reorg

modules/features/step-client.nix

@@ -2,7 +2,7 @@
 let
   defaultCaUrl = "https://janus.john-stream.com/";
   defaultFingerprint = "2036c44f7b5901566ff7611ea6c927291ecc6d2dd00779c0eead70ec77fa10d6";
-  defaultRoot = ../hosts/janus/root_ca.crt;
+  defaultRoot = ../hosts/janus/public/root_ca.crt;
 
   mkStepBootstrap = { pkgs, caUrl, fingerprint, install ? false }:
     (inputs.self.wrappers.stepBootstrap.apply {

modules/hosts/janus/README.md

@@ -38,14 +38,14 @@ Secret source-of-truth after this split:
 
 Then update public artifacts in repo from generated output:
 
-- `modules/hosts/janus/root_ca.crt` from `/tmp/janus-step-ca-bootstrap/step/certs/root_ca.crt`
-- `modules/hosts/janus/intermediate_ca.crt` from `/tmp/janus-step-ca-bootstrap/step/certs/intermediate_ca.crt` (public certificate; intentionally committed, not stored in SOPS)
+- `modules/hosts/janus/public/root_ca.crt` from `/tmp/janus-step-ca-bootstrap/step/certs/root_ca.crt`
+- `modules/hosts/janus/public/intermediate_ca.crt` from `/tmp/janus-step-ca-bootstrap/step/certs/intermediate_ca.crt` (public certificate; intentionally committed, not stored in SOPS)
 - `modules/hosts/janus/fingerprint` from:
 	```shell
 	step certificate fingerprint /tmp/janus-step-ca-bootstrap/step/certs/root_ca.crt
 	```
-- `modules/hosts/janus/ssh_user_ca_key.pub` from `/tmp/janus-step-ca-bootstrap/step/certs/ssh_user_ca_key.pub`
-- `modules/hosts/janus/ssh_host_ca_key.pub` from `/tmp/janus-step-ca-bootstrap/step/certs/ssh_host_ca_key.pub`
+- `modules/hosts/janus/public/ssh_user_ca_key.pub` from `/tmp/janus-step-ca-bootstrap/step/certs/ssh_user_ca_key.pub`
+- `modules/hosts/janus/public/ssh_host_ca_key.pub` from `/tmp/janus-step-ca-bootstrap/step/certs/ssh_host_ca_key.pub`
 
 ## First boot checks
 

modules/hosts/janus/default.nix

@@ -29,8 +29,8 @@ in
           extraPrincipals = [ "janus.john-stream.com" ipv4 ipv6 ];
         };
         step-ca = {
-          rootCertPath = ./root_ca.crt;
-          intermediateCertPath = ./intermediate_ca.crt;
+          rootCertPath = ./public/root_ca.crt;
+          intermediateCertPath = ./public/intermediate_ca.crt;
           dnsNames = [
             "${hostname}.john-stream.com"
             ipv4

modules/services/ssh.nix

@@ -1,7 +1,6 @@
 { inputs, ... }:
 let
-  userName = "john";
-  sshHostCAPubKeyPath = ../hosts/janus/ssh_host_ca_key.pub;
+  sshHostCAPubKeyPath = ../hosts/janus/public/ssh_host_ca_key.pub;
 in
 {
   flake.modules.nixos.ssh = { config, pkgs, lib, ... }: