WIP SSH cert wrappers

modules/features/ssh-certs.nix

@@ -42,6 +42,9 @@ in
         type = lib.types.nullOr lib.types.str;
         default = "admin";
       };
+      provisionerPasswordFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+      };
       extraPrincipals = lib.mkOption {
         type = lib.types.listOf lib.types.str;
         default = [ ];
@@ -73,6 +76,9 @@ in
           "--principal" "$IP_ADDRESS"
         ]
         ++ lib.optionals (config.provisioner != null) [ "--provisioner" "${config.provisioner}" ]
+        ++ lib.optionals (config.provisionerPasswordFile != null) [
+          "--provisioner-password-file" "${config.provisionerPasswordFile}"
+        ]
         ++ lib.optionals config.overwrite [ "-f" ]
         ++ mkPrincipalArgs config.extraPrincipals;
       postHook = ''
@@ -81,6 +87,25 @@ in
     };
   });
 
+  flake.wrappers.renewHostWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
+    options = {
+      sshHostKeyFile = lib.mkOption {
+        type = lib.types.str;
+        default = "/etc/ssh/ssh_host_ed25519_key";
+      };
+      overwrite = lib.mkEnableOption "Overwrite existing cert file?";
+    };
+
+    config = {
+      binName = "ssh-host-cert-renew";
+      package = config.pkgs.step-cli;
+      extraPackages = with config.pkgs; [ systemd ];
+      args =
+        [ "ssh" "renew" "${config.sshHostKeyFile}-cert.pub" "${config.sshHostKeyFile}" ]
+        ++ lib.optionals config.overwrite [ "-f" ];
+    };
+  });
+
   flake.wrappers.hostCheckWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
     options = {
       certPath = lib.mkOption {
@@ -136,4 +161,28 @@ in
       args = [ "-Lf" "${config.certPath}" ];
     };
   });
+
+  flake.wrappers.renewalCheck = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
+    options = {
+      certPath = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = "$HOME/.ssh/id_ed25519-cert.pub";
+      };
+      expires-in = lib.mkOption {
+        type = lib.types.str;
+        default = "4h";
+      };
+    };
+    config = {
+      binName = "ssh-renewal-check";
+      package = config.pkgs.step-cli;
+      preHook = ''
+        echo "Checking SSH cert at ${config.certPath}"
+      '';
+      args = [
+        "ssh" "needs-renewal" "${config.certPath}"
+        "--expires-in" "${config.expires-in}"
+      ];
+    };
+  });
 }

modules/hosts/janus/default.nix

@@ -25,8 +25,8 @@ in
         };
         sops.defaultSopsFile = ./secrets.yaml;
         ssh-certs = {
-          hostname = hostname;
+          provisioner = "admin";
-          extraPrincipals = [ ipv4 ipv6 ];
+          extraPrincipals = [ "janus.john-stream.com" ipv4 ipv6 ];
         };
         step-ca = {
           rootCertPath = ./root_ca.crt;

modules/services/step-ca/ssh-host.nix

@@ -2,41 +2,33 @@
   flake.modules.nixos.ssh-certs = { config, pkgs, lib, ... }:
   let
     cfg = config.ssh-certs;
-    provisionerPasswordPath = config.sops.secrets."janus/admin_jwk".path;
+    wrappers = inputs.self.wrappers;
     sshKeyPath = "/etc/ssh/ssh_host_ed25519_key";
     sshCertPath = "${sshKeyPath}-cert.pub";
-    mkPrincipalArgs = principals:
-      lib.concatMapStringsSep " " (principal: ''--principal "${principal}"'') principals;
-    principalArgs = mkPrincipalArgs ([
-      cfg.hostname
-      "${cfg.hostname}.john-stream.com"
-    ] ++ cfg.extraPrincipals);
-    sshHostCertRenew = pkgs.writeShellScriptBin "ssh-host-cert-renew" ''
-      set -euo pipefail
 
