.spire-server}/bin/spire-server run " + "-config " + serverConfigFile;
+        WorkingDirectory = "/var/lib/spire";
+        # TODO: not sure if there's any nicer way to couple these to the user definition
+        User = "spire-server";
+        Group = "spire";
+        # AmbientCapabilities = "cap_net_bind_service";
+        Restart = "on-failure";
+        RestartSec = 5;
+      };
+      unitConfig = {
+        StartLimitIntervalSec = 0;
+      };
+    };
+  };
+}

systems/x86_64-linux/fat-controller/default.nix

@@ -17,6 +17,8 @@
     "ip6 saddr { 2403:580a:e4b1::/48 } tcp dport 443 accept"
   ];
   services = {
+    # spire.trustDomain = "services.richtman.au";
+    # spire-server.enable = true;
     k8s.controller = true;
     caddyRP.enabled = true;
     monitoring.enable = true;