ssh cert consolidation

.github/instructions/janus-host.instructions.md

@@ -24,7 +24,7 @@ When editing `modules/hosts/janus/default.nix`, preserve this composition unless
 - `nixos.mysops` with `sops.defaultSopsFile = ./secrets.yaml` for host-local encrypted CA runtime material.
 - `nixos.step-ca` to run the CA daemon and render `/etc/smallstep/ca.json` from Nix plus SOPS paths.
 - `nixos.step-client` to install Step trust bootstrap defaults and root CA material.
-- `nixos.step-ssh-host` so Janus itself participates in SSH host certificate flow.
+- `nixos.ssh-certs` so Janus itself participates in SSH host certificate flow.
 - `nixos.mtls` so Janus can issue and renew its own mTLS certificate bundle.
 
 ## Step CA Deployment Pattern
@@ -83,7 +83,7 @@ Start with the smallest check that matches the change:
 4. Rendered config: on the host, inspect `/etc/smallstep/ca.json` or `/etc/step-ca` paths without copying secret content into logs.
 5. Service health: check `systemctl status step-ca.service`, `journalctl -u step-ca.service`, and `step ca health --ca-url https://janus.john-stream.com` after trust is bootstrapped.
 6. Provisioners: use `step ca provisioner list` to confirm ACME, SSHPOP, and admin JWK availability.
-7. SSH cert flow: use `ssh-host-cert-check`, `systemctl status step-ssh-host-renew.service`, and `systemctl status step-ssh-host-renew.timer`.
+7. SSH cert flow: use `ssh-host-cert-check`, `systemctl status ssh-certs-renew.service`, and `systemctl status ssh-certs-renew.timer`.
 8. mTLS flow: use `mtls-check`, `mtls-generate`, and `systemctl status mtls-renew.timer` for host certificate renewal issues.
 
 ## Change Safety Rules

.github/instructions/soteria-host.instructions.md

@@ -19,31 +19,31 @@ Use this instruction when changing Soteria host wiring in `modules/hosts/soteria
 
 When editing `modules/hosts/soteria/default.nix`, preserve this composition unless the task explicitly changes architecture:
 
-- Import `nixos.step-ssh-host` to enable host SSH cert integration.
+- Import `nixos.ssh-certs` to enable host SSH cert integration.
 - Import `nixos.janus-ca` so Step client trust material and defaults remain available.
 - Import `nixos.restic-server` so the RESTic REST server implementation lives in the shared module rather than inline host wiring.
-- Keep `step-ssh-host.hostname = hostname;` so cert principals match host naming.
+- Keep `ssh-certs.hostname = hostname;` so cert principals match host naming.
 
 ## SSH Cert Mechanics On Soteria
 
 Soteria SSH certificate behavior is the result of multiple modules. Keep this flow intact:
 
-1. `soteria/default.nix` imports `nixos.step-ssh-host` and sets `step-ssh-host.hostname = "soteria"` (via `hostname`).
+1. `soteria/default.nix` imports `nixos.ssh-certs` and sets `ssh-certs.hostname = "soteria"` (via `hostname`).
 2. `modules/services/step-ca/ssh-host.nix`:
    - Enables `ssh.certificates.enable = true`.
    - Requires `sops.secrets."janus/admin_jwk"` (provisioner credential) from Soteria's `secrets.yaml`.
    - Defines cert paths at `/etc/ssh/ssh_host_ed25519_key` and `/etc/ssh/ssh_host_ed25519_key-cert.pub`.
    - Exposes `ssh-host-cert-renew` and `ssh-host-cert-check` helper binaries.
-   - Schedules `step-ssh-host-renew.timer` every 4h with jitter.
+   - Schedules `ssh-certs-renew.timer` every 4h with jitter.
 3. `modules/services/ssh.nix` consumes `ssh.certificates.enable` and configures OpenSSH to:
-   - Set `TrustedUserCAKeys = /etc/ssh/ssh_user_ca.pub`.
+   - Set `TrustedUserCAKeys = /etc/ssh/ssh_user_ca_key.pub`.
    - Set `HostCertificate = /etc/ssh/ssh_host_ed25519_key-cert.pub`.
-   - Install the trusted user CA file into `/etc/ssh/ssh_user_ca.pub`.
+   - Install the trusted user CA file into `/etc/ssh/ssh_user_ca_key.pub`.
 4. `nixos.janus-ca` provides Step CA trust bootstrapping (`/etc/step-ca/defaults.json` and linked root CA material), allowing Step CLI operations to trust and reach the CA endpoint.
 
 Current implementation note:
 
-- `step-ssh-host-renew.service` currently checks renewal state via `step ssh needs-renewal` and logs status. It does not directly invoke `ssh-host-cert-renew` in the service script. Preserve this behavior unless the task explicitly asks to change renewal execution semantics.
+- `ssh-certs-renew.service` currently checks renewal state via `step ssh needs-renewal` and logs status. It does not directly invoke `ssh-host-cert-renew` in the service script. Preserve this behavior unless the task explicitly asks to change renewal execution semantics.
 
 ## SOPS/Secrets Mechanics On Soteria
 
@@ -135,5 +135,5 @@ Current implementation note:
 
 - Do not rename the secret key `janus/admin_jwk` without updating all consumers.
 - Do not change SSH host key/cert filenames unless OpenSSH `HostKey`/`HostCertificate` paths are updated together.
-- If changing hostnames or domains, update cert principals in `step-ssh-host` and corresponding SSH client targets together.
-- If adding or removing `nixos.step-ssh-host`, explain impact on SSH cert issuance, renewal, and trust in the change summary.
+- If changing hostnames or domains, update cert principals in `ssh-certs` and corresponding SSH client targets together.
+- If adding or removing `nixos.ssh-certs`, explain impact on SSH cert issuance, renewal, and trust in the change summary.

.github/instructions/step-ssh-host.instructions.md

@@ -12,8 +12,8 @@ Use this instruction when changing the shared NixOS module in modules/services/s
 
 - Keep this module reusable across hosts; do not hard-code host-local file paths beyond SSH system paths under /etc/ssh.
 - Preserve the option interface unless the task explicitly changes it:
-  - step-ssh-host.hostname (required host identity used for cert principals)
-  - step-ssh-host.provisioner (default: "admin")
+  - ssh-certs.hostname (required host identity used for cert principals)
+  - ssh-certs.provisioner (default: "admin")
 - Keep imports = [ inputs.self.modules.nixos.ssh ] so OpenSSH host certificate settings stay composed through the shared SSH module.
 
 ## Secret Key Contract
@@ -29,7 +29,7 @@ When this module is enabled by a host, the host is expected to provide:
 
 - A working Step trust/bootstrap path (for example via janus-ca or equivalent trust material).
 - `sops.defaultSopsFile` containing `janus.admin_jwk` (or equivalent if contract is intentionally changed everywhere).
-- `step-ssh-host.hostname` matching deployed host identity and DNS naming expectations.
+- `ssh-certs.hostname` matching deployed host identity and DNS naming expectations.
 
 ## SSH Certificate Paths And Principals