-      if [ ! -s "${sshKeyPath}.pub" ]; then
+    sshHostCertSign = (wrappers.signHostWrapper.apply {
-        ${lib.getExe' pkgs.openssh "ssh-keygen"} -y -f "${sshKeyPath}" > "${sshKeyPath}.pub"
+      inherit pkgs;
-        chmod 0644 "${sshKeyPath}.pub"
+      inherit (cfg) provisioner extraPrincipals;
-      fi
+      provisionerPasswordFile = config.sops.secrets."janus/admin_jwk".path;
-
+    }).wrapper;
-      ${lib.getExe pkgs.step-cli} ssh certificate \
+    sshHostCertRenew = (wrappers.renewHostWrapper.apply {
-        --host --sign \
+      inherit pkgs;
-        --provisioner "${cfg.provisioner}" \
+      sshHostKeyFile = sshKeyPath;
-        --provisioner-password-file "${provisionerPasswordPath}" \
+      overwrite = true;
-        ${principalArgs} \
+    }).wrapper;
-        "${cfg.hostname}" "${sshKeyPath}.pub"
+    sshHostCertCheck = (wrappers.hostCheckWrapper.apply {
-    '';
+      inherit pkgs;
-    sshHostCertCheck = pkgs.writeShellScriptBin "ssh-host-cert-check" ''
+      certPath = sshCertPath;
-      ${lib.getExe' pkgs.openssh "ssh-keygen"} -Lf ${sshCertPath}
+    }).wrapper;
-    '';
+    sshHostRenewalCheck = (wrappers.renewalCheck.apply {
+      inherit pkgs;
+      certPath = sshCertPath;
+      expires-in = "4h";
+    }).wrapper;
   in
   {
     # NixOS Options
     options.ssh-certs = {
-      hostname = lib.mkOption {
-        description = "Networking host name to register with the CA";
-        type = lib.types.str;
-      };
       provisioner = lib.mkOption {
         description = "Provisioner inside Step CA to use for the SSH certificates";
         type = lib.types.str;
@@ -64,59 +56,30 @@
       networking.nameservers = [ "192.168.1.150" ];
       networking.dhcpcd.extraConfig = "nohook resolv.conf";
       environment.systemPackages = [
+        sshHostCertSign
         sshHostCertRenew
+        sshHostRenewalCheck
         sshHostCertCheck
       ];
 
       systemd.services.ssh-certs-renew = {
-        description = "Renew Step SSH host certificate if needed";
+        description = "SSH host certificate renewal";
         wantedBy = [ "multi-user.target" ];
-        before = [ "sshd.service" ];
         after = [ "network-online.target" ];
         wants = [ "network-online.target" ];
-        path = with pkgs; [ coreutils systemd step-cli openssh ];
+        path = with pkgs; [ step-cli systemd ];
         serviceConfig = {
           Type = "oneshot";
           User = "root";
           Group = "root";
+          ExecCondition = lib.getExe sshHostRenewalCheck;
+          ExecStart = lib.getExe sshHostCertRenew;
         };
-        script = ''
-          set -euo pipefail
-
-          renew=0
-          if [ ! -s "${sshCertPath}" ]; then
-            echo "SSH host cert missing: ${sshCertPath}"
-            renew=1
-          elif ${lib.getExe pkgs.step-cli} ssh needs-renewal "${sshCertPath}" --expires-in "4h"; then
-            echo "SSH host cert needs renewal"
-            renew=1
-          else
-            rc=$?
-            if [ "$rc" -eq 1 ]; then
-              echo "SSH host cert does not need renewal"
-              exit 0
-            fi
-
-            if [ "$rc" -eq 2 ]; then
-              echo "SSH host cert missing or unreadable: ${sshCertPath}"
-              renew=1
-            else
-              echo "step ssh needs-renewal failed with rc=$rc" >&2
-              exit "$rc"
-            fi
-          fi
-
-          if [ "$renew" -eq 1 ]; then
-            ${lib.getExe sshHostCertRenew}
-            ${lib.getExe sshHostCertCheck}
-          fi
-        '';
       };
 
       systemd.timers.ssh-certs-renew = {
         description = "Periodic Step SSH host certificate renewal";
         wantedBy = [ "timers.target" ];
-
         timerConfig = {
           OnBootSec = "5m";
           OnUnitActiveSec = "4h";
@@ -125,10 +88,6 @@
           Unit = "ssh-certs-renew.service";
         };
       };
-
-      # Ensure sshd waits for a cert reconciliation attempt at boot.
-      systemd.services.sshd.wants = [ "ssh-certs-renew.service" ];
-      systemd.services.sshd.after = [ "ssh-certs-renew.service" ];
     };
   };
 }