started secrets reorg

.sops.yaml

@@ -1,14 +1,17 @@
 keys:
   - &john-p14s age1f6drjusg866yscj8029tk4yfpgecklrvezldm02ankm6h8nnwu5s2u6ahy
   - &john-pc age1ykcs39e62pz3xu6cedg8ea685kv5d5qsrhgkndygzm8rx30xd5ys5t3qxt
+  - &test-nix age1gvplss0ddmyf6vpjy363wu3n057vhm0j6n7tc94cxd8kadapypws5mtaj0
 creation_rules:
   - path_regex: \.yaml$
     key_groups:
     - age:
       - *john-p14s
       - *john-pc
+      - *test-nix
   - path_regex: \.json$
     key_groups:
     - age:
       - *john-p14s
       - *john-pc
+      - *test-nix

README.md

@@ -15,7 +15,15 @@ nix flake show --all-systems
 ## Layout
 
 - Everything under `./modules` gets auto-imported by `import-tree`
-- 
+
+| Directory     | Description |
+| ------------- | ----------- |
+| `hosts`       | Provides either `homeConfigurations` or `nixosConfigurations` |
+| `nix-tools`   | Nix-specific tools, like factory functions for use in the flakes |
+| `nixos`       | `flake.modules.nixos` |
+| `programs`    | flakes that provide `flake.modules` attributes for specific programs |
+| `services`    | flakes that provide configuration for running services |
+| `users`       | flakes that provide configuration for individual users with the `flake.factory.user` factory |
 
 ## Mechanics
 

flake.lock

@@ -2,11 +2,11 @@
   "nodes": {
     "flake-file": {
       "locked": {
-        "lastModified": 1772999280,
-        "narHash": "sha256-XX60YlqSKa/QNIJVnLeEXNDQPwrQucMuITef6rEJqIs=",
+        "lastModified": 1773554778,
+        "narHash": "sha256-keH0VNsci9e0Uwt3Msp/N+pltaP8Lb6lt09Q3WvDPw4=",
         "owner": "vic",
         "repo": "flake-file",
-        "rev": "e2a19eb539fa7be4537f6e73e7556edf031eed7f",
+        "rev": "f4780a86bd4c756475d839b286f8a40aabdbc802",
         "type": "github"
       },
       "original": {
@@ -76,11 +76,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1772985285,
-        "narHash": "sha256-wEEmvfqJcl9J0wyMgMrj1TixOgInBW/6tLPhWGoZE3s=",
+        "lastModified": 1773608492,
+        "narHash": "sha256-QZteyExJYSQzgxqdsesDPbQgjctGG7iKV/6ooyQPITk=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "5be5d8245cbc7bc0c09fbb5f38f23f223c543f85",
+        "rev": "9a40ec3b78fc688d0908485887d355caa5666d18",
         "type": "github"
       },
       "original": {
@@ -91,11 +91,11 @@
     },
     "import-tree": {
       "locked": {
-        "lastModified": 1772999353,
-        "narHash": "sha256-dPb0WxUhFaz6wuR3B6ysqFJpsu8txKDPZvS47AT2XLI=",
+        "lastModified": 1773554199,
+        "narHash": "sha256-6apV5N1F5tTD8JY9AUGnkWmy56HqDPn4MNFRsq4Rg+s=",
         "owner": "vic",
         "repo": "import-tree",
-        "rev": "545a4df146fce44d155573e47f5a777985acf912",
+        "rev": "c6ebc59c85ee54cfb68163d06d1a3149ce0fe431",
         "type": "github"
       },
       "original": {
@@ -127,11 +127,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1772773019,
-        "narHash": "sha256-E1bxHxNKfDoQUuvriG71+f+s/NT0qWkImXsYZNFFfCs=",
+        "lastModified": 1773389992,
+        "narHash": "sha256-wvfdLLWJ2I9oEpDd9PfMA8osfIZicoQ5MT1jIwNs9Tk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "aca4d95fce4914b3892661bcb80b8087293536c6",
+        "rev": "c06b4ae3d6599a672a6210b7021d699c351eebda",
         "type": "github"
       },
       "original": {
@@ -143,11 +143,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1772771118,
-        "narHash": "sha256-SDEGkbscgwFhxzfvNdDNcvsA82gAQcyOh0/BZOb6fWg=",
-        "rev": "e38213b91d3786389a446dfce4ff5a8aaf6012f2",
+        "lastModified": 1773507054,
+        "narHash": "sha256-yzDBkI1CpeZrAt4l1nGvTOs3OFtXCS7a7Gi5Y1h878w=",
+        "rev": "e80236013dc8b77aa49ca90e7a12d86f5d8d64c9",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre958959.e38213b91d37/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre963414.e80236013dc8/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
@@ -190,11 +190,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772944399,
-        "narHash": "sha256-xTzsSd3r5HBeufSZ3fszAn0ldfKctvsYG7tT2YJg5gY=",
+        "lastModified": 1773550941,
+        "narHash": "sha256-wa/++bL2QeMUreNFBZEWluQfOYB0MnQIeGNMuaX9sfs=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "c8e69670b316d6788e435a3aa0bda74eb1b82cc0",
+        "rev": "c469b6885f0dcd5c7c56bd935a0f08dbcd9e79e1",
         "type": "github"
       },
       "original": {

keys/root_ca.crt

@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBlDCCATqgAwIBAgIRAKDvqOX8WVhJ/ev02Y1gXKQwCgYIKoZIzj0EAwIwKDEO
+MAwGA1UEChMFSmFudXMxFjAUBgNVBAMTDUphbnVzIFJvb3QgQ0EwHhcNMjUxMjE4
+MDYwMjI4WhcNMzUxMjE2MDYwMjI4WjAoMQ4wDAYDVQQKEwVKYW51czEWMBQGA1UE
+AxMNSmFudXMgUm9vdCBDQTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABMt6kNpx
+Q9vySc1N6F9jJObeQXZI+9f33E1cN4zbEuNpmtpRl0WaPa1AGNbSi5sIbiH7wDv2
+llXfCqYWkeoCE5mjRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/
+AgEBMB0GA1UdDgQWBBRo55byyyo2sePP+8zz+uM4mXNV+zAKBggqhkjOPQQDAgNI
+ADBFAiB6zxTbvWMZWgDQhKGh+MnGQQ7f8UGhzinOfRG7a/HdOAIhAIVWt6MLl6QU
+FOvl/qIFGd7YJeWU5aahPABVttxjSMn/
+-----END CERTIFICATE-----

