SPIRE service

SPIRE is a SPIFFE runtime environment. I use it in my infra to easily provide certificates or tokens to various workloads across the homelab. These can be used for service-to-service communication.

{ lib, ... }: {
  imports = [
    ./agent.nix
    ./certs.nix
    ./creds.nix
    ./entries.nix
    ./server.nix
    ./tunnels.nix
    ./users.nix
  ];

  options.mjm.spire = {
    <<options>>
  };

  _class = "nixos";
}

This module has several different subcomponents, each broken out into their own submodules.

=> agent
=> server

Options

trustDomain = lib.mkOption {
  type = lib.types.str;
  default = "home.mattmoriarity.com";
};

Both the SPIRE server and agent need to configured the trust domain they are a part of. This is the host part of the URLs for SPIFFE IDs.