WIP janus secrets

modules/hosts/janus/README.md

@@ -5,6 +5,13 @@ Generate passwords:
 mkdir -p /tmp/janus-step-ca-bootstrap && chmod 700 /tmp/janus-step-ca-bootstrap && cd /tmp/janus-step-ca-bootstrap && umask 077 && openssl rand -base64 48 > ca_password.txt && openssl rand -base64 48 > admin_jwk_password.txt
 ```
 
+Generate the Janus OpenSSH host key that Nix will materialize from SOPS at
+`/etc/ssh/ssh_host_ed25519_key`:
+
+```shell
+ssh-keygen -t ed25519 -N '' -C [email protected] -f /tmp/janus-step-ca-bootstrap/ssh_host_ed25519_key
+```
+
 Bootstrap CA materials with SSH enabled:
 ```shell
 STEPPATH=/tmp/janus-step-ca-bootstrap/step step ca init --name Janus --dns janus.john-stream.com --dns 192.168.1.244 --address :443 --provisioner admin --password-file /tmp/janus-step-ca-bootstrap/ca_password.txt --provisioner-password-file /tmp/janus-step-ca-bootstrap/admin_jwk_password.txt --ssh --deployment-type standalone --with-ca-url https://janus.john-stream.com
@@ -17,9 +24,24 @@ Insert generated runtime CA material into `modules/hosts/janus/secrets.yaml` und
 - `/tmp/janus-step-ca-bootstrap/step/secrets/ssh_host_ca_key` -> `ssh_host_ca_key`
 - `/tmp/janus-step-ca-bootstrap/step/secrets/ssh_user_ca_key` -> `ssh_user_ca_key`
 - `/tmp/janus-step-ca-bootstrap/step/config/ca.json` -> `admin_provisioner_encrypted_key` (copy `authority.provisioners[].encryptedKey` for the `admin` JWK provisioner)
+- `/tmp/janus-step-ca-bootstrap/ssh_host_ed25519_key` -> `ssh_host_ed25519_key`
 
 If you are only validating wiring first, `admin_provisioner_encrypted_key` can be an encrypted placeholder and replaced later.
 
+The checked-in `ssh_host_ed25519_key` value is also only an encrypted placeholder.
+Replace it before deploying Janus, otherwise OpenSSH and SSH host certificate
+issuance will fail because the materialized host key is not a valid private key.
+
+For multiline secret values, avoid putting private key contents in shell history.
+One safe non-interactive pattern is to JSON-encode the file content and pass that
+temporary JSON file to `sops set --value-file`:
+
+```shell
+jq -Rs . /tmp/janus-step-ca-bootstrap/ssh_host_ed25519_key > /tmp/janus-step-ca-bootstrap/ssh_host_ed25519_key.json
+sops --config .sops.yaml set --value-file modules/hosts/janus/secrets.yaml '["janus"]["ssh_host_ed25519_key"]' /tmp/janus-step-ca-bootstrap/ssh_host_ed25519_key.json
+rm -f /tmp/janus-step-ca-bootstrap/ssh_host_ed25519_key.json
+```
+
 If rotating provisioner password, also set:
 
 - `/tmp/janus-step-ca-bootstrap/admin_jwk_password.txt` -> `janus.admin_jwk` in `keys/secrets.yaml`
@@ -27,6 +49,7 @@ If rotating provisioner password, also set:
 Secret source-of-truth after this split:
 
 - `modules/hosts/janus/secrets.yaml`: Janus runtime CA secrets (`ca_password`, `intermediate_ca_key`, `ssh_host_ca_key`, `ssh_user_ca_key`, `admin_provisioner_encrypted_key`)
+- `modules/hosts/janus/secrets.yaml`: Janus OpenSSH host private key (`ssh_host_ed25519_key`) materialized to `/etc/ssh/ssh_host_ed25519_key`
 - `keys/secrets.yaml`: shared Janus provisioner secret (`janus.admin_jwk`) consumed by `step-ssh-host` across hosts
 
 Then update public artifacts in repo from generated output:
@@ -38,6 +61,26 @@ Then update public artifacts in repo from generated output:
 	step certificate fingerprint /tmp/janus-step-ca-bootstrap/step/certs/root_ca.crt
 	```
 - `modules/hosts/janus/ssh_user_ca_key.pub` from `/tmp/janus-step-ca-bootstrap/step/certs/ssh_user_ca_key.pub`
+- `modules/hosts/janus/ssh_host_ca_key.pub` from `/tmp/janus-step-ca-bootstrap/step/certs/ssh_host_ca_key.pub`
+
+## First boot checks
+
+After switching Janus, verify the declarative bootstrap units instead of running
+ad hoc issuance commands first:
+
+```shell
+systemctl status step-ca.service
+systemctl status step-ssh-host-renew.service
+systemctl status step-ssh-host-renew.timer
+systemctl status mtls-bootstrap.service
+ssh-host-cert-check
+mtls-check
+```
+
+`step-ssh-host-renew.service` issues the SSH host certificate when it is missing
+or expiring. `mtls-bootstrap.service` issues the first Janus mTLS bundle
+only when the configured certificate files are absent or invalid; recurring mTLS
+renewal remains handled by `mtls-renew.timer`.
 
 ## Back up the root CA key offline