diff --git a/.sops.yaml b/.sops.yaml index df466ef..930e725 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -3,7 +3,7 @@ keys: - &john-pc age1ykcs39e62pz3xu6cedg8ea685kv5d5qsrhgkndygzm8rx30xd5ys5t3qxt - &test-nix age1gvplss0ddmyf6vpjy363wu3n057vhm0j6n7tc94cxd8kadapypws5mtaj0 - &soteria age1h0prahyukq4l564yqwgcpg3g6gdrjflk0suklussjjrjstxd9uesws8633 - - &janus age1n94nkvmzezdj08t4dpwukd7s5k4cx2rldwvx9x5qhx3xhqm48yhq6ejldt + - &janus age1qahhlzeanprtykym9jymk2t95uedr7cwx9sdshx46q2m6u66fucsqua8l3 creation_rules: - path_regex: modules/hosts/janus/secrets\.yaml$ key_groups: diff --git a/keys/secrets.yaml b/keys/secrets.yaml index e2fc229..544e018 100644 --- a/keys/secrets.yaml +++ b/keys/secrets.yaml @@ -11,49 +11,49 @@ sops: age: - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuQytmUDE3NVg1RWlYcjVq - RVp6dHlqOHlNdXAyWkNlOVlGQlIwZERpdFRrCk1CTW84Q1B0MEFKTmpFM2FNS3lE - NDY4b0k3dTdST1VyQlFZVUhGSlpudDgKLS0tIHlVZDBrd0VFSWRsUGtpVjVIYnUx - VGc0WjlNSzE1U2h2cFNZekxoNUhSdVUKYpl5ZlZpH5zvfNUVrPdd+dqwZ16zJn7D - cbc5xZLtDpoeG3ZQQeV9T4WGTKycZN8Wo13Iw7BtQL/zUnUU8L/y8g== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwWlpYV1o3SVdJdmJ5TWM3 + Qmg4WVkvL21aQ2wvMUcxeGIxL2FQRUNOZFhZCkFqT3RtNTZvODJZczVwcEZkMzBp + eFFTVmJLb1ZOQVVVSWl4OVNQWkM4VWcKLS0tIEV4WmhEOGpkUWFBTCtqaldxdXFO + T20rVXNrY0ZBWlBaS0lWdGIrYUFNdm8KL06MsEu0fy6gKX5khZoxaypKDgEEJnTL + hCh4sCmTC3l7vQLv6deWf1Xhc8vSYhhNaWFCZ+KSaUen+6Bm/WrRIg== -----END AGE ENCRYPTED FILE----- recipient: age1f6drjusg866yscj8029tk4yfpgecklrvezldm02ankm6h8nnwu5s2u6ahy - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6czRVNUhGaFV1U0dUKzNp - YVl0TGZBTnBIaS96dWo2S3BZUFBSclhITkJNCkZZU0dCdnA4d1VVOFRjU2JueG1C - MndFazdFZG5CbEdPU2xSS24xNnBHQ2sKLS0tIFh3TWxydi96alBKRkpqa3VKekUx - ck5hbU1ValNJU2d1cTVTZU10NSsxVkEK5/dMd08yTRKNmunA3u7RYtJsaYVRD/cG - cXL2g5ewWl/vhFH71pwCpXIyEhKCF1U6HR9VlesnwU8ZOON59n9FKg== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwRGVJTXJtSk9KUFpCdksv + SUJ4YXBSTndhZkVHNlV2TTlyS0MrQXdqOG1jCkk0c3p0ZUlHMzZmR0FTUTMxOTl1 + c0dFTW9yZFpuSUdwVUs0dlJiL2d2cFUKLS0tIE1VWldEYmR6cWFoRTkycmllVnpt + TGYxU2J0NzAvMjBMOXVMZEJTYTNkamMK2zfuTeHJ/8I07oNhp3MN1wKlmtVpahke + cz8FVesp/+53HxfQAdnC7l/Cv7P71aVEyr2/oTEd4gt9HsHVVw3O6A== -----END AGE ENCRYPTED FILE----- recipient: age1ykcs39e62pz3xu6cedg8ea685kv5d5qsrhgkndygzm8rx30xd5ys5t3qxt - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWVWlDaTdpK2t1Z1pTbmZO - V2o5VW9oa3c3eE9Yc2lzaWtJdk5KcWZFTUQ4CkI2UnN3NWxQOUVwaDFXWmY0ODBU - NXFHeEYwYnUvVkRmNzFQZVNUZHd3bjgKLS0tIDA2Q2J2bnVGUHJ6UEIzNHpmbTRL - U284VStkZ3MyS0x2RTA4akJPRmJtbU0KSKpSQDPiC+m6ta9kYb5J2uYstW2fz2Xq - zVYs/F1727hasnwTOnR+rdN2k72dpxof1T6CxRKWZ3xjkvFqis2Nhg== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwR3VEWmZ4REpUN0M5NTRT + U1l1S0k1MnFrYnhRanB4UStOQU0vYXE0TjFZCld2cDBlRXNyRlJWMlZ4TENadURy + cUN0RmpYYld3WlY0TzkyNXlqbFVnKzgKLS0tIHhtSG5VU3RMclMyZFJmbk1DMkV6 + elRhVTV6Tk5OTjUybldvUXY3Sk9hdkEKg17Pagk12Pvj6cNr49HN8tImM4w7pnkc + XLCWIHUCe3QpJlgs4USXbyA06PmsNl7PVvCoxmf6tPegt+SFMTuDRQ== -----END AGE ENCRYPTED FILE----- recipient: age1gvplss0ddmyf6vpjy363wu3n057vhm0j6n7tc94cxd8kadapypws5mtaj0 - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPbFUxTmhablI5SEczeWlV - Q20vYzFGR21GUzNQZVdSb3hCOXNNMUN5K3dNCi9FeEpPcHJCV0t1eU5VMmNzclla - eWdWL2RVMXZMbHhPN2Z1NHdBRnBpQnMKLS0tIG5XR1QrOXJQNHRNQzZvU0hVaFpv - eU82a3Y4enZpUTJIU0dObkkxa1J5K0kKoiSmt5LcM8U82pwwsvMBsgEbQ6u3+156 - GFXQFp2+gk8zsxtzCkW1nl52Bw3GfXS7cJTW3jOVBw/YquDTc8nhXQ== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMUUtJWklHTGpLYTJuMkZi + N2YzMlBUU3dxUGZwSUJjRktVYmp4RlowZ0c0CmdWdmFOQndpQWM0a0VOZUtlckhz + SktRclh5ZFZLaCt2RjhIdGU1aUs0c2sKLS0tIGI4UGFUcHhPVis5Z3dhanhiMGwv + OXRWQnNKcU9XRVJRWWdUNTZyZUdETzAKSchzGq3teDdBiyzJEujlxPaoJsVww4JX + 3VvsUZLxnV1yWu83X1bp6uZA3YLMdQgPcHezdgmIyixp+ATHh9fgzw== -----END AGE ENCRYPTED FILE----- recipient: age1h0prahyukq4l564yqwgcpg3g6gdrjflk0suklussjjrjstxd9uesws8633 - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBETlZVQ2RyT21KeWtNRFd6 - ZytTWStEdFZkaG9jZzJkU253SzE1VUgvQkNNCk1QTDF6dGo4aXF2TmhtRlcrM3dk - Z25kVXZxQTlJY1pIMXZQOU9FdWN6T1UKLS0tIGhBU0FVNHd6cWhiZzh3Skp6Nzdz - SHhEMndWN1Z1TlRoajRnSEZ1UmFvbmsKR79t34F3rjQg6IzQEIc7W/VUjpHLgFus - wlMkfHfZqUDo/ORvOJmT337l2XuK/spbsNlYqfupCWUbvtMZNhnkAg== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtOHFwemUyc2pEKzlibVBo + MlI4R0VTMHpwK21MaXZkSUp5dnIwUnVZOFRvCjVsM3FrclFJL0s2a1RwU1F2VXNF + MnRBOVUydFdEWXY3Mk9oTGw5Z05Zb28KLS0tIE9QRFdCVGR1Z0UyeE5KSzgrWnpP + Q25nZWx3bFdlek1OSjJsSk1QREdGRU0K++hDWzoKbBkGkMAkruuEwQKa1Jrc8POs + liN274cEdi1T6nmwBJ05w0alUR2XuYEn9HNKdvz8EntNuKIhCpHing== -----END AGE ENCRYPTED FILE----- - recipient: age1n94nkvmzezdj08t4dpwukd7s5k4cx2rldwvx9x5qhx3xhqm48yhq6ejldt + recipient: age1qahhlzeanprtykym9jymk2t95uedr7cwx9sdshx46q2m6u66fucsqua8l3 lastmodified: "2026-03-15T15:06:29Z" mac: ENC[AES256_GCM,data:cF/TJ8VkzrHRUrO5iGdRdlFtqV/5EQ15JwQKIywJvsh0NERK67T21czSP7923MiL0u5QTVPn/rO8R5E/8gBu3r8+fLq+CFl9PDQHEX2JhnYOD5WZR412WMZq3MVR94IMTOrQANMVpS4uhMyvnrqOe4AenxLDyzrYhkwf1KQh4w0=,iv:Qwy8z4uXGMlf+kTMNiE42M9l8LtSJ+O7diknRrsSeYI=,tag:qlCY9r8HnEDmq/jw59C/sg==,type:str] unencrypted_suffix: _unencrypted diff --git a/modules/hosts/janus/README.md b/modules/hosts/janus/README.md index e1f174b..d7dd0e5 100644 --- a/modules/hosts/janus/README.md +++ b/modules/hosts/janus/README.md @@ -5,8 +5,8 @@ Generate passwords: mkdir -p /tmp/janus-step-ca-bootstrap && chmod 700 /tmp/janus-step-ca-bootstrap && cd /tmp/janus-step-ca-bootstrap && umask 077 && openssl rand -base64 48 > ca_password.txt && openssl rand -base64 48 > admin_jwk_password.txt ``` -Generate the Janus OpenSSH host key that Nix will materialize from SOPS at -`/etc/ssh/ssh_host_ed25519_key`: +Generate the Janus OpenSSH host key for reference (Janus now uses whatever key +already exists on the target at `/etc/ssh/ssh_host_ed25519_key`): ```shell ssh-keygen -t ed25519 -N '' -C janus@john-stream.com -f /tmp/janus-step-ca-bootstrap/ssh_host_ed25519_key @@ -24,24 +24,9 @@ Insert generated runtime CA material into `modules/hosts/janus/secrets.yaml` und - `/tmp/janus-step-ca-bootstrap/step/secrets/ssh_host_ca_key` -> `ssh_host_ca_key` - `/tmp/janus-step-ca-bootstrap/step/secrets/ssh_user_ca_key` -> `ssh_user_ca_key` - `/tmp/janus-step-ca-bootstrap/step/config/ca.json` -> `admin_provisioner_encrypted_key` (copy `authority.provisioners[].encryptedKey` for the `admin` JWK provisioner) -- `/tmp/janus-step-ca-bootstrap/ssh_host_ed25519_key` -> `ssh_host_ed25519_key` If you are only validating wiring first, `admin_provisioner_encrypted_key` can be an encrypted placeholder and replaced later. -The checked-in `ssh_host_ed25519_key` value is also only an encrypted placeholder. -Replace it before deploying Janus, otherwise OpenSSH and SSH host certificate -issuance will fail because the materialized host key is not a valid private key. - -For multiline secret values, avoid putting private key contents in shell history. -One safe non-interactive pattern is to JSON-encode the file content and pass that -temporary JSON file to `sops set --value-file`: - -```shell -jq -Rs . /tmp/janus-step-ca-bootstrap/ssh_host_ed25519_key > /tmp/janus-step-ca-bootstrap/ssh_host_ed25519_key.json -sops --config .sops.yaml set --value-file modules/hosts/janus/secrets.yaml '["janus"]["ssh_host_ed25519_key"]' /tmp/janus-step-ca-bootstrap/ssh_host_ed25519_key.json -rm -f /tmp/janus-step-ca-bootstrap/ssh_host_ed25519_key.json -``` - If rotating provisioner password, also set: - `/tmp/janus-step-ca-bootstrap/admin_jwk_password.txt` -> `janus.admin_jwk` in `keys/secrets.yaml` @@ -49,7 +34,6 @@ If rotating provisioner password, also set: Secret source-of-truth after this split: - `modules/hosts/janus/secrets.yaml`: Janus runtime CA secrets (`ca_password`, `intermediate_ca_key`, `ssh_host_ca_key`, `ssh_user_ca_key`, `admin_provisioner_encrypted_key`) -- `modules/hosts/janus/secrets.yaml`: Janus OpenSSH host private key (`ssh_host_ed25519_key`) materialized to `/etc/ssh/ssh_host_ed25519_key` - `keys/secrets.yaml`: shared Janus provisioner secret (`janus.admin_jwk`) consumed by `step-ssh-host` across hosts Then update public artifacts in repo from generated output: diff --git a/modules/hosts/janus/default.nix b/modules/hosts/janus/default.nix index 6c9d413..d147d29 100644 --- a/modules/hosts/janus/default.nix +++ b/modules/hosts/janus/default.nix @@ -2,6 +2,8 @@ let username = "john"; hostname = "janus"; + ipv4 = "192.168.1.32"; + ipv6 = "fded:fb16:653e:25da:be24:11ff:fe6b:4d57"; in { flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem { @@ -22,27 +24,17 @@ in "Step-CA" = "step-ca"; }; sops.defaultSopsFile = ./secrets.yaml; - sops.secrets."janus/ssh_host_ed25519_key" = { - sopsFile = ./secrets.yaml; - owner = "root"; - group = "root"; - mode = "0600"; - path = "/etc/ssh/ssh_host_ed25519_key"; - restartUnits = [ "sshd.socket" "step-ssh-host-renew.service" ]; - }; step-ssh-host = { hostname = hostname; - extraPrincipals = [ - "192.168.1.244" - "fded:fb16:653e:25da:be24:11ff:fea0:753f" - ]; + extraPrincipals = [ ipv4 ipv6 ]; }; step-ca = { rootCertPath = ./root_ca.crt; intermediateCertPath = ./intermediate_ca.crt; dnsNames = [ "${hostname}.john-stream.com" - "192.168.1.244" + ipv4 + ipv6 ]; secrets = { sopsFile = ./secrets.yaml; @@ -53,17 +45,18 @@ in adminProvisionerEncryptedKey = "janus/admin_provisioner_encrypted_key"; }; }; + step-client.caUrl = "https://${ipv4}/"; mtls = { enable = true; subject = hostname; san = [ "${hostname}.john-stream.com" - "192.168.1.244" + ipv4 ]; bootstrap = { enable = true; - after = [ "network-online.target" "sops-nix.service" "step-ca.service" ]; - wants = [ "network-online.target" "step-ca.service" ]; + after = [ "sops-nix.service" "step-ca.service" ]; + wants = [ "step-ca.service" ]; provisionerPasswordFile = config.sops.secrets."janus/admin_jwk".path; }; }; diff --git a/modules/hosts/janus/secrets.yaml b/modules/hosts/janus/secrets.yaml index 812c98a..43fefc0 100644 --- a/modules/hosts/janus/secrets.yaml +++ b/modules/hosts/janus/secrets.yaml @@ -9,29 +9,29 @@ sops: age: - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCdFNwM2JQSVlFZXpJZ0VQ - eDFYek1TMnNTM3lLbjh4SG56VDl6MGsvb1drCnpLbGZ1N2FwSmRacitFVDJxaFlD - Vk5XeCtxRGM0OGV2UFNwQmlFV1pLS1EKLS0tIHB5bm1iRG9WWmpjTlBKcWkwWktz - SWVQOVlJU3RBejdpaGpyTTAzVmh0MFkK6nLey1QwSw5J8WeDdUIjJo62pylqOKmP - +GANs3OQkRuwW2+nwG+LJR2pfUS6O6PDOz7ZWGKih90/Bk7EMtjOIQ== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRZ1pQQW1rekYzUDFGcXBW + M2RHSXUvbCtvemtHYUljNmxXOCt4dEczYUU0CkdFWDRBYWRhQStYb1RtbEFmZVk4 + bWxMTnhKVXlZWDRlcWZHWWhaSC9KMW8KLS0tIER6VWJGY28ramk2NDhZa0x5RU1s + YmU5S1FCVkJyNTNIVXhJSkdQVHYxMVkKEkbFmD4a7FWC8cKpZu2ZVot5ibheTQ1h + H6uqwAYT/UIXqnceyZyoT9JRcZyQy7xAUAJzQMe+TxUr+8iHAm7aBg== -----END AGE ENCRYPTED FILE----- - recipient: age1n94nkvmzezdj08t4dpwukd7s5k4cx2rldwvx9x5qhx3xhqm48yhq6ejldt + recipient: age1qahhlzeanprtykym9jymk2t95uedr7cwx9sdshx46q2m6u66fucsqua8l3 - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyeE04L0RvYmlnaWpxUWhm - M01vQVc2bFdNZ2k4TjJBOWZDTlV1V2VkVGd3CnhseTlOZWtqbmpldXUrWnRxSWdR - dFFPTFZtSlZjZVdKMDdYQkVJeG5wZUUKLS0tIGxRbEE3ZjNrUTlLSDMrVVIzbnJ5 - cEFnNmErTlhQMEtZM282STVRUGl0dVkKDyyTGVFDm6u+cdGu/PzFUFgj6ewCf0fi - vFhmYA8bTGNg6loThbYxm4uN1u+mJgwOKJ3FRR+u9yYEF6xvqrIbdw== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqWjBiVDJSZFRQYis3dSt5 + OFFMbGhyaHgxSDBjdnVMSlZ5d3B0eEhVM0VVCmw4TXk2a0s3ZDRCeHhEVFpGRkpl + b1lSQUJPL0hNRk50UEhHejNkL2VRd1EKLS0tICtXaWVMN0FSejNsNGNTOGh1WG13 + aFJINlNKOVNhc3VBOU00VXYyMTRFdVkKV251o5CegRdDxvhpOJjK5ITp/+DVBE9o + R3eAsTXG5SSN50rcZYjwoEgYUeiRB4dQ/NYw6lVDUFrOf/a7sAr32g== -----END AGE ENCRYPTED FILE----- recipient: age1ykcs39e62pz3xu6cedg8ea685kv5d5qsrhgkndygzm8rx30xd5ys5t3qxt - enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjeHQ4aDlSU2M2bzE1ODFY - Ym1NNEFFaVhrVlR0WUs1ZUVwTFVGN3QwMFZJCmdJWWFaeHByUlB2U3FLbEpwRkJI - ckRTNWx2dVl3Mi9ZNjhwUFNTdjZIaTAKLS0tIDZ0dFpCa2F3aFRCYmh2N3Nwb2dF - ZUJxakM3Wnc3U3JwTklPcllydXZBUXcKlf9C2/Gb9H9PdEKHdAd48dsalm43vYIz - ODYoLItstmJvT/rZ+XijZFALNsRrIj5435CW6V34OsfCkFkjeHz17w== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYYjlQRGVmRnRGbjNNT3dC + cWJCWmtrM1BnbE80QnpTWXdHMytqSmFHOVhjCm9LYzd4R2s1TENIVkFYK3g4STRk + cGIxMS9RQ2Y1dmR6RjZYeVF5LzRoelkKLS0tIEdjaGk2WnNCRVA0S1dxRzJyWFc3 + Yzh0MlFSZTR0Z0RhUnhHQzRSbFRXaUEK+5jadT4PMWPrljNcXVW3S1yJ1nI0iei8 + htf09S2S5jraIFkl2x6Rv8IqOnKVPPgTZkvZqPMQoM4zcs+o1/lnug== -----END AGE ENCRYPTED FILE----- recipient: age1gvplss0ddmyf6vpjy363wu3n057vhm0j6n7tc94cxd8kadapypws5mtaj0 lastmodified: "2026-07-05T01:59:20Z"