keys/secrets.yaml

@@ -1,3 +1,8 @@
+janus:
+    fingerprint: ENC[AES256_GCM,data:A0eNE3nX8hVq8m4bNFvkTGR15Xh9QV44JpOJFyhZojPOTirRGEq/MCSNIqpKfoFUB4TXdRZIN95pAoNlO7Z2dQ==,iv:3TQ9ZcjRmnQzkNA5Cv/cpEIT8gTJ1w3cTjTVtxtuzq4=,tag:hIwcjdZ6R8UzUgh/VoDz3A==,type:str]
+    admin_jwk: ENC[AES256_GCM,data:HhsnsCsR87ItjEKP3MsHpxb/WZHvxRrMIhbBgW7qq/0=,iv:b5MKd5TFkxFjd1zY0Lfi2QDv4sLmyKn7riW8s/EfDeA=,tag:GkGfyAM2RtKzuo567bAjiA==,type:str]
+test-nix:
+    ssh_host_key: ENC[AES256_GCM,data:04CRKNCycc8Dre44ERtytmX6NHdZOIds95ckYzmi/i74qEYyN/L5XsuKKmjH2WCn3brvK4pZLLIZWzxC5VJ85q+O8Tfd3qdFROTG5qYRvmK5huxphPaIWSUI2ZEdLqecpRtmq7Zeq+Xa2+JKC0ehg2sqavotkPM5vIeVsaStD5rMVSgnuGaTS3WuPPfEjJPfsCyGPup4ysgxKxfc3JXOR+T8t6w4ccG0Si6tGz6io0Sl9tgPzrYqwqTaMtWLUA50luJg+D8ZxpMjpqFNbIry2tKwettzwXtGz7xGYnjvuk+1sCdYl8PXOMRT2KwAy5usCJsWFRTXJzZ5kxzwAYLwmhlsfPuxwTrR5fRETJPglRP/1muq8piIZn6yHtq9dCSrNcDCZnjnjG+cby28yPLYKhDgVNF5DObob8e6Fp/nP00sdi4Bt1aHRR5pjK/9mpsWE6ikO83SUi4xSoL1LKZM2kC5DL8XBJP7nWQTwijp84m3htMKvrKfFo68G9xP4v/DhVcHLsoNGLytH5omAuGL,iv:0cAtrXlPBis8nYw1XT4kSPRuwVkq0XSh6jjY9mpewIA=,tag:WFsiOe/l8cVicOqX2C94xA==,type:str]
 restic_password:
     john_ubuntu: ENC[AES256_GCM,data:Q4lUaFFDgoK9k4kQj7hSVKaFDGW0T+6V+OpFU5R528R3EKM7YJMgcFX+sK3mWl9XA4/6E1GeINpIqOpx+FP5Cf/8qt9sXBXCmXXSYdA4IH3RS6a1NkcIVjsTMvpn4q/fslCeYN4LB+r4pBGmdca105miqVun8J69cZGwjZ+wuxrMAP+mdnHdSUPycjNWJJzmEa3waQsygAi4A5cAN5sigOPBxe2pCTh/FEKoTgWmzHGJvcjrzuL6wNOpQrkMWwTsHCtbe9dyMP/fQpoBgYDT4W9Rd4XHhbrooje+g3x48EL1rkRIVVNRavpRUih/mjcdJGzzJ6jZmLLcc1f7SZIKZht7f+ZcdZl3rKQB+WanZgK/KAgKBRCrbIk2eeBZwkcRSw5kmGFU7x0azdIipJYj+3KHHQS5S2VW4j2tQG74xK3qaNJcSMjpKmdI1dHcPf0x2ILaDDV9Ts0H4GTOB2zO9iGy7x2tdPd4tugxxk5rr5rphTZL3lgUf0Ri/qMkJh9I8CsjUdvRycHeIEUZPmEVaIqJC2jrd2pBslis5VWD/6PHQBCob07d1fcpIYox4YXM3GcLg3OxiD8nZ7DTzGRMhciZtTKKWbBT8qzPud4ZQvDkT5l+XOpeM13wXFIMa13CwOzYeyWjycED0VQ/i3XRw9+9lg3cosfxaPdaFtv4MjV7Od62G/UJw3OxaQOHM2y24N+Q0pSBoTdDAFwDCH/kcqZji6ZrVTu4Rad8opcILJJcqC+pjegDvBtUdDz+G3/dFiS6m8RYIRb7qB5yEX/lCgzlECmRS2XP8uraNJ5NN8rtk0gdBtaI9/78YyAjLLGkjIcIR4uJA5buCZBR9jIdqf4f52fowbx18VPrwFXN2mYX6mPsKbDmaz0ILHq/I9n8bS/KM7gIQmTw/RAUwnmL4IRu8zHn6nmIqj6d8AkjYx7s6pG8OF8LgfhqZT7tdPKCd+n/HnYn1fZGSw26zHzPd4nKnVV1e3NYvX6CVwVycerGs9elOKtOI8GsrWYyXzJbfC+nWxbHKI/t6sxyzTBrHPR4r6l/CchQF+SfBs5aELKExe7h325qBB2y6EFdkbxTj1tPGqxttp9xJB1LUyNtwsEAkpD44JNqPxZCYHQbeVE3Oo3TYtRUSVWREc1WNIsfSG/anScYUhDEah9YyIdiG+O71QqegunusLoxmpF2rQtx7shtAvJV3skDBB0tFDoQyIV+yPo7kPV0D7Ig+Ba+mk5ASJrT9DXZ53Q2CCTLAuslU4MP7g22RX8rU3s2hFJq8m7wvMwpqa9Tr6O38i1wX4PhG1VRMM8EIlMQnLWWKmni6NbOYiRxFYJMioxH5SyE4ODQYXy5YIuLoRsX8VR6UqJ1GZb7sJf3M1aPOFOHzTN9hnziTRRe1KCMoBrAghrqhvL1VRr9X5PYMxnjBh6o0d5YTN0WOGD2iEVbCzqxFXcxQZBBp4KyNAAhFhGNw8WUp/rVoyCYn7+OEYFspY4FmGMTYhvxbq5LEptXeQgOP2ggBkqsw8sYP9oj1cb4kzBNv8M7nR9kM1EqvZpFV47phoTbBeMY4DZOJodkASFVM5/7ijWy/M9rtWMFMCXKURKkAQJRFADs0KqMJ5osnFFnubX7vKgK736XXF4+wIQuuHqEsYDZ90ftInxq8sYRnb2FZ0EV4yc8qqnz++fjwrAA5EV+zhL6l6hum1zL8JkUJ1ICKZ905If6nIeoul8MY3B1Cz4W+osN2Wtl8OeJ2t3iZx3wk/unVa8uDZH1owu47He68e2V8vpYxOaW4/hLyy/XuL5DukETrhRjC+7GbEaKaCwoA2UwAdqU,iv:N8ek+tp16WiZgjTDxXb0CRXH+MbLsl/oZ/OwcOoVRO0=,tag:uIzCSX0R/EObF/RdWxj64w==,type:str]
 api:
@@ -7,22 +12,31 @@ sops:
         - recipient: age1f6drjusg866yscj8029tk4yfpgecklrvezldm02ankm6h8nnwu5s2u6ahy
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoWkxDSnlNT2Vua1ZXWC8r
-            SU9UMnhaVXVEVlZGL3dtYTBJSzNGbHVaSTJNCm9ZTFM3RndpRktUcWhwZk1Fc2dk
-            ZGtoWXdoOWVyK1F0YStSS3dsMkg2R28KLS0tIFkrdVFZNlVxRjhPaWdMZXl2elV3
-            TVpyTzFsNFNmd3FNU0tlMnlTOHNTQWsKfKdN4epZokF74bCNr9+jxulZJFBQM83P
-            quMhl+H85My8jAsEeC9CW7y2jdNPJkfk9gHun4ozoW8U7o6y5RLfJg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0UEpja2kxdThZVWZhOGVP
+            S0NtSi84MjhnN0RORkh2NjZ4YlYvWS9kZDBNClFzYnVxWnhmQkpCRkRFVUx1RDdX
+            ZHFqYXRqYXM0cWJzcU5EeEtSR1BUVzAKLS0tIDdEY2pnVTJqWlNZVkZldXVYVmFH
+            dVNBRUVodU5sRnpVcG1GZ1RiZzhjTXMKefqBvvD/qZwcSHmFjUnleukVRLueG36Y
+            Q81KlwQweF2F8kHl7Bqsi+3hH1dZZbVm3vjuGpWFOoti7fowUV55Kw==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1ykcs39e62pz3xu6cedg8ea685kv5d5qsrhgkndygzm8rx30xd5ys5t3qxt
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSakZRUnkraWtId2h3eUhB
-            REpkUHhYMm1MSmtFU2pvd1BpQ0xRTTlCWkZJCkxrTm1sdDBqclJ3RHR6VkllOFpo
-            ZXRtS2lsazRDS2lyRnZmT3FTTjJ6WUUKLS0tIExxNlFoeDhHQ3l5a1VvUHNRWUdw
-            Mms2UEhFSU82UWR5Z1VvU25qenJUQm8KtQeZDIfJIczm1l8ql/WmVEf8KI9dg0vw
-            9rNSjtBkEttVd21zUSOziG4513abllE8NFTkAc1z3HacuXpHTBnd5A==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqZFZxbDhVUWFEUGhPMlZI
+            SFdBYkpxSnAxTUZXbjVwQnlZQ3l1SWtuZGg0CmVBdnVHbTNUcmwvK01iMnZKZTJh
+            ajFla3kzYUl4ZWY3czA0WUdNM2lpVFUKLS0tIHo5Uk1pV296MXdnUTZGQ25haWZG
+            QWZDWGRaRDBhY1ZkZk5oTHY0ZVV2RXMKanv+WWRhf5nl+aw/T6QZFVQQmhV1DZfB
+            jkSzOAKOgPx7toYFmpq9E8fAH+zrMzDbxI2z2uyrOFI6v+QE0Ul/iQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-08-03T17:03:22Z"
-    mac: ENC[AES256_GCM,data:c3rcMHTRxbnpQoW5eLn0X1aCL1v2ft05UTcHaCuGiCaF3b/loVjEQr30pepBgR07PSleTIi375Y0Rj8ik8Ot3j+Zl5BR32bEtqf6gcWwz6oSmeORDrJS15698d7/avJl82/EC0ZN77j+fcdkWZrCJHb47HGfRxKl9L5HbyWasA4=,iv:g3d3C571uYpTTFixYZg+ztg8jTdof1g6Hb5gtRvpRkk=,tag:8kAxrUwUVeWvpYjWMDE+AA==,type:str]
+        - recipient: age1gvplss0ddmyf6vpjy363wu3n057vhm0j6n7tc94cxd8kadapypws5mtaj0
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZcGtMNi9RSG5aTVV5cWdT
+            NittUXN0Qnpld1YvOU50OUh3Z3ZiSzhHOHdNCnc4TmdYbS9QQnBLbldHSytIdkJl
+            R0psQWxkZTgyZTRzckkrTGpyNCsvR2sKLS0tIEdLb05aT2I2S3BKcFRrVmtvTGw5
+            Z1orRCtkTDVXSktuck5pTmV4K05qZHMKZlHHu07q+GnyDDgdwW2Ic3P23PmoSPwn
+            WuNLZdlZQleROaRb+zpD+9P1HGGJ3mWAlNlnmjGrRk453k1PbBQ5Og==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-15T15:06:29Z"
+    mac: ENC[AES256_GCM,data:cF/TJ8VkzrHRUrO5iGdRdlFtqV/5EQ15JwQKIywJvsh0NERK67T21czSP7923MiL0u5QTVPn/rO8R5E/8gBu3r8+fLq+CFl9PDQHEX2JhnYOD5WZR412WMZq3MVR94IMTOrQANMVpS4uhMyvnrqOe4AenxLDyzrYhkwf1KQh4w0=,iv:Qwy8z4uXGMlf+kTMNiE42M9l8LtSJ+O7diknRrsSeYI=,tag:qlCY9r8HnEDmq/jw59C/sg==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.10.2
+    version: 3.12.1

keys/ssh_user_ca.pub

@@ -0,0 +1 @@
+ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNpgz9xYE3K+JeQ7vtDA07iWlp0xTXB+G8MBzX6/RluXs8E6v+ahx90M093EYIOImaW6npWQ0JnFtmZaet5l9Ao=

modules/default.nix

@@ -1,9 +1,7 @@
 { inputs, ... }:
 {
-
   imports = [
     # https://github.com/vic/flake-file/tree/main/modules/dendritic
     inputs.flake-file.flakeModules.dendritic
   ];
-
 }

modules/home-manager/profiles/base.nix

@@ -1,12 +0,0 @@
-{ inputs, pkgs, ... }:
-{
-  flake.homeModules.base = { pkgs, ... }:
-  {
-    imports = with inputs.self.homeModules; [
-      rebuild
-      ssh
-      git
-      shell-tools
-    ];
-  };
-}

modules/home-manager/programs/bash.nix

@@ -1,10 +0,0 @@
-{
-  flake.homeModules.bash = { pkgs, ... }:
-  {
-    programs.bash = {
-      enable = true;
-      enableCompletion = true;
-      package = pkgs.bash;
-    };
-  };
-}

