reactor-ca/example_config/hosts.yaml at master · serpent213/reactor-ca · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
# ReactorCA: Host Certificate Configuration
# This file defines the certificates you want to issue for your hosts/services.
# yaml-language-server: $schema=https://serpent213.github.io/reactor-ca/schemas/v1/hosts.schema.json

hosts:
  # Web server example - SAN-first approach (no CN required)
  web-server:
    # Subject Alternative Names are the primary method for hostname validation
    alternative_names:
      dns:
        - web.reactor.local
        - www.reactor.local
        - "*.dev.reactor.local"
      ip:
        - 192.168.1.100
        - 10.10.0.1
        - 2001:db8::1
    validity:
      years: 1

  # FritzBox deployment example
  mushroom:
    subject:
      common_name: fritz.box
    alternative_names:
      dns:
        - fritz.box
      ip:
        - 192.168.178.1
    validity:
      years: 1
    key_algorithm: RSA2048
    hash_algorithm: SHA256
    deploy:
      command: |
        # using https://github.com/tisba/fritz-tls
        fritz-tls --manual --host https://admin@fritz.box --insecure --key=${private_key} --fullchain=${cert}

  # IoT device with custom subject fields
  iot-gateway:
    subject:
      organizational_unit: IoT Division
    alternative_names:
      dns:
        - iot.reactor.local
        - mqtt.reactor.local
      ip:
        - 192.168.1.150
    validity:
      days: 365
    key_algorithm: ED25519
    hash_algorithm: SHA256
    export:
      cert: "/opt/iot/certs/gateway.crt"
      chain: "/opt/iot/certs/gateway-chain.crt"
    deploy:
      command: |
        chown iot:iot /opt/iot/certs/*
        systemctl restart mosquitto

  # Client certificate for user authentication (VPN, web auth, email signing)
  client-user:
    subject:
      organizational_unit: Users
    alternative_names:
      email:
        - "john.doe@reactor.local"
    validity:
      years: 1
    key_algorithm: RSA3072
    hash_algorithm: SHA256
    # No export/deploy - stored in secure store only

  # Proxmox PVE deployment example (via SSH)
  moxbox:
    subject:
      common_name: moxbox
    alternative_names:
      dns:
        - moxbox
        - moxbox.fritz.box
    validity:
      months: 1
    key_algorithm: ECP384
    hash_algorithm: SHA384
    deploy:
      command: |
        scp ${cert} moxbox:new.pem
        scp ${private_key} moxbox:new.key
        ssh moxbox "pvenode cert set new.pem new.key --force --restart ; rm -f new.pem new.key"

  # NixOS homelab server with agenix secrets management
  # Additional recipients for runtime decryption on the target system
  nixos-homelab:
    subject:
      organizational_unit: Infrastructure
    alternative_names:
      dns:
        - homelab.reactor.local
        - vault.reactor.local
        - git.reactor.local
        - ci.reactor.local
      ip:
        - 192.168.1.10
    validity:
      years: 1
    key_algorithm: ED25519
    hash_algorithm: SHA256
    # Include host's SSH host private key for agenix
    encryption:
      additional_recipients:
        - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEMJHSsJ1rwalBLpOt/JkxQubOwgp1xtZhvwqxkFCVTM test@reactor.local"
    export:
      cert: "../myserver/secrets/homelab/cert.pem"
      key_encrypted: "../myserver/secrets/homelab/key.age"
    deploy:
      command: |-
        # Rebuild NixOS configuration locally and deploy to target host
        cd ~/infrastructure/myserver
        nixos-rebuild switch --target-host root@homelab.reactor.local --flake .#homelab