WIP SSH cert wrappers

modules/features/ssh-certs.nix

@@ -42,6 +42,9 @@ in
         type = lib.types.nullOr lib.types.str;
         default = "admin";
       };
+      provisionerPasswordFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+      };
       extraPrincipals = lib.mkOption {
         type = lib.types.listOf lib.types.str;
         default = [ ];
@@ -73,6 +76,9 @@ in
           "--principal" "$IP_ADDRESS"
         ]
         ++ lib.optionals (config.provisioner != null) [ "--provisioner" "${config.provisioner}" ]
+        ++ lib.optionals (config.provisionerPasswordFile != null) [
+          "--provisioner-password-file" "${config.provisionerPasswordFile}"
+        ]
         ++ lib.optionals config.overwrite [ "-f" ]
         ++ mkPrincipalArgs config.extraPrincipals;
       postHook = ''
@@ -81,6 +87,25 @@ in
     };
   });
 
+  flake.wrappers.renewHostWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
+    options = {
+      sshHostKeyFile = lib.mkOption {
+        type = lib.types.str;
+        default = "/etc/ssh/ssh_host_ed25519_key";
+      };
+      overwrite = lib.mkEnableOption "Overwrite existing cert file?";
+    };
+
+    config = {
+      binName = "ssh-host-cert-renew";
+      package = config.pkgs.step-cli;
+      extraPackages = with config.pkgs; [ systemd ];
+      args =
+        [ "ssh" "renew" "${config.sshHostKeyFile}-cert.pub" "${config.sshHostKeyFile}" ]
+        ++ lib.optionals config.overwrite [ "-f" ];
+    };
+  });
+
   flake.wrappers.hostCheckWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
     options = {
       certPath = lib.mkOption {
@@ -136,4 +161,28 @@ in
       args = [ "-Lf" "${config.certPath}" ];
     };
   });
+
+  flake.wrappers.renewalCheck = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
+    options = {
+      certPath = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = "$HOME/.ssh/id_ed25519-cert.pub";
+      };
+      expires-in = lib.mkOption {
+        type = lib.types.str;
+        default = "4h";
+      };
+    };
+    config = {
+      binName = "ssh-renewal-check";
+      package = config.pkgs.step-cli;
+      preHook = ''
+        echo "Checking SSH cert at ${config.certPath}"
+      '';
+      args = [
+        "ssh" "needs-renewal" "${config.certPath}"
+        "--expires-in" "${config.expires-in}"
+      ];
+    };
+  });
 }