modules/home-manager/programs/resticprofile.nix

@@ -1,85 +0,0 @@
-{ inputs, ... }:
-{
-  perSystem = { pkgs, ... }:
-    let
-      resticprofilePkg = pkgs.buildGoModule rec {
-        pname = "resticprofile";
-        version = "0.32.0";
-        src = pkgs.fetchFromGitHub {
-          owner = "creativeprojects";
-          repo   = "resticprofile";
-          rev    = "v${version}";
-          sha256 = "sha256-fmYsoGYppNgbtoX18aF5UHBG9ieYorBJ9JZkwrR+UBI=";
-        };
-        vendorHash = "sha256-/GVWjOvkYe7xMRjANKIKV6FSU0F5VY1ZP/ppgAJyhvw=";
-        goPackagePath = "github.com/creativeprojects/resticprofile";
-        doCheck = false;
-        meta = with pkgs.lib; {
-          description = "Configuration profiles manager and scheduler for restic backup";
-          homepage    = "https://creativeprojects.github.io/resticprofile/";
-          license     = licenses.gpl3Only;
-          maintainers = [ ];
-          mainProgram = "resticprofile";
-        };
-      };
-    in {
-      packages = {
-        resticprofile = resticprofilePkg;
-        default = resticprofilePkg;
-      };
-    };
-
-  flake.homeModules.resticprofile = { config, lib, pkgs, ... }:
-    let
-      cfg = config.programs.resticprofile;
-      yamlFormat = pkgs.formats.yaml { };
-      baseProfile = import ../../../resticprofile/base.nix { inherit lib config; };
-      profiles = lib.recursiveUpdate baseProfile cfg.profiles;
-    in {
-      options.programs.resticprofile = {
-        enable = lib.mkEnableOption "Enable resticprofile (Restic backup profile manager)";
-        package = lib.mkPackageOption pkgs "resticprofile" { };
-        profiles = lib.mkOption {
-          type = lib.types.attrsOf yamlFormat.type;
-          default = { };
-          description = ''
-            Additional resticprofile configuration merged on top of the base profile.
-            Each attribute becomes a profile entry in
-            `$XDG_CONFIG_HOME/resticprofile/profiles.yaml`.
-          '';
-        };
-      };
-
-      config = lib.mkIf cfg.enable (
-        let
-          resticprofilePackage = lib.mkDefault
-            inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.resticprofile;
-          resticprofileBin = lib.getExe cfg.package;
-          rpScript = pkgs.writeShellScriptBin "rp" ''
-            set -e
-            sudo ${resticprofileBin} --config "${config.xdg.configHome}/resticprofile/profiles.yaml" $@
-          '';
-          rpbackupScript = pkgs.writeShellScriptBin "rp-backup" ''
-            ${lib.getExe rpScript} run-schedule backup@default
-          '';
-        in {
-          programs.resticprofile.package = resticprofilePackage;
-          home.packages = [
-            cfg.package
-            rpScript
-            rpbackupScript
-            (pkgs.writeShellScriptBin "rps" ''
-              set -e
-              ${lib.getExe rpScript} unschedule --all
-              ${lib.getExe rpScript} schedule --all
-            '')
-            (pkgs.writeShellScriptBin "rp-test" "${lib.getExe rpbackupScript} --dry-run")
-          ];
-          xdg.configFile."resticprofile/profiles.yaml".source = yamlFormat.generate "profiles" {
-            version = "2";
-            profiles = profiles;
-          };
-        }
-      );
-    };
-}

modules/home-manager/programs/ssh.nix

@@ -1,120 +0,0 @@
-{inputs, ... }:
-let
-  userName = "john";
-in
-{
-  flake.homeModules.ssh = { pkgs, config, lib, ... }:
-  {
-    options.ssh = {
-      IdentityFile = lib.mkOption {
-        # Intentionally not using a path type here because that will end up with the private key getting copied into the store
-        type = lib.types.str;
-        default = "${config.home.homeDirectory}/.ssh/id_ed25519";
-        description = "Path to the SSH identity file.";
-      };
-
-      matchSets = {
-        appdaemon = lib.mkEnableOption "Enable AppDaemon SSH targets";
-        certs = lib.mkEnableOption "Enable Janus and Soteria SSH targets";
-        homelab = lib.mkEnableOption "Enable various Homelab targets";
-        dev = lib.mkEnableOption "Enable development targets";
-      };
-    };
-
-    # All this stuff has to be wrapped in a config attribute because of the presence of the options here?
-    config = let
-      identityFile = config.ssh.IdentityFile;
-      publicKeyFile = "${identityFile}.pub";
-      certificateFile = "${identityFile}-cert.pub";
-      userKnownHostsFile = "${config.home.homeDirectory}/.ssh/known_hosts";
-    in {
-      home.packages = [
-        (pkgs.writeShellScriptBin "sign-ssh-cert" ''
-          echo "Signing ${publicKeyFile}"
-          echo "Copy the Step-CA JWK Provisioner password from 1password"
-          step ssh certificate --sign \
-          --principal root \
-          --principal ${userName} \
-          --principal appdaemon \
-          --provisioner admin \
-          ${userName} ${publicKeyFile}
-        '')
-      ];
-
-      programs.ssh = {
-        enable = true;
-        enableDefaultConfig = false;
-        extraConfig = ''
-          SetEnv TERM="xterm-256color"
-          IdentityAgent ~/.1password/agent.sock
-        '';
-
-        matchBlocks = lib.mkMerge [
-          {
-            "*" = {
-              user = "john";
-
-              compression = false;
-              serverAliveInterval = 0;
-              serverAliveCountMax = 3;
-
-              identitiesOnly = true;
-              inherit identityFile certificateFile;
-
-              hashKnownHosts = false;
-              userKnownHostsFile = "${userKnownHostsFile}";
-
-              addKeysToAgent = "yes";
-              forwardAgent = false;
-            };
-          }
-          (lib.mkIf config.ssh.matchSets.appdaemon {
-            "appdaemon" = {
-              hostname = "192.168.1.242";
-              user = "appdaemon";
-            };
-            "ad-nix" = {
-              hostname = "192.168.1.201";
-              user = "appdaemon";
-            };
-          })
-          (lib.mkIf config.ssh.matchSets.certs {
-            "janus" = {
-              hostname = "janus.john-stream.com";
-              user = "root";
-            };
-            "soteria" = {
-              hostname = "soteria.john-stream.com";
-              user = "john";
-            };
-          })
-          (lib.mkIf config.ssh.matchSets.homelab {
-            "docs" = {
-              hostname = "192.168.1.110";
-              user = "root";
-            };
-            "gitea" = {
-              hostname = "192.168.1.104";
-              user = "john";
-            };
-            "hermes" = {
-              hostname = "192.168.1.150";
-              user = "root";
-            };
-            "panoptes" = {
-              hostname = "192.168.1.107";
-              user = "panoptes";
-            };
-          })
-          (lib.mkIf config.ssh.matchSets.dev {
-            "test-nix" = {
-              hostname = "fded:fb16:653e:25da:be24:11ff:fea0:753f";
-              user = "john";
-              identityFile = identityFile;
-            };
-          })
-        ];
-      };
-    };
-  };
-}

modules/home-manager/programs/sublime.nix

@@ -1,5 +0,0 @@
-{
-  flake.homeModules.sublime = {
-    # TODO: Port `graphical.sublime = true` into an explicit Home Manager module.
-  };
-}

modules/home-manager/programs/zsh.nix

@@ -1,39 +0,0 @@
-{
-  flake.homeModules.zsh = { pkgs, config, ... }:
-  {
-    programs.zsh = {
-      enable = true;
-      package = pkgs.zsh;
-      enableCompletion = true;
-      autosuggestion.enable = true;
-      # syntaxHighlighting.enable = true;
-      initContent = "HOST=$(hostname -s)";
-      dotDir = "${config.xdg.configHome}/zsh";
-      history = {
-        append = true;
-        ignoreAllDups = true;
-        ignorePatterns = [
-          "history"
-          "ls"
-          "eza"
-          "clear"
-        ];
-        save = 1000;
-        size = 1000;
-        share = true;
-      };
-      oh-my-zsh = {
-        enable = true;
-        # theme = "risto";
-        theme = "agnoster";
-        plugins = [
-          "sudo"
-          "dotenv"
-          "git"
-          "ssh"
-          "ssh-agent"
-        ];
-      };
-    };
-  };
-}

modules/home-manager/users/john.nix

@@ -1,35 +0,0 @@
-{ inputs, ... }:
-{
-  flake.homeModules.john = {
-    home.username = "john";
-    home.homeDirectory = "/home/john";
-    home.stateVersion = "25.11";
-    xdg.enable = true;
-
-    programs.git.settings.user.name = "John Lancaster";
-    programs.git.settings.user.email = "32917998+jsl12@users.noreply.github.com";
-
-    imports = with inputs.self.homeModules; [
-      base
-      docker
-			# resticprofile
-		];
-  };
-
-  # This is the base homeConfiguration for the john user that will be used if no other
-  flake.homeConfigurations.john = inputs.home-manager.lib.homeManagerConfiguration {
-		pkgs = import inputs.nixpkgs { system = "x86_64-linux"; };
-		modules = [
-			inputs.self.homeModules.john
-
-      # Include another inline module to set the options created through the jsl-home modules
-      {
-        docker.enable = false;
-        ssh.matchSets = {
-          certs = true;
-          homelab = true;
-        };
-      }
-		];
-	};
-}

modules/hosts/janus.nix

@@ -0,0 +1,55 @@
+{ inputs, ... }:
+let
+  username = "john";
+  hostname = "janus";
+  caURL = "https://janus.john-stream.com/";
+in
+{
+  flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
+    modules = with inputs.self.modules; [
+      nixos.lxc
+      nixos.sops
+      nixos.step-ssh-host
+      inputs.home-manager.nixosModules.home-manager
+      nixos."${username}"
+      nixos.zsh
+      nixos.docker
+      nixos.login-text
+      nixos.mtls
+      {
+        networking.hostName = hostname;
+        step-ssh-host = {
+          hostname = hostname;
+          caURL = caURL;
+        };
+        mtls = {
+          enable = true;
+          subject = hostname;
+          caURL = caURL;
+          san = [
+            "${hostname}.john-stream.com"
+            "192.168.1.244"
+          ];
+        };
+
+        home-manager.users."${username}" = {
+          imports = with inputs.self.modules.homeManager; [
+            sops
+            step-ssh-user
+          ];
+          
+          shell.program = "zsh";
+          docker.enable = true;
+          # step-ssh-user = {
+          #   enable = true;
+          #   principals = [ "${hostname}" ];
+          # };
+          ssh.matchSets = {
+            certs = true;
+            homelab = true;
+          };
+        };
+      }
+    ];
+  };
+}

modules/hosts/john-pc-ubuntu.nix

@@ -1,60 +1,104 @@
 { inputs, ... }:
+let
+  username = "john";
+  hostname = "john-pc-ubuntu";
+  # testTarget = "fded:fb16:653e:25da:be24:11ff:fea0:753f";
+  testTarget = "fded:fb16:653e:25da:be24:11ff:fe89:1cc3";
+in
 {
-	flake.homeModules."john-pc-ubuntu" = { pkgs, ... }: {
-		imports = with inputs.self.homeModules; [
-			john
-			desktop
-			resticprofile
-			sops
-		];
+  flake.modules.homeManager."${hostname}" = { pkgs, config, ... }:
+  let
+    flakeDir = "${config.xdg.configHome}/home-manager/jsl-dendritic";
+    certDir = "${config.mtls.certDir}";
+    CACert = "${certDir}/root_ca.crt";
+    mtlsBundle = "${certDir}/${config.mtls.bundleFilename}";
+    resticPasswordFile = "${config.xdg.configHome}/restic/password.txt";
+  in
+  {
+    imports = with inputs.self.modules.homeManager; [
+      rebuild
+      john
+      sops
+      step-ssh-user
+      mtls
+      restic
+      docker
+      desktop
+    ];
+    targets.genericLinux.enable = true;
 
-		home.packages = with pkgs; [
-			nixos-rebuild
-		];
-		# TODO: Add host-specific settings here:
-		# - sops secret for `restic_password/john_ubuntu`
-		# - resticprofile profile definition
-		# - zsh RESTIC* session variables
-	};
+    shell.program = "zsh";
 
