reorg

modules/hosts/janus/README.md

@@ -38,14 +38,14 @@ Secret source-of-truth after this split:
 
 Then update public artifacts in repo from generated output:
 
-- `modules/hosts/janus/root_ca.crt` from `/tmp/janus-step-ca-bootstrap/step/certs/root_ca.crt`
-- `modules/hosts/janus/intermediate_ca.crt` from `/tmp/janus-step-ca-bootstrap/step/certs/intermediate_ca.crt` (public certificate; intentionally committed, not stored in SOPS)
+- `modules/hosts/janus/public/root_ca.crt` from `/tmp/janus-step-ca-bootstrap/step/certs/root_ca.crt`
+- `modules/hosts/janus/public/intermediate_ca.crt` from `/tmp/janus-step-ca-bootstrap/step/certs/intermediate_ca.crt` (public certificate; intentionally committed, not stored in SOPS)
 - `modules/hosts/janus/fingerprint` from:
 	```shell
 	step certificate fingerprint /tmp/janus-step-ca-bootstrap/step/certs/root_ca.crt
 	```
-- `modules/hosts/janus/ssh_user_ca_key.pub` from `/tmp/janus-step-ca-bootstrap/step/certs/ssh_user_ca_key.pub`
-- `modules/hosts/janus/ssh_host_ca_key.pub` from `/tmp/janus-step-ca-bootstrap/step/certs/ssh_host_ca_key.pub`
+- `modules/hosts/janus/public/ssh_user_ca_key.pub` from `/tmp/janus-step-ca-bootstrap/step/certs/ssh_user_ca_key.pub`
+- `modules/hosts/janus/public/ssh_host_ca_key.pub` from `/tmp/janus-step-ca-bootstrap/step/certs/ssh_host_ca_key.pub`
 
 ## First boot checks
 

modules/hosts/janus/default.nix

@@ -29,8 +29,8 @@ in
           extraPrincipals = [ "janus.john-stream.com" ipv4 ipv6 ];
         };
         step-ca = {
-          rootCertPath = ./root_ca.crt;
-          intermediateCertPath = ./intermediate_ca.crt;
+          rootCertPath = ./public/root_ca.crt;
+          intermediateCertPath = ./public/intermediate_ca.crt;
           dnsNames = [
             "${hostname}.john-stream.com"
             ipv4