ssh cert consolidation

modules/hosts/janus/README.md

@@ -34,7 +34,7 @@ If rotating provisioner password, also set:
 Secret source-of-truth after this split:
 
 - `modules/hosts/janus/secrets.yaml`: Janus runtime CA secrets (`ca_password`, `intermediate_ca_key`, `ssh_host_ca_key`, `ssh_user_ca_key`, `admin_provisioner_encrypted_key`)
-- `keys/secrets.yaml`: shared Janus provisioner secret (`janus.admin_jwk`) consumed by `step-ssh-host` across hosts
+- `keys/secrets.yaml`: shared Janus provisioner secret (`janus.admin_jwk`) consumed by `ssh-certs` across hosts
 
 Then update public artifacts in repo from generated output:
 
@@ -54,14 +54,14 @@ ad hoc issuance commands first:
 
 ```shell
 systemctl status step-ca.service
-systemctl status step-ssh-host-renew.service
-systemctl status step-ssh-host-renew.timer
+systemctl status ssh-certs-renew.service
+systemctl status ssh-certs-renew.timer
 systemctl status mtls-bootstrap.service
 ssh-host-cert-check
 mtls-check
 ```
 
-`step-ssh-host-renew.service` issues the SSH host certificate when it is missing
+`ssh-certs-renew.service` issues the SSH host certificate when it is missing
 or expiring. `mtls-bootstrap.service` issues the first Janus mTLS bundle
 only when the configured certificate files are absent or invalid; recurring mTLS
 renewal remains handled by `mtls-renew.timer`.

modules/hosts/janus/default.nix

@@ -10,7 +10,7 @@ in
     modules = with inputs.self.modules; [
       nixos.lxc
       nixos.mysops
-      nixos.step-ssh-host
+      nixos.ssh-certs
       nixos.step-client
       nixos.step-ca
       inputs.home-manager.nixosModules.home-manager
@@ -24,7 +24,7 @@ in
           "Step-CA" = "step-ca";
         };
         sops.defaultSopsFile = ./secrets.yaml;
-        step-ssh-host = {
+        ssh-certs = {
           hostname = hostname;
           extraPrincipals = [ ipv4 ipv6 ];
         };

modules/hosts/john-pc/default.nix

@@ -59,7 +59,7 @@ in
     ssh = {
       certificates.enable = true;
       knownHosts = [
-        "@cert-authority fded:fb16:653e:25da:be24:11ff:fea0:753f ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNug18oLH0vZxnibXJzMJvTWFPZTnSlhCDDVi+rHhgnIum6ZXQ4SF+VHOOAM5BbzZmMKitNJ5lcrGP15Eur7DzQ="
+        "@cert-authority fded:fb16:653e:25da:be24:11ff:* ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNug18oLH0vZxnibXJzMJvTWFPZTnSlhCDDVi+rHhgnIum6ZXQ4SF+VHOOAM5BbzZmMKitNJ5lcrGP15Eur7DzQ="
       ];
       matchSets = {
         certs = true;

modules/hosts/soteria/default.nix

@@ -10,7 +10,7 @@ in
       nixos.lxc
       nixos.mysops
       nixos."${username}"
-      nixos.step-ssh-host
+      nixos.ssh-certs
       nixos.login-text
       nixos.docker
       nixos.mtls
@@ -75,7 +75,7 @@ in
           "Restic REST Server" = "restic-rest-server.service";
         };
 
-        step-ssh-host.hostname = hostname;
+        ssh-certs.hostname = hostname;
 
         # This provides the secrets at install time
         sops.defaultSopsFile = ./secrets.yaml;