-	flake.homeConfigurations."john-pc-ubuntu" = inputs.home-manager.lib.homeManagerConfiguration {
-		pkgs = import inputs.nixpkgs { system = "x86_64-linux"; };
-		modules = [
-			inputs.self.homeModules."john-pc-ubuntu"
+    home.username = "${username}";
+    home.homeDirectory = "/home/${username}";
 
-      # Include another inline module to set the options created through the jsl-home modules
-      ({ config, ... }: {
-        homeManagerFlakeDir = "${config.xdg.configHome}/home-manager/jsl-dendritic";
-        docker.enable = true;
-        ssh.matchSets = {
-          certs = true;
-          appdaemon = true;
-          homelab = true;
-					dev = true;
-        };
-				shell.program = "zsh";
-				sops.secrets."restic_password/john_ubuntu" = {
-					path = "${config.xdg.configHome}/resticprofile/password.txt";
-				};
-				programs.resticprofile = {
-					enable= true;
-					profiles = {
-						default = {
-							"inherit" = "base";
-							repository = "rest:https://soteria.john-stream.com/john-ubuntu";
-							cacert = "${config.home.homeDirectory}/.step/certs/root_ca.crt";
-							tls-client-cert = "${config.home.homeDirectory}/.step/certs/mtls.pem";
-							backup = {
-								source = [
-									"${config.xdg.userDirs.documents}"
-									"/conf"
-								];
-								schedule = "*-*-* *:15,30,45:00";
-							};
-						};
-					};
-				};
-      })
-		];
-	};
+    home.packages = with pkgs; [
+      nixos-rebuild
+      (writeShellScriptBin "test-push" ''
+        mkdir -p /var/tmp/nix-build
+        chmod 1777 /var/tmp/nix-build
+        nixos-rebuild switch \
+          --flake ${flakeDir}#john-pc-ubuntu \
+          --target-host root@${testTarget}
+      '')
+    ];
+
+    # TODO: make this more restrictive, rather than allowing all unfree packages
+    nixpkgs.config.allowUnfree = true;
+    nixpkgs.config.permittedInsecurePackages = [ "openssl-1.1.1w" ];
+
+    homeManagerFlakeDir = flakeDir;
+    docker.enable = true;
+
+    step-ssh-user = {
+      enable = true;
+      principals = ["root" "${username}" "appdaemon"];
+      provisioner = "admin";
+    };
+    ssh = {
+      certificates.enable = true;
+      matchSets = {
+        certs = true;
+        appdaemon = true;
+        homelab = true;
+        dev = true;
+      };
+    };
+    sops.secrets."restic_password/john_ubuntu" = {
+      path = resticPasswordFile;
+      mode = "0400";
+    };
+    restic = {
+      passwordFile = resticPasswordFile;
+      OnCalendar = "*:0/15";
+      paths = [ "${config.xdg.userDirs.documents}" "/conf" ];
+      exclude = [
+        "/home/*/Pictures"
+        "/home/*/Videos"
+        "/home/*/go"
+        "/home/*/snap"
+        "/home/john/john-nas"
+      ];
+    };
+    mtls = {
+      enable = true;
+      caURL = "https://janus.john-stream.com/";
+      provisioner = "admin";
+      subject = hostname;
+      san = [
+        "${hostname}"
+        "192.168.1.85"
+        "spiffe://john-stream.com/ubuntu"
+      ];
+      lifetime = "1h";
+      renew.onCalendar = "*:1/10";
+    };
+  };
+
+  flake.homeConfigurations."${hostname}" = inputs.home-manager.lib.homeManagerConfiguration {
+    pkgs = import inputs.nixpkgs { system = "x86_64-linux"; };
+    modules = with inputs.self.modules; [
+      homeManager."${hostname}"
+    ];
+  };
 }

modules/hosts/soteria/soteria.nix

@@ -0,0 +1,93 @@
+{ inputs, ... }:
+let
+  username = "john";
+  hostname = "soteria";
+  caURL = "https://janus.john-stream.com/";
+in
+{
+  flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
+    modules = with inputs.self.modules; [
+      nixos.lxc
+      nixos.sops
+      nixos.step-ssh-host
+      inputs.home-manager.nixosModules.home-manager
+      nixos."${username}"
+      nixos.zsh
+      nixos.login-text
+      # nixos.mtls
+      # nixos.restic-server
+      # nixos.restic-envoy
+      {
+        networking.hostName = hostname;
+        nix.settings.build-dir = "/var/tmp/nix-build";
+        systemd.tmpfiles.rules = [
+          "d /var/tmp/nix-build 1777 root root -"
+        ];
+        step-ssh-host = {
+          hostname = hostname;
+          caURL = caURL;
+        };
+        # mtls = {
+        #   enable = true;
+        #   subject = hostname;
+        #   caURL = caURL;
+        #   san = [
+        #     "${hostname}.john-stream.com"
+        #     # "192.168.1.244"
+        #   ];
+        # };
+
+        # restic.envoy = {
+        #   enable = true;
+        #   port = 10000;
+        #   spiffePrefix = "spiffe://john-stream.com";
+        #   upstreamHost = "127.0.0.1";
+        #   upstreamPort = 8000;
+        #   logLevel = "debug";
+        #   policies = {
+        #     ubuntu-policy = {
+        #       pathPrefix = "/john-ubuntu";
+        #       principal = "spiffe://john-stream.com/ubuntu";
+        #     };
+        #     p14-policy = {
+        #       pathPrefix = "/john-p14s";
+        #       principal = "spiffe://john-stream.com/john-p14s";
+        #     };
+        #     gitea-policy = {
+        #       pathPrefix = "/gitea";
+        #       principal = "spiffe://john-stream.com/gitea";
+        #     };
+        #   };
+        # };
+
+        home-manager.users."${username}" = {
+          imports = with inputs.self.modules.homeManager; [
+            sops
+            step-ssh-user
+          ];
+          shell.program = "zsh";
+        };
+      }
+    ];
+  };
+
+  flake.homeConfigurations."${hostname}" = inputs.home-manager.lib.homeManagerConfiguration {
+    pkgs = import inputs.nixpkgs { system = "x86_64-linux"; };
+    modules = with inputs.self.modules; [
+      homeManager."${username}"
+      {
+        imports = with inputs.self.modules.homeManager; [
+          rebuild
+          # sops
+          # step-ssh-user
+          # mtls
+          # restic
+        ];
+
+        home.username = "${username}";
+        home.homeDirectory = "/home/${username}";
+        shell.program = "zsh";
+      }
+    ];
+  };
+}

modules/hosts/test-nix.nix

@@ -1,49 +1,31 @@
 { inputs, ... }:
 let
-  name = "test-nix";
   username = "john";
+  hostname = "test-nix";
 in
 {
-  flake.modules.nixos."${name}" = { pkgs, lib, ...}: {
-    home-manager.users."${username}" = {
-      imports = [
-        inputs.self.homeModules."${username}"
-      ];
-      home.sessionVariables = rec {
-        HOST = "${name}";
-        OTHER_VAR = "abc123";
-      };
-    };
-
-    networking.hostName = "${name}";
-    # environment.sessionVariables = rec {
-    #   HOST = "${name}";
-    # };
-
-    users.users."${username}" = {
-      isNormalUser = true;
-      shell = pkgs.zsh;
-      openssh.authorizedKeys.keys = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIAUa4dcg1TWc4pW++uodyhX4eOqrX/QYIxFWtEP7HFJ john@john-pc-ubuntu"
-      ];
-    };
-    programs.zsh.enable = true;
-
-    services.openssh = {
-      enable = true;
-      # require public key authentication for better security
-      settings.PasswordAuthentication = false;
-      settings.KbdInteractiveAuthentication = false;
-    };
-
-  };
-
-  # Generic bootstrapping lxc, use a specific host file for more
-  flake.nixosConfigurations."${name}" = inputs.nixpkgs.lib.nixosSystem {
-    modules = [
+  flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
+    modules = with inputs.self.modules; [
+      nixos.lxc
+      nixos.sops
+      nixos.step-ssh-host
       inputs.home-manager.nixosModules.home-manager
-      inputs.self.modules.nixos.lxc
-      inputs.self.modules.nixos."${name}"
+      nixos."${username}"
+      nixos.zsh
+      nixos.docker
+      {
+        home-manager.users."${username}" = {
+          imports = with inputs.self.modules.homeManager; [
+            sops
+          ];
+          shell.program = "zsh";
+          docker.enable = true;
+          ssh.matchSets = {
+            certs = true;
+            homelab = true;
+          };
+        };
+      }
     ];
   };
 }

modules/nix-tools/rebuild.nix

@@ -1,6 +1,6 @@
 { inputs, ... }:
 {
-  flake.homeModules.rebuild =
+  flake.modules.homeManager.rebuild =
     { pkgs, lib, config, ... }:
     {
       options = {
@@ -31,7 +31,8 @@
             ${nixBin} flake check
           '')
           (writeShellScriptBin "nhms" ''
-            ${lib.getExe home-manager} switch --impure --flake ${flakeDir}
+            HOSTNAME=$(hostname -s)
+            ${lib.getExe home-manager} switch --impure --flake ${flakeDir}#$HOSTNAME
           '')
           (writeShellScriptBin "nhmu" ''
             ${nixBin} flake update --flake ${flakeDir}

modules/nix-tools/user.nix

@@ -0,0 +1,41 @@
+# Lifted from:
+# https://github.com/Doc-Steve/dendritic-design-with-flake-parts/blob/69edacdb5a4a6ca71d649bb8eb62cf8c630c8627/modules/users/bob%20%5BNDn%5D/bob.nix#L8
+{ self, ... }:
+{
+  config.flake.factory.user = username: isAdmin: {
+    nixos."${username}" = { lib, pkgs, ... }: {
+      users.users."${username}" = {
+        isNormalUser = true;
+        home = "/home/${username}";
+        extraGroups = [
+          "input"
+          "networkmanager"
+        ] ++ lib.optionals isAdmin [
+          "docker"
+          "wheel"
+        ];
+      };
+
+      # Removes password for sudo
+      security.sudo-rs = lib.mkIf isAdmin {
+        enable = true;
+        extraRules = [{
+          users = [ "${username}" ];
+          commands = [{
+            command = "ALL";
+            options = [ "NOPASSWD" ];
+          }];
+        }];
+      };
+
+      # https://github.com/Doc-Steve/dendritic-design-with-flake-parts/wiki/Dendritic_Aspects#multi-context-aspect
+      home-manager.users."${username}" = {
+        home.username = "${username}";
+        home.homeDirectory = "/home/${username}";
+        imports = [
+          self.modules.homeManager."${username}"
+        ];
+      };
+    };
+  };
+}

