WIP janus secrets

modules/hosts/janus/default.nix

@@ -16,9 +16,20 @@ in
       nixos.docker
       nixos.login-text
       nixos.mtls
-      ({ lib, pkgs, ... }: {
+      ({ config, lib, pkgs, ... }: {
         networking.hostName = hostname;
+        loginText.extraServiceStatus = {
+          "Step-CA" = "step-ca";
+        };
         sops.defaultSopsFile = ./secrets.yaml;
+        sops.secrets."janus/ssh_host_ed25519_key" = {
+          sopsFile = ./secrets.yaml;
+          owner = "root";
+          group = "root";
+          mode = "0600";
+          path = "/etc/ssh/ssh_host_ed25519_key";
+          restartUnits = [ "sshd.service" "step-ssh-host-renew.service" ];
+        };
         step-ssh-host = {
           hostname = hostname;
           extraPrincipals = [
@@ -49,6 +60,12 @@ in
             "${hostname}.john-stream.com"
             "192.168.1.244"
           ];
+          bootstrap = {
+            enable = true;
+            after = [ "network-online.target" "sops-nix.service" "step-ca.service" ];
+            wants = [ "network-online.target" "step-ca.service" ];
+            provisionerPasswordFile = config.sops.secrets."janus/admin_jwk".path;
+          };
         };
 
         users.users."${username}" = {