ssh user certs in home-manager

modules/features/mtls/config.nix

@@ -0,0 +1,49 @@
+{ lib, ... }: {
+  options.optionModules.mtls = lib.mkOption {
+    type = lib.types.deferredModule;
+    description = "Shared mTLS certificate option definitions, imported by the mTLS wrapper modules.";
+  };
+
+  config.optionModules.mtls = { config, lib, pkgs, ... }: {
+    key = "mtls-config";
+    _file = "modules/features/mtls/config.nix";
+    options = {
+      certDir = lib.mkOption {
+        description = "String path to the directory where the certs will be stored";
+        type = lib.types.str;
+        default = "/etc/mtls";
+      };
+      keyFile = lib.mkOption {
+        description = "String path for the private key";
+        type = lib.types.str;
+        default = "${config.certDir}/key.pem";
+      };
+      certFile = lib.mkOption {
+        description = "String path for the public cert";
+        type = lib.types.str;
+        default = "${config.certDir}/cert.pem";
+      };
+      bundleFile = lib.mkOption {
+        description = "String path for the mTLS key bundle";
+        type = lib.types.str;
+        default = "${config.certDir}/mtls.pem";
+      };
+      subject = lib.mkOption {
+        description = "Subject for the cert";
+        type = lib.types.str;
+      };
+      provisioner = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+      };
+      provisionerPasswordFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+      };
+      overwrite = lib.mkEnableOption "Overwrite existing cert file?";
+      SANs = lib.mkOption {
+        description = "A list of Subject Alternative Names";
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+      };
+    };
+  };
+}

modules/features/mtls/mtls-wrappers.nix

@@ -1,49 +1,12 @@
-{ self, inputs, lib, ... }:
+{ self, inputs, lib, config, ... }:
 let
+  mtlsConfigModule = config.optionModules.mtls;
   mkSANArgs = sans: builtins.concatLists (map (name: [ "--san" name ]) sans);
-  mkOpts = config: let cfg = config.mtls; in {
-    certDir = lib.mkOption {
-      description = "String path to the directory where the certs will be stored";
-      type = lib.types.str;
-      default = "/etc/mtls";
-    };
-    keyFile = lib.mkOption {
-      description = "String path for the private key";
-      type = lib.types.str;
-      default = "${config.certDir}/key.pem";
-    };
-    certFile = lib.mkOption {
-      description = "String path for the public cert";
-      type = lib.types.str;
-      default = "${config.certDir}/cert.pem";
-    };
-    bundleFile = lib.mkOption {
-      description = "String path for the mTLS key bundle";
-      type = lib.types.str;
-      default = "${config.certDir}/mtls.pem";
-    };
-    subject = lib.mkOption {
-      description = "Subject for the cert";
-      type = lib.types.str;
-    };
-    provisioner = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-    };
-    provisionerPasswordFile = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-    };
-    overwrite = lib.mkEnableOption "Overwrite existing cert file?";
-    SANs = lib.mkOption {
-      description = "A list of Subject Alternative Names";
-      type = lib.types.listOf lib.types.str;
-      default = [ ];
-    };
-  };
 in
 {
   flake.wrappers.mtls = {
     generate = inputs.wrappers.lib.wrapModule ({ config, lib, wlib, ... }: {
-      options = (mkOpts config);
+      imports = [ mtlsConfigModule ];
       config = {
         binName = "mtls-generate";
         package = config.pkgs.step-cli;
@@ -69,8 +32,10 @@ in
 
     renew = inputs.wrappers.lib.wrapModule ({ config, lib, wlib, ... }: {
       # https://github.com/Lassulus/wrappers#generating-systemd-services
-      imports = [ wlib.modules.systemd ];
-      options = (mkOpts config);
+      imports = [
+        wlib.modules.systemd mtlsConfigModule
+        mtlsConfigModule
+      ];
       config = {
         binName = "mtls-renew";
         package = config.pkgs.step-cli;
@@ -101,7 +66,7 @@ in
     });
 
     check = inputs.wrappers.lib.wrapModule ({ config, lib, wlib, ... }: {
-      options = (mkOpts config);
+      imports = [ mtlsConfigModule ];
       config = {
         binName = "mtls-check";
         # This pattern is necessary to wrap packages like openssl that provide more than one binary