modules/nixos/login-text.nix

@@ -0,0 +1,46 @@
+{ inputs, ... }: {
+  flake.modules.nixos.login-text = { config, ... }: {
+    programs.rust-motd = {
+      enable = true;
+      refreshInterval = "*:0/5";
+      order = [
+        "global"
+        "last_login"
+        "service_status"
+        # "uptime"
+        "memory"
+        "filesystems"
+      ];
+      settings = {
+        global = {
+          time_format = "%Y-%m-%d %H:%M:%S %Z";
+        };
+
+        last_login = {
+          john = 3;
+          root = 3;
+        };
+
+        service_status = {
+          Docker = "docker";
+          SSH = "sshd.socket";
+          "SSH Cert Renewal" = "step-ssh-host-renew.timer";
+          "mTLS Renewal" = "mtls-renew.timer";
+        };
+
+        # This calculation is wrong for LXCs
+        # uptime = {
+        #   prefix = "Uptime";
+        # };
+
+        memory = {
+          swap_pos = "beside";
+        };
+
+        filesystems = {
+          root = "/";
+        };
+      };
+    };
+  };
+}

modules/nixos/lxc.nix

@@ -1,19 +1,29 @@
 { inputs, ... }:
 {
   flake.modules.nixos.lxc = { pkgs, lib, ...}: {
-    imports = [
+    imports = with inputs.self.modules.nixos; [
       ({ modulesPath, ... }: { imports = [ "${modulesPath}/virtualisation/proxmox-lxc.nix" ]; })
     ];
     nixpkgs.hostPlatform = lib.mkForce "x86_64-linux";
     system.stateVersion = "25.11";
     nix.settings.experimental-features = [ "nix-command" "flakes" ];
     environment.systemPackages = with pkgs; [ git zsh ];
+
+    # security.sudo-rs.enable = true;
+    programs.nix-ld.enable = true;
+    nix.optimise.automatic = true;
+    nix.gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 30d";
+    };
+    programs.bash.enable = true;
   };
 
   # Generic bootstrapping lxc, use a specific host file for more
   flake.nixosConfigurations.lxc = inputs.nixpkgs.lib.nixosSystem {
-    modules = [
-      inputs.self.modules.nixos.lxc
+    modules = with inputs.self.modules.nixos; [
+      lxc
     ];
   };
 }

modules/programs/bash.nix

@@ -0,0 +1,10 @@
+{
+  flake.modules.homeManager.bash = { pkgs, lib, config, ... }:
+  {
+    programs.bash = lib.mkIf (config.shell.program == "bash") {
+      enable = true;
+      enableCompletion = true;
+      package = pkgs.bash;
+    };
+  };
+}

modules/programs/desktop.nix

@@ -1,9 +1,9 @@
 # This module is for programs with GUIs that run in a desktop environment
 { inputs, ... }:
 {
-  flake.homeModules.desktop = 
+  flake.modules.homeManager.desktop = 
     {
-      imports = with inputs.self.homeModules; [
+      imports = with inputs.self.modules.homeManager; [
         onepassword
         ghostty
         sublime

modules/programs/eza.nix

@@ -1,6 +1,6 @@
 { inputs, pkgs, lib, ... }:
 {
-  flake.homeModules.eza = { pkgs, lib, ... }: {
+  flake.modules.homeManager.eza = { pkgs, lib, ... }: {
     programs.eza = {
       enable = true;
       package = pkgs.eza;

modules/programs/files.nix

@@ -1,5 +1,5 @@
 {
-  flake.homeModules.files = { pkgs, ... }:
+  flake.modules.homeManager.files = { pkgs, ... }:
   {
     programs.lf.enable = true;
     programs.lf.cmdKeybindings = {

modules/programs/ghostty.nix

@@ -7,7 +7,7 @@
     };
   };
 
-  flake.homeModules.ghostty = { config, pkgs, lib, ... }:
+  flake.modules.homeManager.ghostty = { config, pkgs, lib, ... }:
   {
     home.sessionVariables = {
       TERMINAL = "ghostty";

modules/programs/git.nix

@@ -1,5 +1,5 @@
 {
-  flake.homeModules.git = { config, lib, ... }:
+  flake.modules.homeManager.git = { config, lib, ... }:
   {
     programs.git = {
         enable = true;

modules/programs/onepassword.nix

@@ -1,5 +1,5 @@
 {
-  flake.homeModules.onepassword = {
+  flake.modules.homeManager.onepassword = {
     # TODO: Port `_1password = true` behavior into an explicit Home Manager module.
   };
 }

modules/programs/shell-tools.nix

@@ -1,14 +1,14 @@
 # This module provides all the shell options
 { inputs, lib, ... }:
 {
-  flake.homeModules.shell-tools = { config, pkgs, ... }: {
+  flake.modules.homeManager.shell-tools = { config, pkgs, ... }: {
     options.shell.program = lib.mkOption {
       type = lib.types.enum [ "bash" "zsh" ];
       default = "zsh";
       description = "Which interactive shell configuration to enable.";
     };
 
-    imports = with inputs.self.homeModules; [
+    imports = with inputs.self.modules.homeManager; [
       bash
       zsh
 
@@ -18,10 +18,8 @@
     ];
 
     config = {
-      programs.bash.enable = lib.mkForce (config.shell.program == "bash");
-      programs.zsh.enable  = lib.mkForce (config.shell.program == "zsh");
       home.shell.enableShellIntegration = true;
-
+      programs.zsh.enable  = lib.mkForce (config.shell.program == "zsh");
       home.packages = with pkgs; [
         wget
         curl
@@ -32,6 +30,7 @@
         btop
         uv
         xclip
+        jq
       ];
     };
   };

modules/programs/sops.nix

@@ -9,15 +9,28 @@ in
     sops-nix.url = "github:Mic92/sops-nix";
     sops-nix.inputs.nixpkgs.follows = "nixpkgs";
   };
-  
+
+  flake.modules.nixos.sops = {
+    imports = with inputs.sops-nix.nixosModules; [
+      sops
+    ];
+
+    sops.defaultSopsFile = ../../keys/secrets.yaml;
+    sops.secrets."test-nix/ssh_host_key" = {
+      owner = "john";
+      path = "/home/john/.ssh/host_key";
+    };
+  };
+
   # Define the homeModules that are used by flake-parts
-  # https://flake.parts/options/home-manager.html#opt-flake.homeModules
-  flake.homeModules.sops = { inputs, config, pkgs, lib, ... }:
+  # https://flake.parts/options/home-manager.html#opt-flake.modules.homeManager
+  flake.modules.homeManager.sops = { inputs, config, pkgs, lib, ... }:
   let
     sopsBin = lib.getExe pkgs.sops;
-    sopsConfigPath = ../../../.sops.yaml;
-    sopsSecretsPath = ../../../keys/secrets.yaml;
+    sopsConfigPath = ../../.sops.yaml;
+    sopsSecretsPath = ../../keys/secrets.yaml;
     ageKeyFile = "${config.xdg.configHome}/sops/age/keys.txt";
+    flakeDir = "${config.xdg.configHome}/home-manager/jsl-dendritic";
   in
   {
     home.packages = with pkgs; [
@@ -31,7 +44,7 @@ in
         echo $(show-age-key)
       '')
       (writeShellScriptBin "show-age-key" "${lib.getExe' pkgs.age "age-keygen"} -y ${ageKeyFile}")
-      (writeShellScriptBin "edit-secrets" "${sopsBin} --config ${sopsConfigPath} ${sopsSecretsPath}")
+      (writeShellScriptBin "edit-secrets" "${sopsBin} --config ${sopsConfigPath} ${flakeDir}/keys/secrets.yaml")
       (writeShellScriptBin "ls-secrets" "${lib.getExe pkgs.eza} -alT --follow-symlinks ~/.config/sops-nix/secrets")
     ];
 
@@ -52,13 +65,8 @@ in
       defaultSopsFile = sopsSecretsPath;
       defaultSopsFormat = "yaml";
       age.sshKeyPaths = [ "${config.ssh.IdentityFile}" ];
-      # age.keyFile = "${ageKeyFile}";
-      # age.generateKey = true;
-
-      secrets."api/gmail_client_secret" = {
-        path = "${config.xdg.configHome}/resticprofile/dendrite.txt";
-      };
 
+      secrets."api/gmail_client_secret" = { };
       templates."gmail_creds" = {
         path = "${config.xdg.configHome}/sops-nix/gmail_api_credentials.json";
         content = ''

modules/programs/step-client.nix

@@ -0,0 +1,69 @@
+{ inputs, ... }:
+let
+  caURL = "https://janus.john-stream.com/";
+  stepFingerprint = "2036c44f7b5901566ff7611ea6c927291ecc6d2dd00779c0eead70ec77fa10d6";
+in
+{
+  #
+  # Home Manager Module
+  #
+  flake.modules.homeManager.step-ssh-user = { config, pkgs, lib, ... }:
+  let
+    cfg = config.step-ssh-user;
+    firstPrincipal = lib.head cfg.principals;
+    principalArgs = lib.concatMapStringsSep " "
+      (principal: "--principal \"${principal}\"") cfg.principals;
+  in
+  {
+    options.step-ssh-user = {
+      enable = lib.mkEnableOption "opionated step client config for SSH certs";
+      caURL = lib.mkOption {
+        type = lib.types.str;
+        default = "${caURL}";
+      };
+      fingerprint = lib.mkOption {
+        type = lib.types.str;
+        default = "${stepFingerprint}";
+      };
+      rootCertFile = {
+        path = lib.mkOption {
+          type = lib.types.str;
+          description = "String path to where the root_ca.crt file will be stored for the user";
+          default = ".step/certs/root_ca.crt";
+        };
+        source = lib.mkOption {
+          type = lib.types.path;
+          description = "Nix path to the root cert file within the repo";
+          default = ../../keys/root_ca.crt;
+        };
+      };
+      provisioner = lib.mkOption {
+        type = lib.types.str;
+        default = "admin";
+      };
+      principals = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        # default = [ ];
+      };
+    };
+    config = lib.mkIf cfg.enable {
+      home.file."${cfg.rootCertFile.path}".source = cfg.rootCertFile.source;
+      home.file.".step/config/defaults.json".text = builtins.toJSON {
+        "ca-url" = cfg.caURL;
+        fingerprint = cfg.fingerprint;
+        root = "${config.home.homeDirectory}/${cfg.rootCertFile.path}";
+      };
+      sops.secrets."janus/admin_jwk".mode = "0400";
+      home.packages = with pkgs; [
+        (writeShellScriptBin "sign-ssh-cert" ''
+          ${lib.getExe pkgs.step-cli} ssh certificate \
+          --sign \
+          ${principalArgs} \
+          --provisioner "${cfg.provisioner}" \
+          --provisioner-password-file "${config.sops.secrets."janus/admin_jwk".path}" \
+          "${firstPrincipal}" "${config.ssh.IdentityFile}.pub"
+        '')
+      ];
+    };
+  };
+}

