From fa29ce93f472799d92f45dd7be8e087d2fc213e3 Mon Sep 17 00:00:00 2001
From: John Lancaster <32917998+jsl12@users.noreply.github.com>
Date: Sun, 5 Jul 2026 11:26:36 -0500
Subject: [PATCH] reorg

---
 modules/features/step-client.nix                     | 2 +-
 modules/hosts/janus/README.md                        | 8 ++++----
 modules/hosts/janus/default.nix                      | 4 ++--
 modules/hosts/janus/{ => public}/fingerprint         | 0
 modules/hosts/janus/{ => public}/intermediate_ca.crt | 0
 modules/hosts/janus/{ => public}/root_ca.crt         | 0
 modules/hosts/janus/{ => public}/ssh_host_ca_key.pub | 0
 modules/hosts/janus/{ => public}/ssh_user_ca_key.pub | 0
 modules/services/ssh.nix                             | 3 +--
 9 files changed, 8 insertions(+), 9 deletions(-)
 rename modules/hosts/janus/{ => public}/fingerprint (100%)
 rename modules/hosts/janus/{ => public}/intermediate_ca.crt (100%)
 rename modules/hosts/janus/{ => public}/root_ca.crt (100%)
 rename modules/hosts/janus/{ => public}/ssh_host_ca_key.pub (100%)
 rename modules/hosts/janus/{ => public}/ssh_user_ca_key.pub (100%)

diff --git a/modules/features/step-client.nix b/modules/features/step-client.nix
index d5381d6..c171016 100644
--- a/modules/features/step-client.nix
+++ b/modules/features/step-client.nix
@@ -2,7 +2,7 @@
 let
   defaultCaUrl = "https://janus.john-stream.com/";
   defaultFingerprint = "2036c44f7b5901566ff7611ea6c927291ecc6d2dd00779c0eead70ec77fa10d6";
-  defaultRoot = ../hosts/janus/root_ca.crt;
+  defaultRoot = ../hosts/janus/public/root_ca.crt;
 
   mkStepBootstrap = { pkgs, caUrl, fingerprint, install ? false }:
     (inputs.self.wrappers.stepBootstrap.apply {
diff --git a/modules/hosts/janus/README.md b/modules/hosts/janus/README.md
index 598e595..09d05db 100644
--- a/modules/hosts/janus/README.md
+++ b/modules/hosts/janus/README.md
@@ -38,14 +38,14 @@ Secret source-of-truth after this split:
 
 Then update public artifacts in repo from generated output:
 
-- `modules/hosts/janus/root_ca.crt` from `/tmp/janus-step-ca-bootstrap/step/certs/root_ca.crt`
-- `modules/hosts/janus/intermediate_ca.crt` from `/tmp/janus-step-ca-bootstrap/step/certs/intermediate_ca.crt` (public certificate; intentionally committed, not stored in SOPS)
+- `modules/hosts/janus/public/root_ca.crt` from `/tmp/janus-step-ca-bootstrap/step/certs/root_ca.crt`
+- `modules/hosts/janus/public/intermediate_ca.crt` from `/tmp/janus-step-ca-bootstrap/step/certs/intermediate_ca.crt` (public certificate; intentionally committed, not stored in SOPS)
 - `modules/hosts/janus/fingerprint` from:
 	```shell
 	step certificate fingerprint /tmp/janus-step-ca-bootstrap/step/certs/root_ca.crt
 	```
-- `modules/hosts/janus/ssh_user_ca_key.pub` from `/tmp/janus-step-ca-bootstrap/step/certs/ssh_user_ca_key.pub`
-- `modules/hosts/janus/ssh_host_ca_key.pub` from `/tmp/janus-step-ca-bootstrap/step/certs/ssh_host_ca_key.pub`
+- `modules/hosts/janus/public/ssh_user_ca_key.pub` from `/tmp/janus-step-ca-bootstrap/step/certs/ssh_user_ca_key.pub`
+- `modules/hosts/janus/public/ssh_host_ca_key.pub` from `/tmp/janus-step-ca-bootstrap/step/certs/ssh_host_ca_key.pub`
 
 ## First boot checks
 
diff --git a/modules/hosts/janus/default.nix b/modules/hosts/janus/default.nix
index fe49a96..c2b090f 100644
--- a/modules/hosts/janus/default.nix
+++ b/modules/hosts/janus/default.nix
@@ -29,8 +29,8 @@ in
           extraPrincipals = [ "janus.john-stream.com" ipv4 ipv6 ];
         };
         step-ca = {
-          rootCertPath = ./root_ca.crt;
-          intermediateCertPath = ./intermediate_ca.crt;
+          rootCertPath = ./public/root_ca.crt;
+          intermediateCertPath = ./public/intermediate_ca.crt;
           dnsNames = [
             "${hostname}.john-stream.com"
             ipv4
diff --git a/modules/hosts/janus/fingerprint b/modules/hosts/janus/public/fingerprint
similarity index 100%
rename from modules/hosts/janus/fingerprint
rename to modules/hosts/janus/public/fingerprint
diff --git a/modules/hosts/janus/intermediate_ca.crt b/modules/hosts/janus/public/intermediate_ca.crt
similarity index 100%
rename from modules/hosts/janus/intermediate_ca.crt
rename to modules/hosts/janus/public/intermediate_ca.crt
diff --git a/modules/hosts/janus/root_ca.crt b/modules/hosts/janus/public/root_ca.crt
similarity index 100%
rename from modules/hosts/janus/root_ca.crt
rename to modules/hosts/janus/public/root_ca.crt
diff --git a/modules/hosts/janus/ssh_host_ca_key.pub b/modules/hosts/janus/public/ssh_host_ca_key.pub
similarity index 100%
rename from modules/hosts/janus/ssh_host_ca_key.pub
rename to modules/hosts/janus/public/ssh_host_ca_key.pub
diff --git a/modules/hosts/janus/ssh_user_ca_key.pub b/modules/hosts/janus/public/ssh_user_ca_key.pub
similarity index 100%
rename from modules/hosts/janus/ssh_user_ca_key.pub
rename to modules/hosts/janus/public/ssh_user_ca_key.pub
diff --git a/modules/services/ssh.nix b/modules/services/ssh.nix
index 686590a..7625887 100644
--- a/modules/services/ssh.nix
+++ b/modules/services/ssh.nix
@@ -1,7 +1,6 @@
 { inputs, ... }:
 let
-  userName = "john";
-  sshHostCAPubKeyPath = ../hosts/janus/ssh_host_ca_key.pub;
+  sshHostCAPubKeyPath = ../hosts/janus/public/ssh_host_ca_key.pub;
 in
 {
   flake.modules.nixos.ssh = { config, pkgs, lib, ... }: