Add certificates and CA

.gitignore

···
 
 **/encrypt/*
 !**/encrypt/*.age
+
+**/certs/*
+!**/certs/*.age
+!**/certs/ca.crt

lib/apps/genCerts.nix

···
 
   caCertificate = {
     name = "ca";
-    output = "modules/base/encrypt/";
+    output = "modules/base/certs/";
     settings.initca = true;
   };
 
   certificates = [
     {
       name = "mqtt";
-      output = "modules/automation/encrypt/";
+      output = "modules/automation/certs/";
       settings = {
         profile = "auth-only";
         config = caConf;

modules/base/certs.nix

···
+{ lib, config, ... }:
+
+with lib;
+let
+  cfg = config.modules.gpg;
+in {
+  options.modules.certs = {
+    enable = mkOption {
+      default = true;
+      description = "CA Certificates";
+      type = types.bool;
+    };
+  };
+
+  config = mkIf cfg.enable {
+    security.pki.certificateFiles = [ ./certs/ca.crt ];
+  };
+}
+

modules/base/certs/ca.crt

···
+-----BEGIN CERTIFICATE-----
+MIIE6jCCAtKgAwIBAgIUXTqgvbXI0xhtkVXYUUFVvLD5Nv0wDQYJKoZIhvcNAQEN
+BQAwDTELMAkGA1UEAxMCY2EwHhcNMjQwOTIxMjIwNjAwWhcNMjkwOTIwMjIwNjAw
+WjANMQswCQYDVQQDEwJjYTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB
+ALzvrQg/WajwUho0LDjbPThVeSn/kMnrtHCMKrXnTZdz3Ok/KmRtTgNJ9QbbJsLR
+A6EhyVxK/W775jki3bLv/hi998s6H4yimgoP+x64l/KFrcxUPsDSM5GfGCfDZoFO
+fAxoLT5RWhuQdJ679x9GIIG0sIunWs8VPkXlipXMORb2tU8g9rEUR1uJwYVhW2by
+EX4znWcndJg5+yAVzFdzPjSyuiPPUES4MPXHHBgyP6qeH1C8gUmYV8l5u+On4lSW
+UE66Shk3mO5dbvit3+g+/7zGR584tM+cxqzeHz+S0yOKOhnL01OWtf2FHBIZSRmK
+j5AM9/Z4MqOom7qVHDol1kO8j/0ub1Xb1tXJ4eAKTeecrx3ouUawCoenrPJYV2f5
+6+tp0QQ20X7+IF4DojA2oqOx6QtDN5AweRnQuZFd+hYusStuspMVeeKzP+XUPYTA
+3ILlTJ26/2Fenc65uewgtbxVR30HNQ7S7jMrI+xzRXPZ9ZSXNbMne62UNPQL1dpK
+cmsRuNkpobnC10Tw/HVmFmhf07zi71IIj/IIL1YdSxFT8xI27WAwh0GNUBGYUkJe
+EbpeMlr3czl6Sx0AG/tsOsJDCu4mdp9Y1kyEIWtkMgi5jeboTWUPhYQ+zBTe2eyu
+yPBcEmp44W4OGazbbv0qg6/2h1emwaDDEBTZINvtCz15AgMBAAGjQjBAMA4GA1Ud
+DwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSz4KVhDRkOqW70
+pi6hoPPMAb7wwzANBgkqhkiG9w0BAQ0FAAOCAgEADdy4pZGIeQqNVChDNNMET7Tl
+DFgTp1q4DQT0Yk9qHtVpIhbxTBWCyfoweNZVx7LL4RzTzZQ73O4YJ7obHPAlMqEW
+bHL/ZctSgG0saVpwk6t0hlX0va/SOjZheplDQBavWTlBlWkE8PiySGcD+CPcP8iS
+qCNh6Eyt2DHODXjGPjaucQlQ3jovNqJjGQbMmFkVQjYwK5Liyj/qu3MxEYky95yt
+S/W8ipnzLE74Um/sJTE0XMKGTcSPrci5ren0EqrgEvuX8rFoJqmJSQloe8H8DycH
+6IptkHncIy8trAby4sZNNA8DHzfJRNe++DVxcbHbXCyd1Nh+yvODuFqZPAcNWY3Y
+aV56xaeu4C0l+ukDj1OpclovZC5r0JFhtcnde6JQo+/8WhVobpRdIYbVFbbV+TiF
+8zUTQobQdDWJriInEoAqmTD+r5gcZYjJJH29yCRzKnltMMCnybDiDSBLwAZPZ94r
+mCeINP2AXGCgJfcXKDvL0o5MVL5jW9xt4ARgn8QaDVqWQfPbWaSLHoQhm671gOHI
+Jk/yq5WsfFuoYWS+dM39vRqb9LWub91Q9HQA+IJ5PXyvpLOI5FJKV5Lp+HkRMA++
+T7wH8VFKIJHGjAm3j2JxrNUeVq+n5/dadHFvv/i1b/nzcWH48L8TxjFR4ab3JG9M
+ftCgJngtxuQKgwJa6HQ=
+-----END CERTIFICATE-----

modules/base/default.nix

···
 {
   imports = [
     ./nix-config.nix
+    ./certs.nix
     ./shell.nix
     ./linux.nix
     ./gpg.nix

secrets.nix

···
   "./home/base/encrypt/CA84692E3CC846C8EC7272468E962B63FC599E49.key.age".publicKeys = keys;
 
   "./home/development/encrypt/npmrc.age".publicKeys = keys;
+
+  "./modules/automation/certs/mqtt.key.age".publicKeys = keys;
+  "./modules/automation/certs/mqtt.crt.age".publicKeys = keys;
 }