modules/programs/sublime.nix

@@ -0,0 +1,8 @@
+{ inputs, pkgs, ... }:
+{
+  flake.modules.homeManager.sublime = { pkgs, lib, ... }: {
+    home.packages = with pkgs; [
+      sublime4
+    ];
+  };
+}

modules/programs/vscode.nix

@@ -1,5 +1,5 @@
 {
-  flake.homeModules.vscode = { pkgs, ... }:
+  flake.modules.homeManager.vscode = { pkgs, ... }:
   {
     programs.vscode = {
       enable = true;

modules/programs/zsh.nix

@@ -0,0 +1,54 @@
+{ inputs, ... }:
+let
+  username = "john";
+in
+{
+  flake.modules = {
+    nixos.zsh = { pkgs, ... }: {
+      users.users."${username}".shell = pkgs.zsh;
+      programs.zsh.enable = true;
+      # Already being imported by the john.nix module
+      # home-manager.sharedModules = [
+      #   inputs.self.modules.homeManager.zsh
+      # ];
+    };
+
+    homeManager.zsh = { pkgs, config, ... }: {
+      programs.zsh = {
+        enable = true;
+        package = pkgs.zsh;
+        enableCompletion = true;
+        autosuggestion.enable = true;
+        # syntaxHighlighting.enable = true;
+        initContent = "HOST=$(hostname -s)";
+        dotDir = "${config.xdg.configHome}/zsh";
+        history = {
+          append = true;
+          ignoreAllDups = true;
+          ignorePatterns = [
+            "history"
+            "ls"
+            "eza"
+            "clear"
+          ];
+          save = 1000;
+          size = 1000;
+          share = true;
+        };
+        oh-my-zsh = {
+          enable = true;
+          # theme = "risto";
+          theme = "agnoster";
+          plugins = [
+            "sudo"
+            "dotenv"
+            "git"
+            "ssh"
+            "ssh-agent"
+          ];
+        };
+      };
+    };
+  };
+  
+}

modules/services/docker.nix

@@ -1,5 +1,15 @@
+{ inputs, ... }:
 {
-  flake.homeModules.docker = { config, lib, pkgs, ... }:
+  flake.modules.nixos.docker = {
+    virtualisation.docker = {
+      enable = true;
+    };
+    home-manager.sharedModules = with inputs.self.modules.homeManager; [
+      docker
+    ];
+  };
+
+  flake.modules.homeManager.docker = { config, lib, pkgs, ... }:
   {
     options.docker = {
       enable = lib.mkEnableOption "Docker tools and utilities";
@@ -13,10 +23,10 @@
         docker
         docker-compose
         lazydocker
-        (pkgs.writeShellScriptBin "test-docker" ''
-          echo "Hello from docker.nix!"
-        '')
       ];
+      home.shellAliases = {
+        lzd = "lazydocker";
+      };
     };
   };
 }

modules/services/restic/envoy.nix

@@ -0,0 +1,323 @@
+{ lib, ... }:
+{
+  flake.modules.nixos.restic-envoy = { config, lib, pkgs, ... }:
+    let
+      cfg = config.restic.envoy;
+
+      envoyConfig = {
+        static_resources = {
+          listeners = [
+            {
+              name = "listener_0";
+              address.socket_address = {
+                address = cfg.listenAddress;
+                port_value = cfg.port;
+              };
+              filter_chains = [
+                {
+                  filter_chain_match.server_names = cfg.serverNames;
+                  transport_socket = {
+                    name = "envoy.transport_sockets.tls";
+                    typed_config = {
+                      "@type" = "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext";
+                      require_client_certificate = true;
+                      common_tls_context = {
+                        tls_params.tls_minimum_protocol_version = "TLSv1_3";
+                        validation_context = {
+                          trusted_ca.filename = cfg.trustedCAPath;
+                          match_typed_subject_alt_names = [
+                            {
+                              san_type = "URI";
+                              matcher.prefix = cfg.spiffePrefix;
+                            }
+                          ];
+                        };
+                        tls_certificates = [
+                          {
+                            certificate_chain.filename = cfg.certificatePath;
+                            private_key.filename = cfg.pkcs8PrivateKeyPath;
+                          }
+                        ];
+                      };
+                    };
+                  };
+                  filters = [
+                    {
+                      name = "envoy.filters.network.http_connection_manager";
+                      typed_config = {
+                        "@type" = "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager";
+                        stat_prefix = "ingress_http";
+                        use_remote_address = true;
+                        http2_protocol_options.max_concurrent_streams = 100;
+                        access_log = [
+                          {
+                            name = "envoy.access_loggers.file";
+                            typed_config = {
+                              "@type" = "type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog";
+                              path = cfg.accessLogPath;
+                            };
+                          }
+                        ];
+                        route_config = {
+                          name = "local_route";
+                          virtual_hosts = [
+                            {
+                              name = "local_service";
+                              domains = [ "*" ];
+                              routes = [
+                                {
+                                  match.prefix = "/";
+                                  route.cluster = cfg.clusterName;
+                                }
+                              ];
+                            }
+                          ];
+                        };
+                        http_filters = [
+                          {
+                            name = "envoy.filters.http.rbac";
+                            typed_config = {
+                              "@type" = "type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC";
+                              rules = {
+                                action = "ALLOW";
+                                policies = lib.mapAttrs (_: policy: {
+                                  permissions = [
+                                    {
+                                      and_rules.rules = [
+                                        {
+                                          header = {
+                                            name = ":path";
+                                            string_match.prefix = policy.pathPrefix;
+                                          };
+                                        }
+                                      ];
+                                    }
+                                  ];
+                                  principals = [
+                                    {
+                                      authenticated.principal_name.exact = policy.principal;
+                                    }
+                                  ];
+                                }) cfg.policies;
+                              };
+                            };
+                          }
+                          {
+                            name = "envoy.filters.http.router";
+                            typed_config = {
+                              "@type" = "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router";
+                            };
+                          }
+                        ];
+                      };
+                    }
+                  ];
+                }
+              ];
+            }
+          ];
+          clusters = [
+            {
+              name = cfg.clusterName;
+              connect_timeout = cfg.connectTimeout;
+              type = "STRICT_DNS";
+              lb_policy = "ROUND_ROBIN";
+              load_assignment = {
+                cluster_name = cfg.clusterName;
+                endpoints = [
+                  {
+                    lb_endpoints = [
+                      {
+                        endpoint.address.socket_address = {
+                          address = cfg.upstreamHost;
+                          port_value = cfg.upstreamPort;
+                        };
+                      }
+                    ];
+                  }
+                ];
+              };
+            }
+          ];
+        };
+      };
+
+      configFile = (pkgs.formats.json { }).generate "restic-envoy.json" envoyConfig;
+      ensurePkcs8Key = pkgs.writeShellScript "restic-envoy-prepare-key" ''
+        set -euo pipefail
+
+        install -d -m 0750 /run/restic-envoy
+        ${lib.getExe pkgs.openssl} pkcs8 \
+          -topk8 \
+          -nocrypt \
+          -in ${lib.escapeShellArg cfg.sourcePrivateKeyPath} \
+          -out ${lib.escapeShellArg cfg.pkcs8PrivateKeyPath}
+        chmod 0600 ${lib.escapeShellArg cfg.pkcs8PrivateKeyPath}
+      '';
+    in
+    {
+      options.restic.envoy = {
+        enable = lib.mkEnableOption "an Envoy mTLS front-end for restic";
+
+        listenAddress = lib.mkOption {
+          type = lib.types.str;
+          default = "0.0.0.0";
+          description = "Address for Envoy to bind to.";
+        };
+
+        port = lib.mkOption {
+          type = lib.types.port;
+          default = 10000;
+          description = "TCP port for the Envoy listener.";
+        };
+
+        openFirewall = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+          description = "Open the configured listener port in the firewall.";
+        };
+
+        serverNames = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          default = [ "*.john-stream.com" ];
+          description = "Accepted SNI server names for the downstream TLS filter chain.";
+        };
+
+        spiffePrefix = lib.mkOption {
+          type = lib.types.str;
+          default = "spiffe://john-stream.com";
+          description = "Allowed SPIFFE URI prefix for client certificate SAN validation.";
+        };
+
+        trustedCAPath = lib.mkOption {
+          type = lib.types.str;
+          default = "/etc/step/certs/root_ca.crt";
+          description = "Path to the CA certificate used to validate client certificates.";
+        };
+
+        certificatePath = lib.mkOption {
+          type = lib.types.str;
+          default = "/etc/step/certs/cert.pem";
+          description = "Path to the server certificate presented by Envoy.";
+        };
+
+        sourcePrivateKeyPath = lib.mkOption {
+          type = lib.types.str;
+          default = "/etc/step/certs/key.pem";
+          description = "Path to the source private key that will be converted to PKCS#8 for Envoy.";
+        };
+
+        pkcs8PrivateKeyPath = lib.mkOption {
+          type = lib.types.str;
+          default = "/run/restic-envoy/key_pkcs8.pem";
+          description = "Path to the PKCS#8 private key file consumed by Envoy.";
+        };
+
+        accessLogPath = lib.mkOption {
+          type = lib.types.str;
+          default = "/var/log/envoy/access.log";
+          description = "Path for the Envoy HTTP access log.";
+        };
+
+        clusterName = lib.mkOption {
+          type = lib.types.str;
+          default = "restic";
+          description = "Name of the upstream Envoy cluster.";
+        };
+
+        connectTimeout = lib.mkOption {
+          type = lib.types.str;
+          default = "0.25s";
+          description = "Cluster connect timeout in Envoy duration format.";
+        };
+
+        upstreamHost = lib.mkOption {
+          type = lib.types.str;
+          default = "rest-server";
+          description = "DNS name or IP address for the upstream restic server.";
+        };
+
+        upstreamPort = lib.mkOption {
+          type = lib.types.port;
+          default = 8000;
+          description = "TCP port for the upstream restic server.";
+        };
+
+        logLevel = lib.mkOption {
+          type = lib.types.enum [ "trace" "debug" "info" "warning" "error" "critical" "off" ];
+          default = "info";
+          description = "Envoy application log level.";
+        };
+
+        policies = lib.mkOption {
+          description = "RBAC policy definitions keyed by Envoy policy name.";
+          type = lib.types.attrsOf (lib.types.submodule ({ ... }: {
+            options = {
+              pathPrefix = lib.mkOption {
+                type = lib.types.str;
+                description = "Allowed HTTP path prefix for this principal.";
+              };
+
+              principal = lib.mkOption {
+                type = lib.types.str;
+                description = "Exact SPIFFE principal required for this path prefix.";
+              };
+            };
+          }));
+          default = {
+            ubuntu-policy = {
+              pathPrefix = "/john-ubuntu";
+              principal = "spiffe://john-stream.com/ubuntu";
+            };
+            p14-policy = {
+              pathPrefix = "/john-p14s";
+              principal = "spiffe://john-stream.com/john-p14s";
+            };
+            gitea-policy = {
+              pathPrefix = "/gitea";
+              principal = "spiffe://john-stream.com/gitea";
+            };
+          };
+        };
+      };
+
+      config = lib.mkIf cfg.enable {
+        assertions = [
+          {
+            assertion = cfg.serverNames != [ ];
+            message = "restic.envoy.serverNames must not be empty.";
+          }
+          {
+            assertion = cfg.policies != { };
+            message = "restic.envoy.policies must define at least one RBAC policy.";
+          }
+        ];
+
+        networking.firewall.allowedTCPPorts = lib.optionals cfg.openFirewall [ cfg.port ];
+
+        systemd.tmpfiles.rules = [
+          "d /var/log/envoy 0750 root root -"
+          "d /run/restic-envoy 0750 root root -"
+        ];
+
+        systemd.services.restic-envoy = {
+          description = "Envoy reverse proxy for the restic server";
+          wantedBy = [ "multi-user.target" ];
+          after = [ "network-online.target" ];
+          wants = [ "network-online.target" ];
+          restartIfChanged = true;
+          serviceConfig = {
+            Type = "simple";
+            User = "root";
+            Group = "root";
+            ExecStartPre = ensurePkcs8Key;
+            ExecStart = "${lib.getExe pkgs.envoy} --config-path ${configFile} --log-level ${cfg.logLevel}";
+            Restart = "on-failure";
+            RestartSec = "5s";
+            RuntimeDirectory = "restic-envoy";
+            LogsDirectory = "envoy";
+          };
+        };
+      };
+    };
+}

