ssh host cert working

modules/programs/step-client.nix

@@ -12,13 +12,29 @@ in
     cfg = config.step-client;
     stepBin = lib.getExe pkgs.step-cli;
     rootCertPath = "/etc/step/certs/root_ca.crt";
-    provisionerPasswordPath = config.sops.secrets."step/provisioner_password".path;
+    provisionerPasswordPath = config.sops.secrets."janus/admin_jwk".path;
     sshKeyPath = "/etc/ssh/ssh_host_ed25519_key";
-    sshCertPath = "/etc/ssh/ssh_host_ed25519_key-cert.pub";
+    sshCertPath = "${sshKeyPath}-cert.pub";
   in
   {
     # NixOS Options
     options.step-client = {
+      caURL = lib.mkOption {
+        type = lib.types.str;
+        default = "${caURL}";
+      };
+      rootCertFile = lib.mkOption {
+        type = lib.types.path;
+        description = "Public Step root CA certificate file from the repo.";
+        default = ../../keys/root_ca.crt;
+      };
+      sshHostProvisioner = lib.mkOption {
+        type = lib.types.str;
+        default = "admin";
+      };
+      hostname = lib.mkOption {
+        type = lib.types.str;
+      };
     };
 
     imports = with inputs.self.modules.nixos; [ ssh ];
@@ -28,15 +44,32 @@ in
       home-manager.sharedModules = with inputs.self.modules; [
         homeManager.step-client
       ];
-      sops.secrets."janus/fingerprint" = { };
+
+      sops.secrets."janus/admin_jwk" = {
+        owner = "root";
+        group = "root";
+        mode = "0400";
+      };
+
+      environment.etc."step/certs/root_ca.crt".source = cfg.rootCertFile;
+
       environment.systemPackages = with pkgs; [
-        (writeShellScriptBin "step-bootstrap" ''
-          set -euo pipefail
-          step ca bootstrap --ca-url ${caURL} --fingerprint ${stepFingerprint}
+        step-cli
+        (writeShellScriptBin "ssh-host-cert-renew" ''
+          ${lib.getExe pkgs.step-cli} ssh certificate \
+          --host --sign \
+          --root "${rootCertPath}" \
+          --ca-url ${cfg.caURL} \
+          --provisioner "${cfg.sshHostProvisioner}" \
+          --provisioner-password-file "${provisionerPasswordPath}" \
+          --principal "${cfg.hostname}" \
+          --principal "${cfg.hostname}.john-stream.com" \
+          "${cfg.hostname}" "${sshKeyPath}.pub"
         '')
       ];
       networking.nameservers = [ "192.168.1.150" ];
       networking.dhcpcd.extraConfig = "nohook resolv.conf";
+
     };
   };
 
@@ -49,8 +82,8 @@ in
   in
   {
     options.step-client = {
-      enable = lib.mkEnableOption "opionated step client config";
-      caUrl = lib.mkOption {
+      enable = lib.mkEnableOption "opionated step client config for SSH certs";
+      caURL = lib.mkOption {
         type = lib.types.str;
         default = "${caURL}";
       };
@@ -58,12 +91,25 @@ in
         type = lib.types.str;
         default = "${stepFingerprint}";
       };
+      rootCertFile = {
+        path = lib.mkOption {
+          type = lib.types.str;
+          description = "Path to where the root_ca.crt file will be stored for the user";
+          default = "${config.home.homeDirectory}/.step/certs/root_ca.crt";
+        };
+        source = lib.mkOption {
+          type = lib.types.path;
+          description = "Nix path to the root cert file within the repo";
+          default = ../../keys/root_ca.crt;
+        };
+      };
     };
-    config = {
+    config = lib.mkIf cfg.enable {
+      home.file.".step/certs/root_ca.crt".source = cfg.rootCertFile;
       home.file.".step/config/defaults.json".text = builtins.toJSON {
-        "ca-url" = cfg.caUrl;
+        "ca-url" = cfg.caURL;
         fingerprint = cfg.fingerprint;
-        root = "${config.home.homeDirectory}/.step/certs/root_ca.crt";
+        root = "${cfg.rootCertFile.path}";
       };
     };
   };