modules/features/ssh/config.nix

@@ -0,0 +1,79 @@
+{ lib, ... }: {
+  options.optionModules.ssh-certs = lib.mkOption {
+    type = lib.types.deferredModule;
+    description = "SSH certificate options";
+  };
+
+  config.optionModules.ssh-certs = { config, lib, pkgs, ... }: {
+    # Needed for some kind of de-duping when this module is used more than once?
+    key = "ssh-cert-config";
+    _file = "modules/features/ssh/config.nix";
+
+    options.ssh-new = {
+      user = {
+        keyFile = lib.mkOption {
+          type = lib.types.str;
+          default = "id_ed25519";
+        };
+      };
+      host = {
+        configDir = lib.mkOption {
+          type = lib.types.str;
+          default = "/etc/ssh";
+        };
+        keyFile = lib.mkOption {
+          description = "String path to the host private key file";
+          type = lib.types.str;
+          default = "ssh_host_ed25519_key";
+        };
+        keyType = lib.mkOption {
+          description = "OpenSSH host key type for ssh.hostKey.";
+          type = lib.types.enum [ "ed25519" "rsa" "ecdsa" ];
+          default = "ed25519";
+        };
+        extraSettings = lib.mkOption {
+          description = "Extra settings to merge";
+          type = lib.types.attrs;
+          default = { };
+        };
+        enable-scripts = lib.mkEnableOption "Enable SSH host cert management scripts";
+      };
+      certificates = {
+        provisioner = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          default = null;
+        };
+        provisionerPasswordFile = lib.mkOption {
+          type = lib.types.nullOr lib.types.str;
+          default = null;
+        };
+        overwrite = lib.mkEnableOption "Overwrite existing certificate files";
+        user = {
+          enable = lib.mkEnableOption "Enable SSH user certs";
+          CAFile = lib.mkOption {
+            description = "Filename of the SSH user CA with the config directory";
+            type = lib.types.str;
+            default = "ssh_user_ca_key.pub";
+          };
+          extraPrincipals = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [ "root" "john" "appdaemon" ];
+          };
+        };
+        host = {
+          enable = lib.mkEnableOption "Enable SSH host certs";
+          autoRenew = lib.mkEnableOption "Auto-renew the SSH host certs with a systemd service/timer";
+          extraPrincipals = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [ ];
+          };
+          expires-in = lib.mkOption {
+            description = "Duration passed to step ssh needs-renewal --expires-in.";
+            type = lib.types.str;
+            default = "4h";
+          };
+        };
+      };
+    };
+  };
+}

