started SSH certs

modules/hosts/test-nix.nix

@@ -19,18 +19,19 @@ in
       inputs.home-manager.nixosModules.home-manager
       nixos."${username}"
       nixos.lxc
-      nixos.sudo
+      # nixos.sudo
       nixos.zsh
       nixos.docker
+      nixos.step-client
       {
         users.users."${username}" = {
           extraGroups = [ "docker" ];
         };
 
         home-manager.users."${username}" = {
-          imports = with inputs.self.modules.homeManager; [
-            step-client
-          ];
+          # imports = with inputs.self.modules.homeManager; [
+          #   step-client
+          # ];
           shell.program = "zsh";
           docker.enable = true;
           ssh.matchSets = {

modules/programs/step-client.nix

@@ -1,5 +1,13 @@
 { inputs, ... }:
 {
+  flake.modules.nixos.step-client = { pkgs, config, ... }: {
+    imports = with inputs.self.modules.nixos; [ ssh ];
+    ssh.certificates = true;
+    home-manager.sharedModules = with inputs.self.modules; [
+      homeManager.step-client
+    ];
+  };
+
   flake.modules.homeManager.step-client = { pkgs, ... }: {
     home.packages = with pkgs; [
       step-cli

modules/programs/sudo.nix

@@ -3,27 +3,14 @@
     security.sudo = {
       enable = true;
       extraRules = [{
+        groups = [ "wheel" ];
         commands = [
           {
-            command = "${pkgs.systemd}/bin/systemctl suspend";
-            options = [ "NOPASSWD" ];
-          }
-          {
-            command = "${pkgs.systemd}/bin/reboot";
-            options = [ "NOPASSWD" ];
-          }
-          {
-            command = "${pkgs.systemd}/bin/poweroff";
+            command = "ALL";
             options = [ "NOPASSWD" ];
           }
         ];
-        groups = [ "wheel" ];
       }];
-      extraConfig = with pkgs; ''
-        Defaults:picloud secure_path="${lib.makeBinPath [
-          systemd
-        ]}:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin"
-      '';
     };
   };
 }

modules/services/ssh.nix

@@ -3,7 +3,12 @@ let
   userName = "john";
 in
 {
-  flake.modules.nixos.ssh = {
+  flake.modules.nixos.ssh = { pkgs, config, lib, ... }: {
+    options = {
+      ssh.certificates = lib.mkEnableOption "Enable SSH certificates";
+    };
+
+    config = {
       services.openssh = {
         enable = true;
         # require public key authentication for better security
@@ -11,9 +16,13 @@ in
         settings.KbdInteractiveAuthentication = false;
       };
 
-    home-manager.sharedModules = with inputs.self.modules.homeManager; [
-      ssh
-    ];
+      programs.ssh.knownHosts = lib.mkIf config.ssh.certificates {
+        "192.168.1.*" = { 
+          certAuthority = true;
+          publicKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNug18oLH0vZxnibXJzMJvTWFPZTnSlhCDDVi+rHhgnIum6ZXQ4SF+VHOOAM5BbzZmMKitNJ5lcrGP15Eur7DzQ=";
+        };
+      };
+    };
   };
 
   flake.modules.homeManager.ssh = { pkgs, config, lib, ... }: