dirty commits:

extend cert cert-generator
add ssl certs to grafana if cert gen is on

Author: djacu

nix/nixos-modules/services/cert-generator.nix

@@ -31,6 +31,18 @@ in
       description = "TODO: @sarcasticadmin";
     };
 
+    certCert = mkOption {
+      type = types.str;
+      default = "${cfg.certPath}/cert.crt";
+      description = "TODO: @sarcasticadmin";
+    };
+
+    certKey = mkOption {
+      type = types.str;
+      default = "${cfg.certPath}/cert.key";
+      description = "TODO: @sarcasticadmin";
+    };
+
     commonName = mkOption {
       type = types.str;
       description = "TODO: @sarcasticadmin";
@@ -49,7 +61,7 @@ in
         ConditionPathExists = "!${cfg.certPath}/cert.crt";
       };
       serviceConfig = {
-        ExecStart = "openssl req -new -newkey rsa:4096 -days 365 -nodes -x509 -subj '/C=US/ST=California/L=Pasadena/O=SCaLE Security/OU=NOC/CN=${cfg.commonName}' -keyout ${cfg.certPath}/cert.key -out ${cfg.certPath}/cert.crt";
+        ExecStart = "${lib.getExe pkgs.openssl} req -new -newkey rsa:4096 -days 365 -nodes -x509 -subj '/C=US/ST=California/L=Pasadena/O=SCaLE Security/OU=NOC/CN=${cfg.commonName}' -keyout ${cfg.certKey} -out ${cfg.certCert}";
       };
       wantedBy = [ "network.target" ];
     };

nix/nixos-modules/services/monitoring.nix

@@ -6,6 +6,7 @@
 }:
 let
   cfg = config.scale-network.services.monitoring;
+  cfgCertGenerator = config.scale-network.services.cert-generator;
 
   inherit (lib)
     types
@@ -14,6 +15,7 @@ let
   inherit (lib.modules)
     mkDefault
     mkIf
+    mkMerge
     ;
 
   inherit (lib.options)
@@ -90,17 +92,24 @@ in
       };
 
       nginx.enable = mkDefault true;
-      # TODO: TLS enabled
-      # Good example enable TLS, but would like to keep it out of the /nix/store
-      # ref: https://github.com/NixOS/nixpkgs/blob/c6fd903606866634312e40cceb2caee8c0c9243f/nixos/tests/custom-ca.nix#L80
-      nginx.virtualHosts."${cfg.nginxFQDN}" = {
-        default = true;
-        enableACME = false;
-        locations."/" = {
-          proxyPass = "http://${toString config.services.grafana.settings.server.http_addr}:${toString config.services.grafana.settings.server.http_port}/";
-          proxyWebsockets = true;
-        };
-      };
+      nginx.virtualHosts."${cfg.nginxFQDN}" = mkMerge [
+
+        {
+          default = true;
+          enableACME = false;
+          locations."/" = {
+            proxyPass = "http://${toString config.services.grafana.settings.server.http_addr}:${toString config.services.grafana.settings.server.http_port}/";
+            proxyWebsockets = true;
+          };
+        }
+
+        (mkIf cfgCertGenerator.enable {
+          addSSL = true;
+          sslCertificate = cfgCertGenerator.certCert;
+          sslCertificateKey = cfgCertGenerator.certKey;
+        })
+
+      ];
     };
   };
 }