modules/services/restic/restic.nix

@@ -0,0 +1,109 @@
+{ inputs, ... }: {
+  flake.modules.nixos.restic-server = { config, pkgs, lib, ... }: {
+    services.restic.server = {
+      enable = true;
+      dataDir = "/mnt/restic";
+      listenAddress = "0.0.0.0:8080";
+      extraFlags = [ "--no-auth" ];
+    };
+  };
+
+  flake.modules.homeManager.restic = { config, pkgs, lib, ... }:
+    let
+      cfg = config.restic;
+    in
+    {
+      options.restic = {
+        repoName = lib.mkOption {
+          description = "Name of the restic repo to use";
+          type = lib.types.str;
+          default = "john-ubuntu";
+        };
+        passwordFile = lib.mkOption {
+          description = "String path to the restic password file";
+          type = lib.types.str;
+        };
+        paths = lib.mkOption {
+          description = "List of string paths to include in the backup";
+          type = lib.types.listOf lib.types.str;
+          default = [ ];
+        };
+        exclude = lib.mkOption {
+          description = "List of string paths to include in the backup. There are already some common ones included by default.";
+          type = lib.types.listOf lib.types.str;
+          default = [ ];
+        };
+        OnCalendar = lib.mkOption {
+          description = "";
+          type = lib.types.str;
+        };
+        RandomizedDelaySec = lib.mkOption {
+          description = "";
+          type = lib.types.str;
+          default = "1m";
+        };
+      };
+
+      config = let
+        resticRepository = "rest:https://soteria.john-stream.com/${cfg.repoName}";
+        caCert = "${config.mtls.certDir}/root_ca.crt";
+        mtlsClientCert = "${config.mtls.certDir}/${config.mtls.bundleFilename}";
+      in
+      {
+        home.sessionVariables = {
+          RESTIC_REPOSITORY = resticRepository;
+          RESTIC_PASSWORD_FILE = cfg.passwordFile;
+          RESTIC_CACERT = caCert;
+          RESTIC_TLS_CLIENT_CERT = mtlsClientCert;
+        };
+        
+        # This is necessary because the restic service in home manager doesn't otherwise expose these options.
+        systemd.user.services."restic-backups-${cfg.repoName}".Service.Environment = [
+          "RESTIC_CACERT=${caCert}"
+          "RESTIC_TLS_CLIENT_CERT=${mtlsClientCert}"
+        ];
+
+        services.restic = {
+          enable = true;
+          backups.${cfg.repoName} = {
+            repository = resticRepository;
+            passwordFile = cfg.passwordFile;
+            paths = cfg.paths;
+            timerConfig = {
+              OnCalendar = cfg.OnCalendar;
+              RandomizedDelaySec = cfg.RandomizedDelaySec;
+              Persistent = true;
+            };
+            runCheck = true;
+            pruneOpts = [
+              "--keep-last 10"
+              "--keep-hourly 8"
+              "--keep-daily 14"
+              "--keep-weekly 8"
+              "--keep-monthly 12"
+            ];
+            exclude = cfg.exclude ++ [
+              ".cache"
+              ".devenv"
+              ".rustup"
+              ".cargo"
+              ".venv"
+              ".pyenv"
+              ".vscode*"
+              "data/postgres"
+              "build"
+              "dist"
+              "__pycache__"
+              "*.log"
+              "*.egg-info"
+              "*.csv"
+              "*.m4a"
+              ".local/share/Steam"
+              ".local/share/Trash"
+            ];
+          };
+        };
+
+      };
+    };
+}

modules/services/ssh.nix

@@ -0,0 +1,183 @@
+{inputs, ... }:
+let
+  userName = "john";
+  sshHostCAPubKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNug18oLH0vZxnibXJzMJvTWFPZTnSlhCDDVi+rHhgnIum6ZXQ4SF+VHOOAM5BbzZmMKitNJ5lcrGP15Eur7DzQ=";
+in
+{
+  flake.modules.nixos.ssh = { pkgs, config, lib, ... }:
+  let
+    cfg = config.ssh;
+    userCAPath = "ssh/ssh_user_ca.pub";
+    hostKeyFile = "ssh/ssh_host_ed25519_key";
+  in
+  {
+    options.ssh = {
+      certificates = {
+        enable = lib.mkEnableOption "Enable SSH host certificates";
+        userCA = lib.mkOption {
+          type = lib.types.path;
+          default = ../../keys/ssh_user_ca.pub;
+        };
+      };
+    };
+
+    config = {
+      services.openssh = {
+        enable = true;
+        # require public key authentication for better security
+        settings = lib.mkMerge [
+          {
+            PasswordAuthentication = false;
+            KbdInteractiveAuthentication = false;
+            HostKey = "/etc/${hostKeyFile}";
+          }
+          (lib.mkIf cfg.certificates.enable {
+            TrustedUserCAKeys = "/etc/${userCAPath}";
+            HostCertificate = "/etc/${hostKeyFile}-cert.pub";
+          })
+        ];
+      };
+
+      environment.etc."${userCAPath}" = lib.mkIf cfg.certificates.enable {
+        source = cfg.certificates.userCA;
+      };
+
+      programs.ssh.knownHosts = lib.mkIf cfg.certificates.enable {
+        "192.168.1.*" = { 
+          certAuthority = true;
+          publicKey = sshHostCAPubKey;
+        };
+        "*.john-stream.com" = {
+          certAuthority = true;
+          publicKey = sshHostCAPubKey;
+        };
+      };
+    };
+  };
+
+  flake.modules.homeManager.ssh = { pkgs, config, lib, ... }:
+  {
+    options.ssh = {
+      IdentityFile = lib.mkOption {
+        # Intentionally not using a path type here because that will end up with the private key getting copied into the store
+        type = lib.types.str;
+        default = "${config.home.homeDirectory}/.ssh/id_ed25519";
+        description = "Path to the SSH identity file.";
+      };
+
+      certificates = {
+        enable = lib.mkEnableOption "Enable SSH user certificates";
+        # sshCertProvisioner = lib.mkOption {
+        #   type = lib.types.str;
+        #   default = "admin";
+        # };
+      };
+
+      knownHostsFile = lib.mkOption {
+        type = lib.types.str;
+        default = "${config.home.homeDirectory}/.ssh/known_hosts";
+      };
+
+      matchSets = {
+        appdaemon = lib.mkEnableOption "Enable AppDaemon SSH targets";
+        certs = lib.mkEnableOption "Enable Janus and Soteria SSH targets";
+        homelab = lib.mkEnableOption "Enable various Homelab targets";
+        dev = lib.mkEnableOption "Enable development targets";
+      };
+    };
+
+    # All this stuff has to be wrapped in a config attribute because of the presence of the options here?
+    config = let
+      cfg = config.ssh;
+      identityFile = cfg.IdentityFile;
+      publicKeyFile = "${identityFile}.pub";
+      certificateFile = "${identityFile}-cert.pub";
+      provisionerPasswordPath = config.sops.secrets."janus/admin_jwk".path;
+    in {
+      home.file.".ssh/known_hosts" = {
+        text = lib.concatStringsSep "\n" (
+          [
+            "fded:fb16:653e:25da:be24:11ff:fea0:753f ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ9ZqiWPrCwHjxFCiu0lT4rlQs7KyMapxKJQQ5PJP1eh"
+          ]
+          ++ (lib.optional cfg.certificates.enable "@cert-authority 192.168.1.* ${sshHostCAPubKey}")
+          ++ (lib.optional cfg.certificates.enable "@cert-authority *.john-stream.com ${sshHostCAPubKey}")
+        );
+      };
+
+      programs.ssh = {
+        enable = true;
+        enableDefaultConfig = false;
+        extraConfig = ''
+          SetEnv TERM="xterm-256color"
+          IdentityAgent ~/.1password/agent.sock
+        '';
+
+        matchBlocks = lib.mkMerge [
+          {
+            "*" = {
+              user = "john";
+
+              compression = false;
+              serverAliveInterval = 0;
+              serverAliveCountMax = 3;
+
+              identitiesOnly = true;
+              inherit identityFile certificateFile;
+
+              hashKnownHosts = false;
+              userKnownHostsFile = cfg.knownHostsFile;
+
+              addKeysToAgent = "yes";
+              forwardAgent = false;
+            };
+          }
+          (lib.mkIf cfg.matchSets.appdaemon {
+            "appdaemon" = {
+              hostname = "192.168.1.242";
+              user = "appdaemon";
+            };
+            "ad-nix" = {
+              hostname = "192.168.1.201";
+              user = "appdaemon";
+            };
+          })
+          (lib.mkIf cfg.matchSets.certs {
+            "janus" = {
+              hostname = "janus.john-stream.com";
+              user = "root";
+            };
+            "soteria" = {
+              hostname = "soteria.john-stream.com";
+              user = "john";
+            };
+          })
+          (lib.mkIf cfg.matchSets.homelab {
+            "docs" = {
+              hostname = "192.168.1.110";
+              user = "root";
+            };
+            "gitea" = {
+              hostname = "192.168.1.104";
+              user = "john";
+            };
+            "hermes" = {
+              hostname = "192.168.1.150";
+              user = "root";
+            };
+            "panoptes" = {
+              hostname = "192.168.1.107";
+              user = "panoptes";
+            };
+          })
+          (lib.mkIf cfg.matchSets.dev {
+            "test-nix" = {
+              hostname = "fded:fb16:653e:25da:be24:11ff:fea0:753f";
+              user = "john";
+              identityFile = identityFile;
+            };
+          })
+        ];
+      };
+    };
+  };
+}