modules/features/ssh/default.nix

@@ -1,115 +1,84 @@
 # New attempt at consolidating SSH config that wraps the step client, SSH certs, and all that in a top-level module
-{ self, inputs, ... }:
+{ self, inputs, lib, config, ... }:
 let
-  caPatterns = [ "*.john-stream.com" "192.168.1.*" "fded:fb16:653e:25da:be24:11ff:*" ];
   sshHostCAPath = ../../hosts/janus/public/ssh_host_ca_key.pub;
+  caPatterns = [ "*.john-stream.com" "192.168.1.*" "fded:fb16:653e:25da:be24:11ff:*" ];
+  wrappers = inputs.self.wrappers;
+  sshCertConfig = config.optionModules.ssh-certs;
+
+  mkHostScripts = { cfg, pkgs, provisionerPasswordFile ? null }: let
+    hostKeyFile = "${cfg.host.configDir}/${cfg.host.keyFile}";
+    hostCertFile = "${hostKeyFile}-cert.pub";
+    wrapperCfg = cfg // {
+      certificates = cfg.certificates // {
+        provisionerPasswordFile = provisionerPasswordFile;
+        overwrite = true;
+      };
+    };
+  in {
+    inherit hostKeyFile hostCertFile;
+    sign = (wrappers.signHostWrapper.apply {
+      inherit pkgs;
+      ssh-new = wrapperCfg;
+    }).wrapper;
+    renew = (wrappers.renewHostWrapper.apply {
+      inherit pkgs;
+      ssh-new = wrapperCfg;
+    }).wrapper;
+    check = (wrappers.hostCheckWrapper.apply {
+      inherit pkgs;
+      ssh-new = wrapperCfg;
+    }).wrapper;
+    renewalCheck = (wrappers.renewalCheck.apply {
+      inherit pkgs;
+      ssh-new = wrapperCfg;
+    }).wrapper;
+  };
+
+  mkUserScripts = { cfg, pkgs, provisionerPasswordFile ? null }: {
+    sign = let
+      wrapperCfg = cfg // {
+        certificates = cfg.certificates // {
+          provisionerPasswordFile = provisionerPasswordFile;
+          overwrite = true;
+        };
+      };
+    in (wrappers.signUserWrapper.apply {
+      inherit pkgs;
+      ssh-new = wrapperCfg;
+    }).wrapper;
+    check = (wrappers.userCheckWrapper.apply {
+      inherit pkgs;
+      ssh-new = cfg;
+    }).wrapper;
+  };
 in
 {
   flake.modules.nixos.ssh-new = { config, pkgs, lib, ... }:
     let
       cfg = config.ssh-new;
-      hostKeyFile = "${cfg.host.configDir}/${cfg.host.keyFile}";
-      hostCertFile = "${hostKeyFile}-cert.pub";
-      userCAFile = "${cfg.host.configDir}/${cfg.certificates.user.CAFile}";
+      hasAdminJwk = lib.hasAttrByPath [ "sops" "secrets" "janus/admin_jwk" ] config;
+      adminJwkPath = if hasAdminJwk then config.sops.secrets."janus/admin_jwk".path else null;
+      hostScripts = mkHostScripts {
+        inherit cfg pkgs;
+        provisionerPasswordFile = if cfg.certificates.host.autoRenew
+          then adminJwkPath
+          else null;
+      };
       CAknownHosts = (lib.genAttrs caPatterns (_: {
-          certAuthority = true;
-          publicKey = lib.removeSuffix "\n" (builtins.readFile sshHostCAPath);
+        certAuthority = true;
+        publicKey = lib.removeSuffix "\n" (builtins.readFile sshHostCAPath);
       }));
-
-      wrappers = inputs.self.wrappers;
-      provisionerPasswordFile = config.sops.secrets."janus/admin_jwk".path;
-      sshHostCertSign = (wrappers.signHostWrapper.apply {
-        inherit pkgs provisionerPasswordFile;
-        inherit (cfg.certificates) provisioner;
-        inherit (cfg.certificates.host) extraPrincipals;
-      }).wrapper;
-      sshHostCertRenew = (wrappers.renewHostWrapper.apply {
-        inherit pkgs;
-        sshHostKeyFile = hostKeyFile;
-        overwrite = true;
