WIP CA bootstrap rework

modules/hosts/janus/default.nix

@@ -2,9 +2,16 @@
 let
   username = "john";
   hostname = "janus";
-  caURL = "https://janus.john-stream.com/";
 in
 {
+  flake.modules.homeManager.janus-ca = { config, ... }: {
+    home.file.".step/config/defaults.json".text = builtins.toJSON {
+      "ca-url" = "https://janus.john-stream.com/";
+      fingerprint = "2036c44f7b5901566ff7611ea6c927291ecc6d2dd00779c0eead70ec77fa10d6";
+      root = (builtins.readFile ./root_ca.crt);
+    };
+  };
+
   flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
     modules = with inputs.self.modules; [
       nixos.lxc
@@ -20,12 +27,10 @@ in
         networking.hostName = hostname;
         step-ssh-host = {
           hostname = hostname;
-          caURL = caURL;
         };
         mtls = {
           enable = true;
           subject = hostname;
-          caURL = caURL;
           san = [
             "${hostname}.john-stream.com"
             "192.168.1.244"
@@ -36,6 +41,7 @@ in
           imports = with inputs.self.modules.homeManager; [
             sops
             step-ssh-user
+            janus-ca
           ];
           
           shell.program = "zsh";

modules/hosts/janus/root_ca.crt

@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBlDCCATqgAwIBAgIRAKDvqOX8WVhJ/ev02Y1gXKQwCgYIKoZIzj0EAwIwKDEO
+MAwGA1UEChMFSmFudXMxFjAUBgNVBAMTDUphbnVzIFJvb3QgQ0EwHhcNMjUxMjE4
+MDYwMjI4WhcNMzUxMjE2MDYwMjI4WjAoMQ4wDAYDVQQKEwVKYW51czEWMBQGA1UE
+AxMNSmFudXMgUm9vdCBDQTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABMt6kNpx
+Q9vySc1N6F9jJObeQXZI+9f33E1cN4zbEuNpmtpRl0WaPa1AGNbSi5sIbiH7wDv2
+llXfCqYWkeoCE5mjRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/
+AgEBMB0GA1UdDgQWBBRo55byyyo2sePP+8zz+uM4mXNV+zAKBggqhkjOPQQDAgNI
+ADBFAiB6zxTbvWMZWgDQhKGh+MnGQQ7f8UGhzinOfRG7a/HdOAIhAIVWt6MLl6QU
+FOvl/qIFGd7YJeWU5aahPABVttxjSMn/
+-----END CERTIFICATE-----

modules/hosts/john-pc/default.nix

@@ -19,6 +19,7 @@ in
       rebuild
       john
       mysops
+      janus-ca
       step-ssh-user
       mtls
       restic
@@ -91,10 +92,6 @@ in
     mtls = {
       enable = true;
       subject = hostname;
-      ca = {
-        url = "https://janus.john-stream.com/";
-        fingerprint = "2036c44f7b5901566ff7611ea6c927291ecc6d2dd00779c0eead70ec77fa10d6";
-      };
       san = [
         "${hostname}"
         "192.168.1.85"

modules/hosts/soteria/soteria.nix

@@ -24,7 +24,6 @@ in
         ];
         step-ssh-host = {
           hostname = hostname;
-          caURL = caURL;
         };
 
         home-manager.users."${username}" = {
@@ -40,6 +39,7 @@ in
     imports = with inputs.self.modules; [
       homeManager.rebuild
       homeManager.mysops
+      homeManager.janus-ca
       homeManager.mtls
       homeManager.docker
     ];