ssh user certs in home-manager

modules/features/ssh/default.nix

@@ -65,10 +65,6 @@ in
           then adminJwkPath
           else null;
       };
-      userScripts = mkUserScripts {
-        inherit cfg pkgs;
-        provisionerPasswordFile = adminJwkPath;
-      };
       CAknownHosts = (lib.genAttrs caPatterns (_: {
         certAuthority = true;
         publicKey = lib.removeSuffix "\n" (builtins.readFile sshHostCAPath);
@@ -157,10 +153,6 @@ in
         home-manager.users.root = lib.mkIf cfg.certificates.user.enable {
           home.stateVersion = lib.mkDefault config.system.stateVersion;
           imports = [ inputs.self.modules.homeManager.ssh-new ];
-          home.packages = [
-            userScripts.sign
-            userScripts.check
-          ];
           ssh-new.certificates.user.enable = true;
         };
       };
@@ -169,6 +161,10 @@ in
   flake.modules.homeManager.ssh-new = { config, pkgs, lib, ... }:
     let
       cfg = config.ssh-new;
+      userKeyPath =
+        if lib.hasPrefix "/" cfg.user.keyFile || lib.hasPrefix "~/" cfg.user.keyFile
+        then cfg.user.keyFile
+        else "${config.home.homeDirectory}/.ssh/${cfg.user.keyFile}";
       hasAdminJwk = lib.hasAttrByPath [ "sops" "secrets" "janus/admin_jwk" ] config;
       adminJwkPath = if hasAdminJwk then config.sops.secrets."janus/admin_jwk".path else null;
       hostScripts = mkHostScripts { inherit cfg pkgs; };
@@ -186,16 +182,11 @@ in
       config = {
         home.file.".ssh/known_hosts" = lib.mkIf cfg.certificates.user.enable {
           text = knownHostsText;
+          force = true;
         };
-        home.packages = [
+        home.packages = lib.optionals cfg.certificates.user.enable [
           userScripts.sign
           userScripts.check
-        ]
-        ++ lib.optionals cfg.host.enable-scripts [
-          hostScripts.sign
-          hostScripts.renew
-          hostScripts.renewalCheck
-          hostScripts.check
         ];
         programs.ssh = {
           enable = true;
@@ -216,7 +207,7 @@ in
                   PasswordAuthentication = "no";
                   PreferredAuthentications = "publickey";
                   IdentitiesOnly = true;
-                  IdentityFile = cfg.user.keyFile;
+                  IdentityFile = userKeyPath;
 
                   StrictHostKeyChecking = "accept-new";
                   UserKnownHostsFile = "${config.home.homeDirectory}/.ssh/known_hosts";
@@ -232,7 +223,7 @@ in
               # SSH certificate settings
               ++ lib.optionals cfg.certificates.user.enable [
                 {
-                  CertificateFile = "${cfg.user.keyFile}-cert.pub";
+                  CertificateFile = "${userKeyPath}-cert.pub";
                 }
               ]
             );

modules/features/ssh/ssh-wrappers.nix

@@ -67,7 +67,10 @@ in
 
   flake.wrappers.signUserWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
     imports = [ sshCertConfig ];
-    config = let cfg = config.ssh-new; in {
+    config =
+    let
+      cfg = config.ssh-new;
+    in {
       binName = "ssh-user-cert-sign";
       package = config.pkgs.step-cli;
       args = [ "ssh" "certificate" "--sign" ]
@@ -84,11 +87,14 @@ in
 
   flake.wrappers.userCheckWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
     imports = [ sshCertConfig ];
-    config = {
+    config =
+    let
+      cfg = config.ssh-new;
+    in {
       binName = "ssh-user-cert-check";
       package = config.pkgs.openssh;
       exePath = lib.getExe' config.pkgs.openssh "ssh-keygen";
-        args = [ "-Lf" "${config.ssh-new.user.keyFile}-cert.pub" ];
+        args = [ "-Lf" "$HOME/.ssh/${config.ssh-new.user.keyFile}-cert.pub" ];
     };
   });