-      }).wrapper;
-      sshHostCertCheck = (wrappers.hostCheckWrapper.apply {
-        inherit pkgs;
-        certPath = hostCertFile;
-      }).wrapper;
-      sshHostRenewalCheck = (wrappers.renewalCheck.apply {
-        inherit pkgs;
-        certPath = hostCertFile;
-        expires-in = "4h";
-      }).wrapper;
-      sshUserCertSign = (wrappers.signUserWrapper.apply {
-        inherit pkgs provisionerPasswordFile;
-        inherit (cfg.certificates) provisioner;
-        validUsers = [ "root" "john" "appdaemon" ];
-      }).wrapper;
-      sshUserCertCheck = (wrappers.userCheckWrapper.apply {
-        inherit pkgs;
-        certPath = "${cfg.user.keyFile}-cert.pub";
-      }).wrapper;
     in
     {
-      options.ssh-new = {
-        user = {
-          keyFile = lib.mkOption {
-            type = lib.types.str;
-            default = "$HOME/.ssh/id_ed25519";
-          };
-        };
-        host = {
-          configDir = lib.mkOption {
-            type = lib.types.str;
-            default = "/etc/ssh";
-          };
-          keyFile = lib.mkOption {
-            description = "String path to the host private key file";
-            type = lib.types.str;
-            default = "ssh_host_ed25519_key";
-          };
-          keyType = lib.mkOption {
-            description = "OpenSSH host key type for ssh.hostKey.";
-            type = lib.types.enum [ "ed25519" "rsa" "ecdsa" ];
-            default = "ed25519";
-          };
-          extraSettings = lib.mkOption {
-            description = "Extra settings to merge";
-            type = lib.types.attrs;
-            default = { };
-          };
-        };
-        certificates = {
-          provisioner = lib.mkOption {
-            type = lib.types.nullOr lib.types.str;
-          };
-          host = {
-            enable = lib.mkEnableOption "Enable SSH host certs";
-            autoRenew = lib.mkEnableOption "Auto-renew the SSH host certs with a systemd service/timer";
-            extraPrincipals = lib.mkOption {
-              type = lib.types.listOf lib.types.str;
-              default = [ ];
-            };
-          };
-          user = {
-            enable = lib.mkEnableOption "Enable SSH user certs";
-            CAFile = lib.mkOption {
-              description = "Filename of the SSH user CA with the config directory";
-              type = lib.types.str;
-              default = "ssh_user_ca_key.pub";
-            };
-            extraPrincipals = lib.mkOption {
-              type = lib.types.listOf lib.types.str;
-              default = [ ];
-            };
-          };
-        };
-      };
-
+      imports = [ sshCertConfig ];
       config = {
         services.openssh = {
           enable = true;
           openFirewall = true;
           hostKeys = [
             {
-              path = hostKeyFile;
+              path = hostScripts.hostKeyFile;
               type = cfg.host.keyType;
             }
           ];
@@ -120,7 +89,7 @@ in
             }
             cfg.host.extraSettings
             (lib.mkIf cfg.certificates.host.enable {
-              HostCertificate = "${hostKeyFile}-cert.pub";
+              HostCertificate = hostScripts.hostCertFile;
             })
             (lib.mkIf cfg.certificates.user.enable {
               TrustedUserCAKeys = "${cfg.host.configDir}/${cfg.certificates.user.CAFile}";
@@ -134,10 +103,10 @@ in
 
