soteria off the ground

modules/features/ssh-certs.nix

@@ -81,9 +81,6 @@ in
         ]
         ++ lib.optionals config.overwrite [ "-f" ]
         ++ mkPrincipalArgs config.extraPrincipals;
-      postHook = ''
-        systemctl reload-or-restart sshd
-      '';
     };
   });
 

modules/hosts/janus/README.md

@@ -34,7 +34,7 @@ If rotating provisioner password, also set:
 Secret source-of-truth after this split:
 
 - `modules/hosts/janus/secrets.yaml`: Janus runtime CA secrets (`ca_password`, `intermediate_ca_key`, `ssh_host_ca_key`, `ssh_user_ca_key`, `admin_provisioner_encrypted_key`)
-- `keys/secrets.yaml`: shared Janus provisioner secret (`janus.admin_jwk`) consumed by `ssh-certs` across hosts
+- `keys/secrets.yaml`: shared Janus provisioner secret (`janus.admin_jwk`) consumed across hosts
 
 Then update public artifacts in repo from generated output:
 

modules/hosts/john-kde/default.nix

@@ -33,7 +33,6 @@ in
     home.packages = with pkgs; [
       selfPkgs.jsl-zsh
       selfPkgs.my-neovim
-      selfPkgs.ssh-certs
       # selfPkgs.step-bootstrap
       # selfPkgs.wg-platform
       # self'.packages.myWrappedPackage

modules/hosts/john-pc/default.nix

@@ -38,7 +38,6 @@ in
     home.packages = with pkgs; [
       nil # Nix language server
       selfPkgs.jsl-zsh
-      # selfPkgs.ssh-certs
       (inputs.self.wrappers.test-push.apply {
         inherit pkgs flakeDir;
         host = testHost;

modules/hosts/soteria/default.nix

@@ -17,7 +17,6 @@ in
       nixos.ssh-new
       # nixos.mtls
       nixos.mysops
-      # nixos.ssh-certs
       nixos.docker
       nixos.step-client
       nixos.forgejo
@@ -39,33 +38,34 @@ in
           }
         ];
 
-        users.users."${username}".extraGroups = [ "mtls" ];
+        # users.users."${username}".extraGroups = [ "mtls" ];
-        mtls = {
+        # mtls = {
-          enable = true;
+        #   enable = true;
-          subject = hostname;
+        #   subject = hostname;
-          san = names;
+        #   san = names;
-          lifetime = "12h";
+        #   lifetime = "12h";
-          renew.onCalendar = "*:3/15";
+        #   renew.onCalendar = "*:3/15";
-          renew.reloadUnits = [ "forgejo.service" "restic-rest-server.service" ];
+        #   renew.reloadUnits = [ "forgejo.service" "restic-rest-server.service" ];
-          certReaders = [ config.services.forgejo.user "restic" ];
+        #   certReaders = [ config.services.forgejo.user "restic" ];
-        };
+        # };
-        forgejo = {
-          enable = true;
-          root_url = "https://forgejo.john-stream.com";
-          https = true;
-          port = 443;
-        };
 
-        resticServer = {
+        # forgejo = {
-          enable = true;
+        #   enable = true;
-          dataDir = "/mnt/restic";
+        #   root_url = "https://forgejo.john-stream.com";
-          privateRepos = true;
+        #   https = true;
-          listenAddress = "0.0.0.0:8000";
+        #   port = 443;
-          tls = {
+        # };
-            certFile = config.mtls.certFile;
+
-            keyFile = config.mtls.keyFile;
+        # resticServer = {
-          };
+        #   enable = true;
-        };
+        #   dataDir = "/mnt/restic";
+        #   privateRepos = true;
+        #   listenAddress = "0.0.0.0:8000";
+        #   tls = {
+        #     certFile = config.mtls.certFile;
+        #     keyFile = config.mtls.keyFile;
+        #   };
+        # };
 
         loginText.extraServiceStatus = {
           Docker = "docker";

modules/hosts/test-nix.nix

@@ -1,31 +0,0 @@
-{ inputs, ... }:
-let
-  username = "john";
-  hostname = "test-nix";
-in
-{
-  flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
-    modules = with inputs.self.modules; [
-      nixos.lxc
-      nixos.mysops
-      nixos.step-ssh-host
-      inputs.home-manager.nixosModules.home-manager
-      nixos."${username}"
-      nixos.docker
-      {
-        step-ssh-host.hostname = hostname;
-        sops.defaultSopsFile = ../../keys/secrets.yaml;
-        home-manager.users."${username}" = {
-          imports = with inputs.self.modules.homeManager; [
-            mysops
-          ];
-          docker.enable = true;
-          ssh.matchSets = {
-            certs = true;
-            homelab = true;
-          };
-        };
-      }
-    ];
-  };
-}

modules/nixos/lxc.nix

@@ -20,6 +20,8 @@
       environment.shells = lib.mkAfter [ rootShellPath ];
       users.users.root.shell = lib.mkForce rootShellPath;
 
+      networking.nameservers = [ "192.168.1.150" ];
+
       # security.sudo-rs.enable = true;
       programs.nix-ld.enable = true;
       nix.optimise.automatic = true;

modules/services/step-ca/ssh-host.nix

@@ -41,11 +41,11 @@
       };
     };
 
-    imports = with inputs.self.modules.nixos; [ ssh ];
+    # imports = with inputs.self.modules.nixos; [ ssh ];
 
     # NixOS Config
     config = {
-      ssh.certificates.enable = true;
+      # ssh.certificates.enable = true;
       sops.secrets."janus/admin_jwk" = {
         # Shared provisioner credential is intentionally centralized.
         sopsFile = ../../../keys/secrets.yaml;