issuer.nix

# This, along with `customize-issuer.nix, contains all of the NixOS system
# configuration necessary to specify an "issuer"-type system.  Originally, this
# file has all the static configuration, and `customize-issuer.nix` was a function
# that filled in the holes. We are in the process of merging the modules, using settings
# instead of function arguments.
# See https://whetstone.privatestorage.io/privatestorage/PrivateStorageio/-/issues/80
{ config, ...}:
let
  inherit (config.grid) publicKeyPath privateKeyPath;
in {
  deployment = {
    secrets = {
      "ristretto-signing-key" = {
        destination = "/run/keys/ristretto.signing-key";
        source = "${privateKeyPath}/ristretto.signing-key";
        owner.user = "zkapissuer";
        owner.group = "zkapissuer";
        permissions = "0400";
        action = ["sudo" "systemctl" "restart" "zkapissuer.service"];
      };
      "stripe-secret-key" = {
        destination = "/run/keys/stripe.secret-key";
        source = "${privateKeyPath}/stripe.secret";
        owner.user = "zkapissuer";
        owner.group = "zkapissuer";
        permissions = "0400";
        action = ["sudo" "systemctl" "restart" "zkapissuer.service"];
      };

      "monitoringvpn-secret-key" = {
        destination = "/run/keys/monitoringvpn/client.key";
        owner.user = "root";
        owner.group = "root";
        permissions = "0400";
        action = ["sudo" "systemctl" "restart" "wireguard-monitoringvpn.service"];
      };
      "monitoringvpn-preshared-key" = {
        destination = "/run/keys/monitoringvpn/preshared.key";
        owner.user = "root";
        owner.group = "root";
        permissions = "0400";
        action = ["sudo" "systemctl" "restart" "wireguard-monitoringvpn.service"];
      };
    };
  };

  imports = [
    ../../nixos/modules/monitoring/vpn/client.nix
    ../../nixos/modules/monitoring/exporters/node.nix
  ];

  services.private-storage-issuer = {
    enable = true;
    tls = true;
    ristrettoSigningKeyPath = config.deployment.secrets.ristretto-signing-key.destination;
    stripeSecretKeyPath = config.deployment.secrets.stripe-secret-key.destination;
    database = "SQLite3";
    databasePath = "${config.fileSystems."zkapissuer-data".mountPoint}/vouchers.sqlite3";
  };
}