infra.pki

16 options

infra.pki.acmeDns

infra.pki.acmeDns.apiAddress

Bind IP for the registration/update HTTP API. Internal interface — reachable on the LAN/tailnet, never WAN.

Type: string

Default:

config.infra.networking.internalIp

Declared by: nix/modules/infra/pki/acme-dns

infra.pki.acmeDns.apiPort

Port for the registration/update HTTP API.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

8081

Declared by: nix/modules/infra/pki/acme-dns

infra.pki.acmeDns.dnsListen

Public DNS listener. Must be reachable from the internet (edge-router WAN :53 forward).

Type: string

Default:

"0.0.0.0:53"

Declared by: nix/modules/infra/pki/acme-dns

infra.pki.acmeDns.domain

Delegated subdomain acme-dns is authoritative for (NS-delegated from the parent zone in Cloudflare). Must be non-null when enabled (asserted).

Type: null or string

Default:

"acme-dns.${config.fleet.settings.domain.base}"

Declared by: nix/modules/infra/pki/acme-dns

infra.pki.acmeDns.enable

Whether to enable acme-dns DNS-01 delegation server (ADR-026).

Type: boolean

Default:

false

Example:

true

Declared by: nix/modules/infra/pki/acme-dns

infra.pki.acmeDns.nsadmin

SOA RNAME (admin contact; ‘@’ written as ‘.’). Must be non-null when enabled (asserted).

Type: null or string

Default:

"admin.${config.fleet.settings.domain.base}"

Declared by: nix/modules/infra/pki/acme-dns

infra.pki.acmeDns.nsname

Authoritative nameserver FQDN. Needs a public glue A record (emitted by the Cloudflare resource) pointing at publicIp. Must be non-null when enabled (asserted).

Type: null or string

Default:

"ns.acme-dns.${config.fleet.settings.domain.base}"

Declared by: nix/modules/infra/pki/acme-dns

infra.pki.acmeDns.publicIp

Public IP returned for the apex/NS A records and used as the glue target. For an edge host this is the fleet WAN IP. Must be non-null when enabled (asserted).

Type: null or string

Default:

config.fleet.settings.network.wanIp

Declared by: nix/modules/infra/pki/acme-dns

infra.pki.acmeDns.stateDir

State directory (SQLite registration DB).

Type: string

Default:

"/var/lib/acme-dns"

Declared by: nix/modules/infra/pki/acme-dns

infra.pki.ca

infra.pki.ca.address

Address step-ca listens on.

Type: string

Default:

"0.0.0.0"

Declared by: nix/modules/infra/pki/ca

infra.pki.ca.caName

Human-readable name for the Certificate Authority.

Type: string

Default:

"${config.fleet.settings.name} Internal CA"

Declared by: nix/modules/infra/pki/ca

infra.pki.ca.domain

FQDN for the CA server. Must be non-null when infra.pki.ca is enabled (asserted).

Type: null or string

Default:

"ca.${config.fleet.settings.domain.internal}"

Declared by: nix/modules/infra/pki/ca

infra.pki.ca.enable

Whether to enable Smallstep step-ca internal ACME server.

Type: boolean

Default:

false

Example:

true

Declared by: nix/modules/infra/pki/ca

infra.pki.ca.metricsPort

Port for the Prometheus metrics listener. step-ca exposes /metrics on a separate plain-HTTP listener (not the main HTTPS API port). Bound to 127.0.0.1 so it isn’t reachable off-host.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

2400

Declared by: nix/modules/infra/pki/ca

infra.pki.ca.port

Port step-ca listens on.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

9000

Declared by: nix/modules/infra/pki/ca

infra.pki.ca.provisioner

Default provisioner name.

Type: string

Default:

"acme"

Declared by: nix/modules/infra/pki/ca