ssh cert consolidation

modules/services/step-ca/ssh-host.nix

@@ -1,7 +1,7 @@
 { inputs, ... }: {
-  flake.modules.nixos.step-ssh-host = { config, pkgs, lib, ... }:
+  flake.modules.nixos.ssh-certs = { config, pkgs, lib, ... }:
   let
-    cfg = config.step-ssh-host;
+    cfg = config.ssh-certs;
     provisionerPasswordPath = config.sops.secrets."janus/admin_jwk".path;
     sshKeyPath = "/etc/ssh/ssh_host_ed25519_key";
     sshCertPath = "${sshKeyPath}-cert.pub";
@@ -32,7 +32,7 @@
   in
   {
     # NixOS Options
-    options.step-ssh-host = {
+    options.ssh-certs = {
       hostname = lib.mkOption {
         description = "Networking host name to register with the CA";
         type = lib.types.str;
@@ -68,9 +68,10 @@
         sshHostCertCheck
       ];
 
-      systemd.services.step-ssh-host-renew = {
+      systemd.services.ssh-certs-renew = {
         description = "Renew Step SSH host certificate if needed";
-        wantedBy = [ ];
+        wantedBy = [ "multi-user.target" ];
+        before = [ "sshd.service" ];
         after = [ "network-online.target" ];
         wants = [ "network-online.target" ];
         path = with pkgs; [ coreutils systemd step-cli openssh ];
@@ -112,7 +113,7 @@
         '';
       };
 
-      systemd.timers.step-ssh-host-renew = {
+      systemd.timers.ssh-certs-renew = {
         description = "Periodic Step SSH host certificate renewal";
         wantedBy = [ "timers.target" ];
 
@@ -121,9 +122,13 @@
           OnUnitActiveSec = "4h";
           RandomizedDelaySec = "15m";
           Persistent = true;
-          Unit = "step-ssh-host-renew.service";
+          Unit = "ssh-certs-renew.service";
         };
       };
+
+      # Ensure sshd waits for a cert reconciliation attempt at boot.
+      systemd.services.sshd.wants = [ "ssh-certs-renew.service" ];
+      systemd.services.sshd.after = [ "ssh-certs-renew.service" ];
     };
   };
 }