         environment.systemPackages = (
           lib.optionals cfg.certificates.host.enable [
-            sshHostCertSign
-            sshHostCertRenew
-            sshHostRenewalCheck
-            sshHostCertCheck
+            hostScripts.sign
+            hostScripts.renew
+            hostScripts.renewalCheck
+            hostScripts.check
           ]
         );
 
@@ -161,8 +130,8 @@ in
               Type = "oneshot";
               User = "root";
               Group = "root";
-              ExecCondition = lib.getExe sshHostRenewalCheck;
-              ExecStart = lib.getExe sshHostCertRenew;
+              ExecCondition = lib.getExe hostScripts.renewalCheck;
+              ExecStart = lib.getExe hostScripts.renew;
             };
           };
           timers.ssh-certs-renew = {
@@ -183,14 +152,8 @@ in
 
         home-manager.users.root = lib.mkIf cfg.certificates.user.enable {
           home.stateVersion = lib.mkDefault config.system.stateVersion;
-          imports = with inputs.self.modules.homeManager; [
-            ssh-new
-          ];
-          home.packages = [
-            sshUserCertSign
-            sshUserCertCheck
-          ];
-          ssh-new.certificates.enable = true;
+          imports = [ inputs.self.modules.homeManager.ssh-new ];
+          ssh-new.certificates.user.enable = true;
         };
       };
     };
@@ -198,26 +161,33 @@ in
   flake.modules.homeManager.ssh-new = { config, pkgs, lib, ... }:
     let
       cfg = config.ssh-new;
+      userKeyPath =
+        if lib.hasPrefix "/" cfg.user.keyFile || lib.hasPrefix "~/" cfg.user.keyFile
+        then cfg.user.keyFile
+        else "${config.home.homeDirectory}/.ssh/${cfg.user.keyFile}";
+      hasAdminJwk = lib.hasAttrByPath [ "sops" "secrets" "janus/admin_jwk" ] config;
+      adminJwkPath = if hasAdminJwk then config.sops.secrets."janus/admin_jwk".path else null;
+      hostScripts = mkHostScripts { inherit cfg pkgs; };
       sshHostCAContent = lib.removeSuffix "\n" (builtins.readFile sshHostCAPath);
       knownHostsText = lib.concatMapStrings
         (pattern: "@cert-authority ${pattern} ${sshHostCAContent}\n")
         caPatterns;
+      userScripts = mkUserScripts {
+        inherit cfg pkgs;
+        provisionerPasswordFile = adminJwkPath;
+      };
     in
     {
-      options.ssh-new = {
-        keyFile = lib.mkOption {
-          type = lib.types.str;
-          default = "${config.home.homeDirectory}/.ssh/id_ed25519";
-        };
-        certificates = {
-          enable = lib.mkEnableOption "Enable SSH client certificates";
-        };
-      };
-
+      imports = [ sshCertConfig ];
       config = {
-        home.file.".ssh/known_hosts" = lib.mkIf cfg.certificates.enable {
+        home.file.".ssh/known_hosts" = lib.mkIf cfg.certificates.user.enable {
           text = knownHostsText;
+          force = true;
         };
+        home.packages = lib.optionals cfg.certificates.user.enable [
+          userScripts.sign
+          userScripts.check
+        ];
         programs.ssh = {
           enable = true;
           enableDefaultConfig = false;
@@ -237,7 +207,7 @@ in
                   PasswordAuthentication = "no";
                   PreferredAuthentications = "publickey";
                   IdentitiesOnly = true;
-                  IdentityFile = cfg.keyFile;
+                  IdentityFile = userKeyPath;
 
                   StrictHostKeyChecking = "accept-new";
                   UserKnownHostsFile = "${config.home.homeDirectory}/.ssh/known_hosts";
@@ -251,13 +221,16 @@ in
                 }
               ]
               # SSH certificate settings
-              ++ lib.optionals cfg.certificates.enable [
+              ++ lib.optionals cfg.certificates.user.enable [
                 {
-                  CertificateFile = "${cfg.keyFile}-cert.pub";
+                  CertificateFile = "${userKeyPath}-cert.pub";
                 }
               ]
             );
-
+            "john-pc" = {
+              HostName = "192.168.1.85";
+              User = "john";
+            };
             "gitea" = {
               HostName = "192.168.1.104";
               User = "john";

modules/features/ssh/ssh-wrappers.nix

@@ -1,26 +1,14 @@
-{ self, inputs, ... }:
+{ self, inputs, config, ... }:
 let
+  sshCertConfig = config.optionModules.ssh-certs;
+  mkHostKeyFile = cfg: "${cfg.host.configDir}/${cfg.host.keyFile}";
   mkPrincipalArgs = principals:
     builtins.concatLists (map (principal: [ "--principal" principal ]) principals);
 in
 {
   flake.wrappers.signHostWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
-    options = {
-      provisioner = lib.mkOption {
-        type = lib.types.nullOr lib.types.str;
-        default = "admin";
-      };
-      provisionerPasswordFile = lib.mkOption {
-        type = lib.types.nullOr lib.types.str;
-      };
-      extraPrincipals = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
-        default = [ ];
-      };
-      overwrite = lib.mkEnableOption "Overwrite existing cert file?";
-    };
-
-    config = {
+    imports = [ sshCertConfig ];
+    config = let cfg = config.ssh-new; in {
       binName = "ssh-host-cert-sign";
       package = config.pkgs.step-cli;
       extraPackages = with config.pkgs; [ hostname iproute2 systemd ];
@@ -43,116 +31,90 @@ in
           "--principal" "$HOSTNAME"
           "--principal" "$IP_ADDRESS"
         ]
-        ++ lib.optionals (config.provisioner != null) [ "--provisioner" "${config.provisioner}" ]
-        ++ lib.optionals (config.provisionerPasswordFile != null) [
-          "--provisioner-password-file" "${config.provisionerPasswordFile}"
+        ++ lib.optionals (cfg.certificates.provisioner != null) [
+          "--provisioner" "${cfg.certificates.provisioner}"
         ]
-        ++ lib.optionals config.overwrite [ "-f" ]
-        ++ mkPrincipalArgs config.extraPrincipals;
+        ++ lib.optionals (cfg.certificates.provisionerPasswordFile != null) [
+          "--provisioner-password-file" "${cfg.certificates.provisionerPasswordFile}"
+        ]
+        ++ lib.optionals cfg.certificates.overwrite [ "-f" ]
+        ++ mkPrincipalArgs cfg.certificates.host.extraPrincipals;
     };
   });
 
