reorg

modules/features/ssh/default.nix

@@ -2,6 +2,7 @@
 { self, inputs, ... }:
 let
   caPatterns = [ "*.john-stream.com" "192.168.1.*" "fded:fb16:653e:25da:be24:11ff:*" ];
+  sshHostCAPath = ../../hosts/janus/public/ssh_host_ca_key.pub;
 in
 {
   flake.modules.nixos.ssh-new = { config, pkgs, lib, ... }:
@@ -10,10 +11,9 @@ in
       hostKeyFile = "${cfg.host.configDir}/${cfg.host.keyFile}";
       hostCertFile = "${hostKeyFile}-cert.pub";
       userCAFile = "${cfg.host.configDir}/${cfg.certificates.user.CAFile}";
-      sshHostCAContent = lib.removeSuffix "\n" (builtins.readFile ../hosts/janus/public/ssh_host_ca_key.pub);
       CAknownHosts = (lib.genAttrs caPatterns (_: {
           certAuthority = true;
-          publicKey = sshHostCAContent;
+          publicKey = lib.removeSuffix "\n" (builtins.readFile sshHostCAPath);
       }));
 
       wrappers = inputs.self.wrappers;
@@ -129,7 +129,7 @@ in
         };
 
         environment.etc."ssh/${cfg.certificates.user.CAFile}" = lib.mkIf cfg.certificates.user.enable {
-          source = ../hosts/janus/public/ssh_user_ca_key.pub;
+          source = ../../hosts/janus/public/ssh_user_ca_key.pub;
         };
 
         environment.systemPackages = (
@@ -143,7 +143,7 @@ in
 
         sops = lib.mkIf cfg.certificates.host.autoRenew {
           secrets."janus/admin_jwk" = {
-            sopsFile = ../../keys/secrets.yaml;
+            sopsFile = ../../../keys/secrets.yaml;
             owner = "root";
             group = "root";
             mode = "0400";
@@ -198,7 +198,7 @@ in
   flake.modules.homeManager.ssh-new = { config, pkgs, lib, ... }:
     let
       cfg = config.ssh-new;
-      sshHostCAContent = lib.removeSuffix "\n" (builtins.readFile ../hosts/janus/public/ssh_host_ca_key.pub);
+      sshHostCAContent = lib.removeSuffix "\n" (builtins.readFile sshHostCAPath);
       knownHostsText = lib.concatMapStrings
         (pattern: "@cert-authority ${pattern} ${sshHostCAContent}\n")
         caPatterns;

modules/features/ssh/ssh-wrappers.nix

@@ -4,38 +4,6 @@ let
     builtins.concatLists (map (principal: [ "--principal" principal ]) principals);
 in
 {
-  perSystem = { system, self', pkgs, lib, ... }: {
-    packages.ssh-certs = inputs.wrappers.lib.wrapPackage {
-      inherit pkgs;
-      package = (pkgs.symlinkJoin {
-        name = "ssh-certs";
-        meta.mainProgram = "ssh-user-cert-sign";
-        paths = [
-          (inputs.self.wrappers.signUserWrapper.apply {
-            inherit pkgs;
-            provisioner = "admin";
-            overwrite = true;
-            validUsers = [ "john" "root" "appdaemon" ];
-          }).wrapper
-
-          (inputs.self.wrappers.userCheckWrapper.apply {
-            inherit pkgs;
-          }).wrapper
-
-          (inputs.self.wrappers.signHostWrapper.apply {
-            inherit pkgs;
-            provisioner = "admin";
-            overwrite = true;
-          }).wrapper
-
-          (inputs.self.wrappers.hostCheckWrapper.apply {
-            inherit pkgs;
-          }).wrapper
-        ];
-      });
-    };
-  };
-
   flake.wrappers.signHostWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
     options = {
       provisioner = lib.mkOption {

modules/nixos/lxc.nix

@@ -21,6 +21,7 @@
       users.users.root.shell = lib.mkForce rootShellPath;
 
       networking.nameservers = [ "192.168.1.150" ];
+      networking.dhcpcd.extraConfig = "nohook resolv.conf";
 
       # security.sudo-rs.enable = true;
       programs.nix-ld.enable = true;