WIP

modules/features/ssh/default.nix

@@ -9,40 +9,47 @@ let
   mkHostScripts = { cfg, pkgs, provisionerPasswordFile ? null }: let
     hostKeyFile = "${cfg.host.configDir}/${cfg.host.keyFile}";
     hostCertFile = "${hostKeyFile}-cert.pub";
+    wrapperCfg = cfg // {
+      certificates = cfg.certificates // {
+        provisionerPasswordFile = provisionerPasswordFile;
+        overwrite = true;
+      };
+    };
   in {
     inherit hostKeyFile hostCertFile;
     sign = (wrappers.signHostWrapper.apply {
-      inherit pkgs provisionerPasswordFile;
-      inherit (cfg.certificates) provisioner;
-      inherit (cfg.certificates.host) extraPrincipals;
-      overwrite = true;
+      inherit pkgs;
+      ssh-new = wrapperCfg;
     }).wrapper;
     renew = (wrappers.renewHostWrapper.apply {
       inherit pkgs;
-      sshHostKeyFile = hostKeyFile;
-      overwrite = true;
+      ssh-new = wrapperCfg;
     }).wrapper;
     check = (wrappers.hostCheckWrapper.apply {
       inherit pkgs;
-      certPath = hostCertFile;
+      ssh-new = wrapperCfg;
     }).wrapper;
     renewalCheck = (wrappers.renewalCheck.apply {
       inherit pkgs;
-      certPath = hostCertFile;
-      expires-in = "4h";
+      ssh-new = wrapperCfg;
     }).wrapper;
   };
 
   mkUserScripts = { cfg, pkgs, provisionerPasswordFile ? null }: {
-    sign = (wrappers.signUserWrapper.apply {
-      inherit pkgs provisionerPasswordFile;
-      inherit (cfg.certificates) provisioner;
-      validUsers = [ "root" "john" "appdaemon" ];
-      overwrite = true;
+    sign = let
+      wrapperCfg = cfg // {
+        certificates = cfg.certificates // {
+          provisionerPasswordFile = provisionerPasswordFile;
+          overwrite = true;
+        };
+      };
+    in (wrappers.signUserWrapper.apply {
+      inherit pkgs;
+      ssh-new = wrapperCfg;
     }).wrapper;
     check = (wrappers.userCheckWrapper.apply {
       inherit pkgs;
-      certPath = "${cfg.user.keyFile}-cert.pub";
+      ssh-new = cfg;
     }).wrapper;
   };
 in
@@ -50,15 +57,17 @@ in
   flake.modules.nixos.ssh-new = { config, pkgs, lib, ... }:
     let
       cfg = config.ssh-new;
+      hasAdminJwk = lib.hasAttrByPath [ "sops" "secrets" "janus/admin_jwk" ] config;
+      adminJwkPath = if hasAdminJwk then config.sops.secrets."janus/admin_jwk".path else null;
       hostScripts = mkHostScripts {
         inherit cfg pkgs;
         provisionerPasswordFile = if cfg.certificates.host.autoRenew
-          then config.sops.secrets."janus/admin_jwk".path
+          then adminJwkPath
           else null;
       };
       userScripts = mkUserScripts {
         inherit cfg pkgs;
-        provisionerPasswordFile = config.sops.secrets."janus/admin_jwk".path;
+        provisionerPasswordFile = adminJwkPath;
       };
       CAknownHosts = (lib.genAttrs caPatterns (_: {
         certAuthority = true;
@@ -160,11 +169,17 @@ in
   flake.modules.homeManager.ssh-new = { config, pkgs, lib, ... }:
     let
       cfg = config.ssh-new;
+      hasAdminJwk = lib.hasAttrByPath [ "sops" "secrets" "janus/admin_jwk" ] config;
+      adminJwkPath = if hasAdminJwk then config.sops.secrets."janus/admin_jwk".path else null;
       hostScripts = mkHostScripts { inherit cfg pkgs; };
       sshHostCAContent = lib.removeSuffix "\n" (builtins.readFile sshHostCAPath);
       knownHostsText = lib.concatMapStrings
         (pattern: "@cert-authority ${pattern} ${sshHostCAContent}\n")
         caPatterns;
+      userScripts = mkUserScripts {
+        inherit cfg pkgs;
+        provisionerPasswordFile = adminJwkPath;
+      };
     in
     {
       imports = [ sshCertConfig ];
@@ -172,7 +187,11 @@ in
         home.file.".ssh/known_hosts" = lib.mkIf cfg.certificates.user.enable {
           text = knownHostsText;
         };
-        home.packages = lib.optionals cfg.host.enable-scripts [
+        home.packages = [
+          userScripts.sign
+          userScripts.check
+        ]
+        ++ lib.optionals cfg.host.enable-scripts [
           hostScripts.sign
           hostScripts.renew
           hostScripts.renewalCheck