   flake.wrappers.renewHostWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
-    options = {
-      sshHostKeyFile = lib.mkOption {
-        type = lib.types.str;
-        default = "/etc/ssh/ssh_host_ed25519_key";
-      };
-      overwrite = lib.mkEnableOption "Overwrite existing cert file?";
-    };
-
+    imports = [ sshCertConfig ];
     config = {
       binName = "ssh-host-cert-renew";
       package = config.pkgs.step-cli;
       extraPackages = with config.pkgs; [ systemd ];
       args =
-        [ "ssh" "renew" "${config.sshHostKeyFile}-cert.pub" "${config.sshHostKeyFile}" ]
-        ++ lib.optionals config.overwrite [ "-f" ];
+        let hostKeyFile = mkHostKeyFile config.ssh-new;
+        in [ "ssh" "renew" "${hostKeyFile}-cert.pub" "${hostKeyFile}" ]
+        ++ lib.optionals config.ssh-new.certificates.overwrite [ "-f" ];
     };
   });
 
   flake.wrappers.hostCheckWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
-    options = {
-      certPath = lib.mkOption {
-        type = lib.types.nullOr lib.types.str;
-        default = "/etc/ssh/ssh_host_ed25519_key-cert.pub";
-      };
-    };
-
+    imports = [ sshCertConfig ];
     config = {
       binName = "ssh-host-cert-check";
       package = config.pkgs.openssh;
       exePath = lib.getExe' config.pkgs.openssh "ssh-keygen";
-      args = [ "-Lf" "${config.certPath}" ];
+      args = [ "-Lf" "${mkHostKeyFile config.ssh-new}-cert.pub" ];
     };
   });
 
   flake.wrappers.signUserWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
-    options = {
-      provisioner = lib.mkOption {
-        type = lib.types.nullOr lib.types.str;
-        default = "admin";
-      };
-      provisionerPasswordFile = lib.mkOption {
-        type = lib.types.nullOr lib.types.str;
-      };
-      validUsers = lib.mkOption {
-        description = "A list of the user names that this cert will be valid for";
-        type = lib.types.listOf lib.types.str;
-        default = [ ];
-      };
-      overwrite = lib.mkEnableOption "Overwrite existing cert file?";
-    };
-
-    config = {
+    imports = [ sshCertConfig ];
+    config =
+    let
+      cfg = config.ssh-new;
+    in {
       binName = "ssh-user-cert-sign";
       package = config.pkgs.step-cli;
       args = [ "ssh" "certificate" "--sign" ]
-        ++ lib.optionals (config.provisioner != null) [ "--provisioner" "${config.provisioner}" ]
-        ++ lib.optionals (config.provisionerPasswordFile != null) [
-          "--provisioner-password-file" "${config.provisionerPasswordFile}"
+        ++ lib.optionals (cfg.certificates.provisioner != null) [
+          "--provisioner" "${cfg.certificates.provisioner}"
         ]
-        ++ lib.optionals config.overwrite [ "-f" ]
-        ++ mkPrincipalArgs config.validUsers;
+        ++ lib.optionals (cfg.certificates.provisionerPasswordFile != null) [
+          "--provisioner-password-file" "${cfg.certificates.provisionerPasswordFile}"
+        ]
+        ++ lib.optionals cfg.certificates.overwrite [ "-f" ]
+        ++ mkPrincipalArgs cfg.certificates.user.extraPrincipals;
     };
   });
 
