john/dendritic
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ssh cert consolidation

Browse Source
This commit is contained in:
John Lancaster
2026-07-05 00:03:28 -05:00
parent b1f4b6ad41
commit a9b831a6b0
10 changed files with 39 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/instructions/step-ssh-host.instructions.md
+3 -3
View File
@@ -12,8 +12,8 @@ Use this instruction when changing the shared NixOS module in modules/services/s
- Keep this module reusable across hosts; do not hard-code host-local file paths beyond SSH system paths under /etc/ssh.
- Preserve the option interface unless the task explicitly changes it:
- step-ssh-host.hostname (required host identity used for cert principals)
- step-ssh-host.provisioner (default: "admin")
- ssh-certs.hostname (required host identity used for cert principals)
- ssh-certs.provisioner (default: "admin")
- Keep imports = [ inputs.self.modules.nixos.ssh ] so OpenSSH host certificate settings stay composed through the shared SSH module.
## Secret Key Contract
@@ -29,7 +29,7 @@ When this module is enabled by a host, the host is expected to provide:
- A working Step trust/bootstrap path (for example via janus-ca or equivalent trust material).
- `sops.defaultSopsFile` containing `janus.admin_jwk` (or equivalent if contract is intentionally changed everywhere).
- `step-ssh-host.hostname` matching deployed host identity and DNS naming expectations.
- `ssh-certs.hostname` matching deployed host identity and DNS naming expectations.
## SSH Certificate Paths And Principals