diff --git a/modules/services/ssh.nix b/modules/services/ssh.nix
deleted file mode 100644
index 7625887..0000000
--- a/modules/services/ssh.nix
+++ /dev/null
@@ -1,248 +0,0 @@
-{ inputs, ... }:
-let
-  sshHostCAPubKeyPath = ../hosts/janus/public/ssh_host_ca_key.pub;
-in
-{
-  flake.modules.nixos.ssh = { config, pkgs, lib, ... }:
-  let
-    cfg = config.ssh;
-    configDir = "/etc/ssh";
-    sshHostCAPubKey = lib.removeSuffix "\n" (builtins.readFile sshHostCAPubKeyPath);
-  in
-  {
-    options.ssh = {
-      hostKey = lib.mkOption {
-        description = "String path to the host private key file";
-        type = lib.types.str;
-        default = "ssh_host_ed25519_key";
-      };
-      hostKeyType = lib.mkOption {
-        description = "OpenSSH host key type for ssh.hostKey.";
-        type = lib.types.enum [ "ed25519" "rsa" "ecdsa" ];
-        default = "ed25519";
-      };
-      fallbackHostKeys = lib.mkOption {
-        description = "Additional non-certificate host keys that keep sshd reachable during certificate bootstrap.";
-        type = with lib.types; listOf (submodule {
-          options = {
-            path = lib.mkOption {
-              description = "Path to the host private key file.";
-              type = str;
-            };
-            type = lib.mkOption {
-              description = "OpenSSH host key type.";
-              type = enum [ "ed25519" "rsa" "ecdsa" ];
-            };
-          };
-        });
-        default = [
-          {
-            path = "${configDir}/ssh_host_rsa_key";
-            type = "rsa";
-          }
-        ];
-      };
-      certificates = {
-        enable = lib.mkEnableOption "Enable SSH host certificates";
-        userCA = lib.mkOption {
-          description = "Content for the SSH user CA file (public key)";
-          type = lib.types.path;
-          default = sshHostCAPubKeyPath;
-        };
-        userCAFile = lib.mkOption {
-          description = "String path to the SSh user CA";
-          type = lib.types.str;
-          default = "ssh_user_ca_key.pub";
-        };
-      };
-    };
-
-    config = {
-      services.openssh = {
-        enable = true;
-        hostKeys = cfg.fallbackHostKeys ++ [
-          {
-            path = "${configDir}/${cfg.hostKey}";
-            type = cfg.hostKeyType;
-          }
-        ];
-        # require public key authentication for better security
-        settings = lib.mkMerge [
-          {
-            PasswordAuthentication = false;
-            KbdInteractiveAuthentication = false;
-          }
-          (lib.mkIf cfg.certificates.enable {
-            TrustedUserCAKeys = "${configDir}/${cfg.certificates.userCAFile}";
-            HostCertificate = "${configDir}/${cfg.hostKey}-cert.pub";
-          })
-        ];
-      };
-
-      environment.etc."ssh/${cfg.certificates.userCAFile}" = lib.mkIf cfg.certificates.enable {
-        source = cfg.certificates.userCA;
-      };
-
-      programs.ssh.knownHosts = lib.mkIf cfg.certificates.enable {
-        "192.168.1.*" = {
-          certAuthority = true;
-          publicKey = sshHostCAPubKey;
-        };
-        "*.john-stream.com" = {
-          certAuthority = true;
-          publicKey = sshHostCAPubKey;
-        };
-      };
-    };
-  };
-
-  flake.modules.homeManager.ssh = { config, pkgs, lib, ... }:
-  let
-    cfg = config.ssh;
-    configDir = "${config.home.homeDirectory}/.ssh";
-    identityFile = cfg.identityFile;
-    publicKeyFile = "${identityFile}.pub";
-    certificateFile = "${identityFile}-cert.pub";
-    sshHostCAPubKey = lib.removeSuffix "\n" (builtins.readFile sshHostCAPubKeyPath);
-  in
-  {
-    options.ssh = with lib; {
-      identityFile = mkOption {
-        # Intentionally not using a path type here because that will end up with the private key getting copied into the store
-        type = types.str;
-        default = "${config.home.homeDirectory}/.ssh/id_ed25519";
-        description = "Path to the SSH identity file.";
-      };
-
-      certificates = {
-        enable = mkEnableOption "Enable SSH client certificates";
