ssh cert consolidation

modules/hosts/janus/README.md

@@ -34,7 +34,7 @@ If rotating provisioner password, also set:
 Secret source-of-truth after this split:
 
 - `modules/hosts/janus/secrets.yaml`: Janus runtime CA secrets (`ca_password`, `intermediate_ca_key`, `ssh_host_ca_key`, `ssh_user_ca_key`, `admin_provisioner_encrypted_key`)
-- `keys/secrets.yaml`: shared Janus provisioner secret (`janus.admin_jwk`) consumed by `step-ssh-host` across hosts
+- `keys/secrets.yaml`: shared Janus provisioner secret (`janus.admin_jwk`) consumed by `ssh-certs` across hosts
 
 Then update public artifacts in repo from generated output:
 
@@ -54,14 +54,14 @@ ad hoc issuance commands first:
 
 ```shell
 systemctl status step-ca.service
-systemctl status step-ssh-host-renew.service
-systemctl status step-ssh-host-renew.timer
+systemctl status ssh-certs-renew.service
+systemctl status ssh-certs-renew.timer
 systemctl status mtls-bootstrap.service
 ssh-host-cert-check
 mtls-check
 ```
 
-`step-ssh-host-renew.service` issues the SSH host certificate when it is missing
+`ssh-certs-renew.service` issues the SSH host certificate when it is missing
 or expiring. `mtls-bootstrap.service` issues the first Janus mTLS bundle
 only when the configured certificate files are absent or invalid; recurring mTLS
 renewal remains handled by `mtls-renew.timer`.

modules/hosts/janus/default.nix

@@ -10,7 +10,7 @@ in
     modules = with inputs.self.modules; [
       nixos.lxc
       nixos.mysops
-      nixos.step-ssh-host
+      nixos.ssh-certs
       nixos.step-client
       nixos.step-ca
       inputs.home-manager.nixosModules.home-manager
@@ -24,7 +24,7 @@ in
           "Step-CA" = "step-ca";
         };
         sops.defaultSopsFile = ./secrets.yaml;
-        step-ssh-host = {
+        ssh-certs = {
           hostname = hostname;
           extraPrincipals = [ ipv4 ipv6 ];
         };