check wrappers

modules/features/ssh-certs.nix

@@ -9,7 +9,7 @@ in
       inherit pkgs;
       package = (pkgs.symlinkJoin {
         name = "ssh-certs";
-        meta.mainProgram = "sign-ssh-user-cert";
+        meta.mainProgram = "ssh-user-cert-sign";
         paths = [
           (inputs.self.wrappers.signUserWrapper.apply {
             inherit pkgs;
@@ -18,11 +18,18 @@ in
             validUsers = [ "john" "root" "appdaemon" ];
           }).wrapper
 
+          (inputs.self.wrappers.userCheckWrapper.apply {
+            inherit pkgs;
+          }).wrapper
+
           (inputs.self.wrappers.signHostWrapper.apply {
             inherit pkgs;
             provisioner = "admin";
             overwrite = true;
-            # extraPrincipals = [ "home-pc" ];
+          }).wrapper
+
+          (inputs.self.wrappers.hostCheckWrapper.apply {
+            inherit pkgs;
           }).wrapper
         ];
       });
@@ -43,7 +50,7 @@ in
     };
 
     config = {
-      binName = "sign-ssh-host-cert";
+      binName = "ssh-host-cert-sign";
       package = config.pkgs.step-cli;
       extraPackages = with config.pkgs; [ hostname iproute2 systemd ];
       preHook = ''
@@ -74,6 +81,22 @@ in
     };
   });
 
+  flake.wrappers.hostCheckWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
+    options = {
+      certPath = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = "/etc/ssh/ssh_host_ed25519_key-cert.pub";
+      };
+    };
+
+    config = {
+      binName = "ssh-host-cert-check";
+      package = config.pkgs.openssh;
+      exePath = lib.getExe' config.pkgs.openssh "ssh-keygen";
+      args = [ "-Lf" "${config.certPath}" ];
+    };
+  });
+
   flake.wrappers.signUserWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
     options = {
       provisioner = lib.mkOption {
@@ -89,7 +112,7 @@ in
     };
 
     config = {
-      binName = "sign-ssh-user-cert";
+      binName = "ssh-user-cert-sign";
       package = config.pkgs.step-cli;
       args = [ "ssh" "certificate" "--sign" ]
         ++ lib.optionals (config.provisioner != null) [ "--provisioner" "${config.provisioner}" ]
@@ -97,4 +120,20 @@ in
         ++ mkPrincipalArgs config.validUsers;
     };
   });
+
+  flake.wrappers.userCheckWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
+    options = {
+      certPath = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = "$HOME/.ssh/id_ed25519-cert.pub";
+      };
+    };
+
+    config = {
+      binName = "ssh-user-cert-check";
+      package = config.pkgs.openssh;
+      exePath = lib.getExe' config.pkgs.openssh "ssh-keygen";
+      args = [ "-Lf" "${config.certPath}" ];
+    };
+  });
 }