-      };
-
-      knownHostsFile = mkOption {
-        type = types.str;
-        default = "${configDir}/known_hosts";
-      };
-
-      knownHosts = mkOption {
-        description = "";
-        type = types.listOf types.str;
-        default = [ ];
-      };
-
-      matchSets = {
-        appdaemon = mkEnableOption "Enable AppDaemon SSH targets";
-        certs = mkEnableOption "Enable Janus and Soteria SSH targets";
-        homelab = mkEnableOption "Enable various Homelab targets";
-        dev = mkEnableOption "Enable development targets";
-        tailscale = mkEnableOption "Enable tailscale targets";
-      };
-    };
-
-    config = {
-      home.file.".ssh/known_hosts" = {
-        text = lib.concatStringsSep "\n" (
-          cfg.knownHosts ++ lib.optionals cfg.certificates.enable [
-            "@cert-authority 192.168.1.* ${sshHostCAPubKey}"
-            "@cert-authority *.john-stream.com ${sshHostCAPubKey}"
-          ]
-        );
-      };
-
-      programs.ssh = {
-        enable = true;
-        enableDefaultConfig = false;
-        extraConfig = ''
-          SetEnv TERM="xterm-256color"
-        '';
-
-        settings = lib.mkMerge [
-          {
-            "john-pc-ubuntu" = {
-              HostName = "192.168.1.85";
-            };
-
-            "*" = lib.mkMerge [
-              {
-                User = "john";
-                IdentityAgent = "${config.home.homeDirectory}/.1password/agent.sock";
-
-                Compression = false;
-                ServerAliveInterval = 0;
-                ServerAliveCountMax = 3;
-
-                IdentitiesOnly = true;
-                IdentityFile = identityFile;
-
-                HashKnownHosts = false;
-                UserKnownHostsFile = cfg.knownHostsFile;
-
-                AddKeysToAgent = "yes";
-                ForwardAgent = false;
-              }
-              (lib.mkIf cfg.certificates.enable { CertificateFile = certificateFile; })
-            ];
-          }
-          (lib.mkIf cfg.matchSets.appdaemon {
-            "appdaemon" = {
-              HostName = "192.168.1.242";
-              User = "appdaemon";
-            };
-            "ad-nix" = {
-              HostName = "192.168.1.201";
-              User = "appdaemon";
-            };
-          })
-          (lib.mkIf cfg.matchSets.certs {
-            "janus" = {
-              HostName = "fded:fb16:653e:25da:be24:11ff:fe6b:4d57";
-              User = "root";
-            };
-            "soteria" = {
-              HostName = "soteria.john-stream.com";
-              User = "john";
-            };
-          })
-          (lib.mkIf cfg.matchSets.homelab {
-            "docs" = {
-              HostName = "192.168.1.110";
-              User = "root";
-              RequestTTY = "force";
-              RemoteCommand = "~/.nix-profile/bin/jsl-zsh";
-            };
-            "gitea" = {
-              HostName = "192.168.1.104";
-              User = "john";
-            };
-            "hermes" = {
-              HostName = "192.168.1.150";
-              User = "root";
-              # Enabling this breaks the ability of Zed to install its remote stuff
-              # RequestTTY = "force";
-              # RemoteCommand = "/root/.nix-profile/bin/jsl-zsh";
-            };
-            "panoptes" = {
-              HostName = "192.168.1.107";
-              User = "panoptes";
-            };
-          })
-          (lib.mkIf cfg.matchSets.dev {
-            "test-nix" = {
-              HostName = "fded:fb16:653e:25da:be24:11ff:fea0:753f";
-              User = "john";
-              RequestTTY = "auto";
-              # RemoteCommand = "/run/current-system/sw/bin/jsl-zsh";
-            };
-          })
-          (lib.mkIf cfg.matchSets.tailscale {
-            "jdl-docker" = {
-              HostName = "jdl-docker.tailcf205.ts.net";
-              User = "john";
-              RequestTTY = "auto";
-              # RemoteCommand = "~/.nix-profile/bin/jsl-zsh";
-            };
-          })
-        ];
-      };
-    };
-  };
-}