issuer.nix

# This contains all of the NixOS system configuration necessary to specify an
# "issuer"-type system.
{ lib, config, ...}:
let
  inherit (config.grid) publicKeyPath privateKeyPath monitoringvpnEndpoint monitoringvpnIPv4;
  inherit (config.grid.issuer) issuerDomains allowedChargeOrigins;
in {
  imports = [
    ../../nixos/modules/monitoring/vpn/client.nix
    ../../nixos/modules/monitoring/exporters/node.nix
  ];

  options.grid.issuer = {
    issuerDomains = lib.mkOption {
      type = lib.types.listOf lib.types.str;
      description = ''
        A list of strings giving the domain names that point at this issuer
        system.  These will all be included in Let's Encrypt certificate.
      '';
    };

    allowedChargeOrigins = lib.mkOption {
      type = lib.types.listOf lib.types.str;
      description = ''
        A list of strings giving CORS Origins will the issuer will be configured
        to allow.
      '';
    };
  };

  config = {
    deployment = {
      secrets = {
        "ristretto-signing-key" = {
          destination = "/run/keys/ristretto.signing-key";
          source = "${privateKeyPath}/ristretto.signing-key";
          owner.user = "zkapissuer";
          owner.group = "zkapissuer";
          permissions = "0400";
          action = ["sudo" "systemctl" "restart" "zkapissuer.service"];
        };
        "stripe-secret-key" = {
          destination = "/run/keys/stripe.secret-key";
          source = "${privateKeyPath}/stripe.secret";
          owner.user = "zkapissuer";
          owner.group = "zkapissuer";
          permissions = "0400";
          action = ["sudo" "systemctl" "restart" "zkapissuer.service"];
        };

        "monitoringvpn-secret-key" = {
          destination = "/run/keys/monitoringvpn/client.key";
          source = "${privateKeyPath}/monitoringvpn/${monitoringvpnIPv4}.key";
          owner.user = "root";
          owner.group = "root";
          permissions = "0400";
          action = ["sudo" "systemctl" "restart" "wireguard-monitoringvpn.service"];
        };
        "monitoringvpn-preshared-key" = {
          destination = "/run/keys/monitoringvpn/preshared.key";
          source = "${privateKeyPath}/monitoringvpn/preshared.key";
          owner.user = "root";
          owner.group = "root";
          permissions = "0400";
          action = ["sudo" "systemctl" "restart" "wireguard-monitoringvpn.service"];
        };
      };
    };

    services.private-storage-issuer = {
      enable = true;
      tls = true;
      ristrettoSigningKeyPath = config.deployment.secrets.ristretto-signing-key.destination;
      stripeSecretKeyPath = config.deployment.secrets.stripe-secret-key.destination;
      database = "SQLite3";
      databasePath = "${config.fileSystems."zkapissuer-data".mountPoint}/vouchers.sqlite3";
      inherit (config.grid) letsEncryptAdminEmail;
      inherit allowedChargeOrigins;
      domains = issuerDomains;
    };

    services.private-storage.monitoring.vpn.client = {
      enable = true;
      ip = monitoringvpnIPv4;
      endpoint = monitoringvpnEndpoint;
      endpointPublicKeyFile = "${publicKeyPath}/monitoringvpn/server.pub";
    };

    system.stateVersion = "19.03";
  };
}