From 39504cd856fb8e4a4ec2c4cb210587b2f43e5f58 Mon Sep 17 00:00:00 2001
From: John Lancaster <32917998+jsl12@users.noreply.github.com>
Date: Sun, 5 Jul 2026 20:40:28 -0500
Subject: [PATCH] reorg

---
 modules/features/{ssh.nix => ssh/default.nix} | 10 +++---
 .../{ssh-certs.nix => ssh/ssh-wrappers.nix}   | 32 -------------------
 modules/nixos/lxc.nix                         |  1 +
 3 files changed, 6 insertions(+), 37 deletions(-)
 rename modules/features/{ssh.nix => ssh/default.nix} (96%)
 rename modules/features/{ssh-certs.nix => ssh/ssh-wrappers.nix} (85%)

diff --git a/modules/features/ssh.nix b/modules/features/ssh/default.nix
similarity index 96%
rename from modules/features/ssh.nix
rename to modules/features/ssh/default.nix
index 01ed22f..ab39b8f 100644
--- a/modules/features/ssh.nix
+++ b/modules/features/ssh/default.nix
@@ -2,6 +2,7 @@
 { self, inputs, ... }:
 let
   caPatterns = [ "*.john-stream.com" "192.168.1.*" "fded:fb16:653e:25da:be24:11ff:*" ];
+  sshHostCAPath = ../../hosts/janus/public/ssh_host_ca_key.pub;
 in
 {
   flake.modules.nixos.ssh-new = { config, pkgs, lib, ... }:
@@ -10,10 +11,9 @@ in
       hostKeyFile = "${cfg.host.configDir}/${cfg.host.keyFile}";
       hostCertFile = "${hostKeyFile}-cert.pub";
       userCAFile = "${cfg.host.configDir}/${cfg.certificates.user.CAFile}";
-      sshHostCAContent = lib.removeSuffix "\n" (builtins.readFile ../hosts/janus/public/ssh_host_ca_key.pub);
       CAknownHosts = (lib.genAttrs caPatterns (_: {
           certAuthority = true;
-          publicKey = sshHostCAContent;
+          publicKey = lib.removeSuffix "\n" (builtins.readFile sshHostCAPath);
       }));
 
       wrappers = inputs.self.wrappers;
@@ -129,7 +129,7 @@ in
         };
 
         environment.etc."ssh/${cfg.certificates.user.CAFile}" = lib.mkIf cfg.certificates.user.enable {
-          source = ../hosts/janus/public/ssh_user_ca_key.pub;
+          source = ../../hosts/janus/public/ssh_user_ca_key.pub;
         };
 
         environment.systemPackages = (
@@ -143,7 +143,7 @@ in
 
         sops = lib.mkIf cfg.certificates.host.autoRenew {
           secrets."janus/admin_jwk" = {
-            sopsFile = ../../keys/secrets.yaml;
+            sopsFile = ../../../keys/secrets.yaml;
             owner = "root";
             group = "root";
             mode = "0400";
@@ -198,7 +198,7 @@ in
   flake.modules.homeManager.ssh-new = { config, pkgs, lib, ... }:
     let
       cfg = config.ssh-new;
-      sshHostCAContent = lib.removeSuffix "\n" (builtins.readFile ../hosts/janus/public/ssh_host_ca_key.pub);
+      sshHostCAContent = lib.removeSuffix "\n" (builtins.readFile sshHostCAPath);
       knownHostsText = lib.concatMapStrings
         (pattern: "@cert-authority ${pattern} ${sshHostCAContent}\n")
         caPatterns;
diff --git a/modules/features/ssh-certs.nix b/modules/features/ssh/ssh-wrappers.nix
similarity index 85%
rename from modules/features/ssh-certs.nix
rename to modules/features/ssh/ssh-wrappers.nix
index a488881..f37977e 100644
--- a/modules/features/ssh-certs.nix
+++ b/modules/features/ssh/ssh-wrappers.nix
@@ -4,38 +4,6 @@ let
     builtins.concatLists (map (principal: [ "--principal" principal ]) principals);
 in
 {
-  perSystem = { system, self', pkgs, lib, ... }: {
-    packages.ssh-certs = inputs.wrappers.lib.wrapPackage {
-      inherit pkgs;
-      package = (pkgs.symlinkJoin {
-        name = "ssh-certs";
-        meta.mainProgram = "ssh-user-cert-sign";
-        paths = [
-          (inputs.self.wrappers.signUserWrapper.apply {
-            inherit pkgs;
-            provisioner = "admin";
-            overwrite = true;
-            validUsers = [ "john" "root" "appdaemon" ];
-          }).wrapper
-
-          (inputs.self.wrappers.userCheckWrapper.apply {
-            inherit pkgs;
-          }).wrapper
-
-          (inputs.self.wrappers.signHostWrapper.apply {
-            inherit pkgs;
-            provisioner = "admin";
-            overwrite = true;
-          }).wrapper
-
-          (inputs.self.wrappers.hostCheckWrapper.apply {
-            inherit pkgs;
-          }).wrapper
-        ];
-      });
-    };
-  };
-
   flake.wrappers.signHostWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
     options = {
       provisioner = lib.mkOption {
diff --git a/modules/nixos/lxc.nix b/modules/nixos/lxc.nix
index e96cc57..3857890 100644
--- a/modules/nixos/lxc.nix
+++ b/modules/nixos/lxc.nix
@@ -21,6 +21,7 @@
       users.users.root.shell = lib.mkForce rootShellPath;
 
       networking.nameservers = [ "192.168.1.150" ];
+      networking.dhcpcd.extraConfig = "nohook resolv.conf";
 
       # security.sudo-rs.enable = true;
       programs.nix-ld.enable = true;