janus deployment

modules/hosts/janus/default.nix

@@ -2,6 +2,8 @@
 let
   username = "john";
   hostname = "janus";
+  ipv4 = "192.168.1.32";
+  ipv6 = "fded:fb16:653e:25da:be24:11ff:fe6b:4d57";
 in
 {
   flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
@@ -22,27 +24,17 @@ in
           "Step-CA" = "step-ca";
         };
         sops.defaultSopsFile = ./secrets.yaml;
-        sops.secrets."janus/ssh_host_ed25519_key" = {
-          sopsFile = ./secrets.yaml;
-          owner = "root";
-          group = "root";
-          mode = "0600";
-          path = "/etc/ssh/ssh_host_ed25519_key";
-          restartUnits = [ "sshd.socket" "step-ssh-host-renew.service" ];
-        };
         step-ssh-host = {
           hostname = hostname;
-          extraPrincipals = [
-            "192.168.1.244"
-            "fded:fb16:653e:25da:be24:11ff:fea0:753f"
-          ];
+          extraPrincipals = [ ipv4 ipv6 ];
         };
         step-ca = {
           rootCertPath = ./root_ca.crt;
           intermediateCertPath = ./intermediate_ca.crt;
           dnsNames = [
             "${hostname}.john-stream.com"
-            "192.168.1.244"
+            ipv4
+            ipv6
           ];
           secrets = {
             sopsFile = ./secrets.yaml;
@@ -53,17 +45,18 @@ in
             adminProvisionerEncryptedKey = "janus/admin_provisioner_encrypted_key";
           };
         };
+        step-client.caUrl = "https://${ipv4}/";
         mtls = {
           enable = true;
           subject = hostname;
           san = [
             "${hostname}.john-stream.com"
-            "192.168.1.244"
+            ipv4
           ];
           bootstrap = {
             enable = true;
-            after = [ "network-online.target" "sops-nix.service" "step-ca.service" ];
-            wants = [ "network-online.target" "step-ca.service" ];
+            after = [ "sops-nix.service" "step-ca.service" ];
+            wants = [ "step-ca.service" ];
             provisionerPasswordFile = config.sops.secrets."janus/admin_jwk".path;
           };
         };