ssh cert consolidation

modules/hosts/janus/README.md

@@ -34,7 +34,7 @@ If rotating provisioner password, also set:
 Secret source-of-truth after this split:
 
 - `modules/hosts/janus/secrets.yaml`: Janus runtime CA secrets (`ca_password`, `intermediate_ca_key`, `ssh_host_ca_key`, `ssh_user_ca_key`, `admin_provisioner_encrypted_key`)
-- `keys/secrets.yaml`: shared Janus provisioner secret (`janus.admin_jwk`) consumed by `step-ssh-host` across hosts
+- `keys/secrets.yaml`: shared Janus provisioner secret (`janus.admin_jwk`) consumed by `ssh-certs` across hosts
 
 Then update public artifacts in repo from generated output:
 
@@ -54,14 +54,14 @@ ad hoc issuance commands first:
 
 ```shell
 systemctl status step-ca.service
-systemctl status step-ssh-host-renew.service
-systemctl status step-ssh-host-renew.timer
+systemctl status ssh-certs-renew.service
+systemctl status ssh-certs-renew.timer
 systemctl status mtls-bootstrap.service
 ssh-host-cert-check
 mtls-check
 ```
 
-`step-ssh-host-renew.service` issues the SSH host certificate when it is missing
+`ssh-certs-renew.service` issues the SSH host certificate when it is missing
 or expiring. `mtls-bootstrap.service` issues the first Janus mTLS bundle
 only when the configured certificate files are absent or invalid; recurring mTLS
 renewal remains handled by `mtls-renew.timer`.

modules/hosts/janus/default.nix

@@ -10,7 +10,7 @@ in
     modules = with inputs.self.modules; [
       nixos.lxc
       nixos.mysops
-      nixos.step-ssh-host
+      nixos.ssh-certs
       nixos.step-client
       nixos.step-ca
       inputs.home-manager.nixosModules.home-manager
@@ -24,7 +24,7 @@ in
           "Step-CA" = "step-ca";
         };
         sops.defaultSopsFile = ./secrets.yaml;
-        step-ssh-host = {
+        ssh-certs = {
           hostname = hostname;
           extraPrincipals = [ ipv4 ipv6 ];
         };

modules/hosts/john-pc/default.nix

@@ -59,7 +59,7 @@ in
     ssh = {
       certificates.enable = true;
       knownHosts = [
-        "@cert-authority fded:fb16:653e:25da:be24:11ff:fea0:753f ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNug18oLH0vZxnibXJzMJvTWFPZTnSlhCDDVi+rHhgnIum6ZXQ4SF+VHOOAM5BbzZmMKitNJ5lcrGP15Eur7DzQ="
+        "@cert-authority fded:fb16:653e:25da:be24:11ff:* ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNug18oLH0vZxnibXJzMJvTWFPZTnSlhCDDVi+rHhgnIum6ZXQ4SF+VHOOAM5BbzZmMKitNJ5lcrGP15Eur7DzQ="
       ];
       matchSets = {
         certs = true;

modules/hosts/soteria/default.nix

@@ -10,7 +10,7 @@ in
       nixos.lxc
       nixos.mysops
       nixos."${username}"
-      nixos.step-ssh-host
+      nixos.ssh-certs
       nixos.login-text
       nixos.docker
       nixos.mtls
@@ -75,7 +75,7 @@ in
           "Restic REST Server" = "restic-rest-server.service";
         };
 
-        step-ssh-host.hostname = hostname;
+        ssh-certs.hostname = hostname;
 
         # This provides the secrets at install time
         sops.defaultSopsFile = ./secrets.yaml;

modules/nixos/login-text.nix

@@ -3,7 +3,7 @@
     let
       defaultServiceStatus = {
         SSH = "sshd.socket";
-        "SSH Cert Renewal" = "step-ssh-host-renew.timer";
+        "SSH Cert Renewal" = "ssh-certs-renew.timer";
       };
     in {
     options.loginText.extraServiceStatus = lib.mkOption {

modules/services/ssh.nix

@@ -48,7 +48,7 @@ in
         userCA = lib.mkOption {
           description = "Content for the SSH user CA file (public key)";
           type = lib.types.path;
-          default = ../hosts/janus/ssh_user_ca_key.pub;
+          default = sshHostCAPubKeyPath;
         };
         userCAFile = lib.mkOption {
           description = "String path to the SSh user CA";
@@ -139,10 +139,7 @@ in
       };
     };
 
-    # All this stuff has to be wrapped in a config attribute because of the presence of the options here?
-    config = let
-      provisionerPasswordPath = config.sops.secrets."janus/admin_jwk".path;
-    in {
+    config = {
       home.file.".ssh/known_hosts" = {
         text = lib.concatStringsSep "\n" (
           cfg.knownHosts ++ lib.optionals cfg.certificates.enable [
@@ -198,7 +195,7 @@ in
           })
           (lib.mkIf cfg.matchSets.certs {
             "janus" = {
-              HostName = "janus.john-stream.com";
+              HostName = "fded:fb16:653e:25da:be24:11ff:fe6b:4d57";
               User = "root";
             };
             "soteria" = {

modules/services/step-ca/ssh-host.nix

@@ -1,7 +1,7 @@
 { inputs, ... }: {
-  flake.modules.nixos.step-ssh-host = { config, pkgs, lib, ... }:
+  flake.modules.nixos.ssh-certs = { config, pkgs, lib, ... }:
   let
-    cfg = config.step-ssh-host;
+    cfg = config.ssh-certs;
     provisionerPasswordPath = config.sops.secrets."janus/admin_jwk".path;
     sshKeyPath = "/etc/ssh/ssh_host_ed25519_key";
     sshCertPath = "${sshKeyPath}-cert.pub";
@@ -32,7 +32,7 @@
   in
   {
     # NixOS Options
-    options.step-ssh-host = {
+    options.ssh-certs = {
       hostname = lib.mkOption {
         description = "Networking host name to register with the CA";
         type = lib.types.str;
@@ -68,9 +68,10 @@
         sshHostCertCheck
       ];
 
-      systemd.services.step-ssh-host-renew = {
+      systemd.services.ssh-certs-renew = {
         description = "Renew Step SSH host certificate if needed";
-        wantedBy = [ ];
+        wantedBy = [ "multi-user.target" ];
+        before = [ "sshd.service" ];
         after = [ "network-online.target" ];
         wants = [ "network-online.target" ];
         path = with pkgs; [ coreutils systemd step-cli openssh ];
@@ -112,7 +113,7 @@
         '';
       };
 
-      systemd.timers.step-ssh-host-renew = {
+      systemd.timers.ssh-certs-renew = {
         description = "Periodic Step SSH host certificate renewal";
         wantedBy = [ "timers.target" ];
 
@@ -121,9 +122,13 @@
           OnUnitActiveSec = "4h";
           RandomizedDelaySec = "15m";
           Persistent = true;
-          Unit = "step-ssh-host-renew.service";
+          Unit = "ssh-certs-renew.service";
         };
       };
+
+      # Ensure sshd waits for a cert reconciliation attempt at boot.
+      systemd.services.sshd.wants = [ "ssh-certs-renew.service" ];
+      systemd.services.sshd.after = [ "ssh-certs-renew.service" ];
     };
   };
 }