   flake.wrappers.userCheckWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
-    options = {
-      certPath = lib.mkOption {
-        type = lib.types.nullOr lib.types.str;
-        default = "$HOME/.ssh/id_ed25519-cert.pub";
-      };
-    };
-
-    config = {
+    imports = [ sshCertConfig ];
+    config =
+    let
+      cfg = config.ssh-new;
+    in {
       binName = "ssh-user-cert-check";
       package = config.pkgs.openssh;
       exePath = lib.getExe' config.pkgs.openssh "ssh-keygen";
-      args = [ "-Lf" "${config.certPath}" ];
+        args = [ "-Lf" "$HOME/.ssh/${config.ssh-new.user.keyFile}-cert.pub" ];
     };
   });
 
   flake.wrappers.renewalCheck = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
-    options = {
-      certPath = lib.mkOption {
-        type = lib.types.nullOr lib.types.str;
-        default = "$HOME/.ssh/id_ed25519-cert.pub";
-      };
-      expires-in = lib.mkOption {
-        type = lib.types.str;
-        default = "4h";
-      };
-    };
-    config = {
+    imports = [ sshCertConfig ];
+    config =
+    let
+      cfg = config.ssh-new;
+      hostKeyFile = mkHostKeyFile cfg;
+      hostCertFile = "${hostKeyFile}-cert.pub";
+    in
+    {
       binName = "ssh-renewal-check";
       package = config.pkgs.step-cli;
       preHook = ''
-        echo "Checking SSH cert at ${config.certPath}"
+        echo "Checking SSH cert at ${hostCertFile}"
       '';
       args = [
-        "ssh" "needs-renewal" "${config.certPath}"
-        "--expires-in" "${config.expires-in}"
+        "ssh" "needs-renewal" hostCertFile
+        "--expires-in" "${cfg.certificates.host.expires-in}"
       ];
     };
   });

modules/hosts/john-pc/default.nix

@@ -17,8 +17,8 @@ in
     imports = with inputs.self.modules.homeManager; [
       rebuild
       john
-      mtls
-      restic
+      # mtls
+      # restic
       docker
       desktop
       step-client
@@ -33,6 +33,7 @@ in
 
     targets.genericLinux.enable = true;
 
+    homeManagerFlakeDir = flakeDir;
     home.username = "${username}";
     home.homeDirectory = "/home/${username}";
     home.packages = with pkgs; [
@@ -45,10 +46,12 @@ in
       }).wrapper
     ];
 
-    homeManagerFlakeDir = flakeDir;
     docker.enable = true;
     ssh-new = {
-      certificates.enable = true;
+      certificates = {
+        provisioner = "admin";
+        user.enable = true;
+      };
     };
     # ssh = {
     #   matchSets = {
@@ -71,18 +74,18 @@ in
       mode = "0400";
       sopsFile = ./secrets.yaml;
     };
-    restic = {
-      passwordFile = resticPasswordFile;
-      OnCalendar = "*:0/15";
-      paths = [ "${config.xdg.userDirs.documents}" "/conf" ];
-      exclude = [
-        "/home/*/Pictures"
-        "/home/*/Videos"
-        "/home/*/go"
-        "/home/*/snap"
-        "/home/john/john-nas"
-      ];
-    };
+    # restic = {
+    #   passwordFile = resticPasswordFile;
+    #   OnCalendar = "*:0/15";
+    #   paths = [ "${config.xdg.userDirs.documents}" "/conf" ];
+    #   exclude = [
+    #     "/home/*/Pictures"
+    #     "/home/*/Videos"
+    #     "/home/*/go"
+    #     "/home/*/snap"
+    #     "/home/john/john-nas"
+    #   ];
+    # };
     # mtls = {
     #   enable = true;
     #   subject = hostname;

modules/nix-tools/user.nix

@@ -9,14 +9,18 @@
     # homeImports ? [ ],
     # homePackages ? [ ],
   }: {
-    nixos."${username}" = { config, lib, pkgs, ... }: {
+    nixos."${username}" = { config, lib, pkgs, ... }:
+      let
+        jslZsh = inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.jsl-zsh;
+        jslZshExe = lib.getExe' jslZsh "jsl-zsh";
+      in {
       imports = [
         inputs.home-manager.nixosModules.home-manager
       ];
 
       environment.shells = [
         "${lib.getExe pkgs.zsh}"
-        "${lib.getExe inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.jsl-zsh}"
+        jslZshExe
       ];
 
