WIP with placeholder secrets

modules/hosts/janus/default.nix

@@ -4,55 +4,13 @@ let
   hostname = "janus";
 in
 {
-  flake.modules.nixos.janus-ca =
-    { config, pkgs, lib, ... }:
-    let
-      cfg = config.janus-ca;
-      johnHome = lib.attrByPath [ "users" "users" username "home" ] "/home/${username}" config;
-      johnGroup = lib.attrByPath [ "users" "users" username "group" ] username config;
-      cfgInEtc = lib.hasPrefix "/etc/" cfg.certDir;
-      certDirEtcPath =
-        if cfgInEtc then
-          lib.removePrefix "/etc/" cfg.certDir
-        else
-          cfg.certDir;
-      mkStepRules = home: user: group: [
-        "d ${home}/.step 0700 ${user} ${group} -"
-        "d ${home}/.step/config 0700 ${user} ${group} -"
-        "d ${home}/.step/certs 0700 ${user} ${group} -"
-        "L+ ${home}/.step/config/defaults.json - - - - /etc/step-ca/defaults.json"
-        "L+ ${home}/.step/certs/root_ca.crt - - - - ${cfg.certDir}/root_ca.crt"
-      ];
-    in
-    {
-      options.janus-ca = {
-        certDir = lib.mkOption {
-          description = "String path to where the mtls certs will be stored.";
-          type = lib.types.str;
-          default = "/etc/step-ca/certs";
-        };
-      };
-
-      config = {
-        environment.etc = lib.mkIf cfgInEtc {
-          "step-ca/defaults.json".text = builtins.toJSON {
-            ca-url = "https://janus.john-stream.com/";
-            fingerprint = "2036c44f7b5901566ff7611ea6c927291ecc6d2dd00779c0eead70ec77fa10d6";
-            root = ./root_ca.crt;
-          };
-        };
-        systemd.tmpfiles.rules =
-          mkStepRules johnHome username johnGroup
-          ++ mkStepRules "/root" "root" "root";
-      };
-    };
-
   flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
     modules = with inputs.self.modules; [
       nixos.lxc
       nixos.mysops
       nixos.step-ssh-host
-      nixos.janus-ca
+      nixos.step-client
+      nixos.step-ca
       inputs.home-manager.nixosModules.home-manager
       nixos."${username}"
       nixos.docker
@@ -60,7 +18,7 @@ in
       nixos.mtls
       ({ lib, pkgs, ... }: {
         networking.hostName = hostname;
-        sops.defaultSopsFile = ../../../keys/secrets.yaml;
+        sops.defaultSopsFile = ./secrets.yaml;
         step-ssh-host = {
           hostname = hostname;
           extraPrincipals = [
@@ -90,6 +48,7 @@ in
         home-manager.users."${username}" = {
           imports = with inputs.self.modules.homeManager; [
             mysops
+            step-client
           ];
           docker.enable = true;
         };