       users.groups."${username}" = {};
@@ -25,7 +29,7 @@
         isNormalUser = true;
         group = username;
         home = "/home/${username}";
-        shell = pkgs.zsh;
+        shell = jslZshExe;
         extraGroups = [ "input" "networkmanager" "video" "render" ]
           ++ lib.optional isAdmin "wheel"
           ++ lib.optional config.virtualisation.docker.enable "docker"
@@ -38,6 +42,14 @@
       security.sudo-rs.enable = lib.mkIf isAdmin true;
 
       home-manager.useGlobalPkgs = true;
+      # DetNix warns when HM generates options.json for manuals; disable manual outputs.
+      home-manager.sharedModules = [
+        {
+          manual.manpages.enable = false;
+          manual.html.enable = false;
+          manual.json.enable = false;
+        }
+      ];
       # https://github.com/Doc-Steve/dendritic-design-with-flake-parts/wiki/Dendritic_Aspects#multi-context-aspect
       home-manager.users."${username}" = {
         imports = [ self.modules.homeManager."${username}" ];

modules/programs/sops.nix

@@ -35,7 +35,7 @@ in
 
       config =
         let
-          identityFile = config.ssh-new.keyFile;
+          identityFile = "${config.home.homeDirectory}/.ssh/${config.ssh-new.user.keyFile}";
           my-sops = (inputs.self.wrappers.mySops.apply {
             inherit pkgs;
             sshKey = identityFile;

modules/users/john.nix

@@ -16,44 +16,46 @@ in
     authorizedKeys = [
       # Shared keys for every host can go here.
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIAUa4dcg1TWc4pW++uodyhX4eOqrX/QYIxFWtEP7HFJ john@john-pc-ubuntu"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFn5ilhqaeDsOWSk7y29se2NvxGm8djlfL3RGLokj0q6 john@john-p14s"
     ];
   };
 
   flake.modules = {
-    nixos."${username}" = { config, pkgs, ... }: {
+    nixos."${username}" = { config, pkgs, ... }: let
+      selfMeta = inputs.self.meta.users."${username}";
+    in {
       imports = [
         baseUserModules.nixos."${username}"
       ];
       users.users."${username}" = {
-        openssh.authorizedKeys.keys = inputs.self.meta.users."${username}".authorizedKeys;
+        openssh.authorizedKeys.keys = selfMeta.authorizedKeys;
       };
     };
 
     # This module will be imported by the user factory
-    homeManager."${username}" = { pkgs, ... }:
-      with inputs.self.meta.users."${username}";
-      let
-        selfPkgs = inputs.self.packages.${pkgs.stdenv.hostPlatform.system};
-      in {
-        home.stateVersion = "25.11";
-        imports = with inputs.self.modules.homeManager; [
-          ssh-new
-          shell-tools
-          git
-        ];
-        xdg.enable = true;
-        home.packages = [
-          selfPkgs.neovim-min
-        ];
-        home.sessionVariables = {
-          EDITOR = "nvim";
-          VISUAL = "nvim";
-          GIT_EDITOR = "nvim";
-          SOPS_EDITOR = "nvim";
-        };
-        programs.git.settings.user.name = name;
-        programs.git.settings.user.email = email;
-        programs.git.settings.core.editor = "nvim";
+    homeManager."${username}" = { pkgs, ... }: let
+      selfMeta = inputs.self.meta.users."${username}";
+      selfPkgs = inputs.self.packages.${pkgs.stdenv.hostPlatform.system};
+    in {
+      home.stateVersion = "25.11";
+      imports = with inputs.self.modules.homeManager; [
+        ssh-new
+        shell-tools
+        git
+      ];
+      xdg.enable = true;
+      home.packages = [
+        selfPkgs.neovim-min
+      ];
+      home.sessionVariables = {
+        EDITOR = "nvim";
+        VISUAL = "nvim";
+        GIT_EDITOR = "nvim";
+        SOPS_EDITOR = "nvim";
       };
+      programs.git.settings.user.name = selfMeta.name;
+      programs.git.settings.user.email = selfMeta.email;
+      programs.git.settings.core.editor = "nvim";
+    };
   };
 }