modules/services/step-ca/ca.json

@@ -0,0 +1,129 @@
+{
+  "root": "/etc/step-ca/certs/root_ca.crt",
+  "federatedRoots": null,
+  "crt": "/etc/step-ca/certs/intermediate_ca.crt",
+  "key": "/etc/step-ca/secrets/intermediate_ca_key",
+  "address": ":443",
+  "insecureAddress": "",
+  "dnsNames": [
+    "janus.john-stream.com",
+    "192.168.1.113"
+  ],
+  "ssh": {
+    "hostKey": "/etc/step-ca/secrets/ssh_host_ca_key",
+    "userKey": "/etc/step-ca/secrets/ssh_user_ca_key"
+  },
+  "logger": {
+    "format": "text"
+  },
+  "db": {
+    "type": "badgerv2",
+    "dataSource": "/var/lib/step-ca/db",
+    "badgerFileLoadingMode": ""
+  },
+  "authority": {
+    "provisioners": [
+      {
+        "type": "ACME",
+        "name": "acme"
+      },
+      {
+        "type": "SSHPOP",
+        "name": "sshpop",
+        "claims": {
+          "enableSSHCA": true
+        }
+      },
+      {
+        "type": "JWK",
+        "name": "admin",
+        "key": {
+          "use": "sig",
+          "kty": "EC",
+          "kid": "xoxgOJFbveSLIL2gm1Yu5ZiRb9v8Jxe44F56i3v-Nf8",
+          "crv": "P-256",
+          "alg": "ES256",
+          "x": "zFO8hPx_eH0Iyz7UJI-w8ODMusEKCZ28M76sGWmWYxA",
+          "y": "XIWLLyKDzqxV9UH-2KeAkKPDrgLoPrxxW9-PzkXggME"
+        },
+        "encryptedKey": "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoiUVJnTnJVTF9KcmxJYkJMVTlGNVRPZyJ9.DMu7xBNCq5pr-_--YTxNr5Hrcqy6ZmSVHsWurfVXL7Hk0Q3vyYRxiw.h-CnFiYc-DhxThI3.plx3_Qa_0kU-2TwnqFNfAfGnCpfQ2e0iiCMLruNHbLMnHeXQ1BysHBqps45_02zZXIRdHoDgYGtXRSfcdUYYoS0pLoPzC6m301ZFNSAFdRVlSZ3Q6VmWdixPXXnEB4EgSKTT_wxR33L8t9OpFzD85KfY-b_Un1l99ufjCnfg-EYkcICTn_G4-8bcW3eFIvJ6setzu-l0jHMhLQdIweqncn9on9xBXBD-ANhZfP95P2BJt-APqCi8eqiAvn_vClovdg0PxzRwOVDvWREz66FDw-HTU7xDtGO9hACopT5tfZOXDoykgZw1mJsq9NEq9ZzvKG2hvyk1UXtExxrNtFo.5q1OfGU4Amo4Si-vpeI42g",
+        "claims": {
+          "enableSSHCA": true,
+          "disableRenewal": false,
+          "allowRenewalAfterExpiry": false,
+          "disableSmallstepExtensions": false
+        },
+        "options": {
+          "x509": {},
+          "ssh": {}
+        }
+      }
+    ],
+    "template": {},
+    "backdate": "1m0s"
+  },
+  "tls": {
+    "cipherSuites": [
+      "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
+      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
+    ],
+    "minVersion": 1.2,
+    "maxVersion": 1.3,
+    "renegotiation": false
+  },
+  "templates": {
+    "ssh": {
+      "user": [
+        {
+          "name": "config.tpl",
+          "type": "snippet",
+          "template": "templates/ssh/config.tpl",
+          "path": "~/.ssh/config",
+          "comment": "#"
+        },
+        {
+          "name": "step_includes.tpl",
+          "type": "prepend-line",
+          "template": "templates/ssh/step_includes.tpl",
+          "path": "${STEPPATH}/ssh/includes",
+          "comment": "#"
+        },
+        {
+          "name": "step_config.tpl",
+          "type": "file",
+          "template": "templates/ssh/step_config.tpl",
+          "path": "ssh/config",
+          "comment": "#"
+        },
+        {
+          "name": "known_hosts.tpl",
+          "type": "file",
+          "template": "templates/ssh/known_hosts.tpl",
+          "path": "ssh/known_hosts",
+          "comment": "#"
+        }
+      ],
+      "host": [
+        {
+          "name": "sshd_config.tpl",
+          "type": "snippet",
+          "template": "templates/ssh/sshd_config.tpl",
+          "path": "/etc/ssh/sshd_config",
+          "comment": "#",
+          "requires": [
+            "Certificate",
+            "Key"
+          ]
+        },
+        {
+          "name": "ca.tpl",
+          "type": "snippet",
+          "template": "templates/ssh/ca.tpl",
+          "path": "/etc/ssh/ca.pub",
+          "comment": "#"
+        }
+      ]
+    }
+  },
+  "commonName": "Step Online CA"
+}

modules/services/step-ca/mtls.nix

@@ -0,0 +1,306 @@
+{ inputs, lib, ... }:
+let
+  # Options that will be in common between
+  opts = {
+    enable = lib.mkEnableOption "Enable mTLS";
+    caURL = lib.mkOption {
+      description = "URL to the certificate authority";
+      type = lib.types.str;
+    };
+    subject = lib.mkOption {
+      description = "The Common Name, DNS Name, or IP address that will be set as the Subject Common Name for the certificate. If no Subject Alternative Names (SANs) are configured (via the --san flag) then the subject will be set as the only SAN.";
+      type = lib.types.str;
+    };
+    keyFilename = lib.mkOption {
+      description = "String filename for the private key";
+      type = lib.types.str;
+      default = "key.pem";
+    };
+    certFilename = lib.mkOption {
+      description = "String filename for the public certificate";
+      type = lib.types.str;
+      default = "cert.pem";
+    };
+    bundleFilename = lib.mkOption {
+      description = "String filename for the mTLS key bundle";
+      type = lib.types.str;
+      default = "mtls.pem";
+    };
+    san = lib.mkOption {
+      description = "List of SAN to give the mTLS cert";
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+    };
+    provisioner = lib.mkOption {
+      type = lib.types.str;
+      default = "admin";
+    };
+    lifetime = lib.mkOption {
+      type = lib.types.str;
+      default = "6h";
+    };
+    renew = {
+      enable = lib.mkOption {
+        description = "Enable automatic mTLS certificate renewal using a systemd timer.";
+        type = lib.types.bool;
+        default = true;
+      };
+      onCalendar = lib.mkOption {
+        description = "systemd OnCalendar schedule for mTLS certificate renewal checks.";
+        type = lib.types.str;
+        default = "*:1/15";
+      };
+      randomizedDelaySec = lib.mkOption {
+        description = "Randomized delay added to renewal timer runs to avoid synchronized renewals.";
+        type = lib.types.str;
+        default = "5m";
+      };
+      user = lib.mkOption {
+        description = "User account to run the mTLS renewal service as.";
+        type = lib.types.str;
+        default = "root";
+      };
+      group = lib.mkOption {
+        description = "Group to run the mTLS renewal service as. Defaults to the configured renewal user when null.";
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+      };
+      reloadUnits = lib.mkOption {
+        description = "systemd units to try-reload-or-restart after a successful certificate renewal.";
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+      };
+      postCommands = lib.mkOption {
+        description = "Shell commands to run after a successful certificate renewal.";
+        type = lib.types.listOf lib.types.lines;
+        default = [ ];
+      };
+    };
+  };
+
+  mkMtlsRenewScript = {
+    pkgs,
+    tlsCert,
+    tlsKey,
+    mtlsBundle,
+    reloadUnits ? [ ],
+    postCommands ? [ ],
+    systemctlArgs ? [ ],
+  }:
+  let
+    renewReloadScript = lib.concatMapStringsSep "\n" (unit: ''
+      if ${lib.getExe' pkgs.systemd "systemctl"} ${lib.escapeShellArgs systemctlArgs} --quiet is-active "${unit}"; then
+        ${lib.getExe' pkgs.systemd "systemctl"} ${lib.escapeShellArgs systemctlArgs} try-reload-or-restart "${unit}"
+      fi
+    '') reloadUnits;
+    renewPostCommands = lib.concatStringsSep "\n" postCommands;
+  in
+    pkgs.writeShellScriptBin "mtls-renew" ''
+      set -euo pipefail
+
+      if ${lib.getExe pkgs.step-cli} certificate needs-renewal "${tlsCert}"; then
+        echo "Renewing mTLS certificate"
+      else
+        echo "Skipping renew"
+        exit "$?"
+      fi
+
+      ${lib.getExe pkgs.step-cli} ca renew --force "${tlsCert}" "${tlsKey}"
+
+      umask 077
+      ${lib.getExe' pkgs.coreutils "cat"} "${tlsCert}" "${tlsKey}" > "${mtlsBundle}"
+
+      ${renewReloadScript}
+      ${renewPostCommands}
+    '';
+
+  mkNixosMtlsRenewService = {
+    pkgs,
+    tlsCert,
+    tlsKey,
+    mtlsBundle,
+    reloadUnits ? [ ],
+    postCommands ? [ ],
+    user ? "root",
+    group ? null,
+  }:
+  let
+    serviceGroup = if group == null then user else group;
+    renewScript = mkMtlsRenewScript {
+      inherit pkgs tlsCert tlsKey mtlsBundle reloadUnits postCommands;
+    };
+  in
+  {
+    description = "Renew the mTLS certificate when Smallstep marks it ready";
+    wantedBy = [ ];
+    after = [ "network-online.target" ];
+    wants = [ "network-online.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      User = user;
+      Group = serviceGroup;
+      ExecStart = lib.getExe renewScript;
+    };
+  };
+
+  mkNixosMtlsRenewTimer = {
+    onCalendar,
+    randomizedDelaySec,
+    unit ? "mtls-renew.service",
+  }: {
+    description = "Periodic Smallstep renewal for the mTLS certificate";
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      Persistent = true;
+      OnCalendar = onCalendar;
+      AccuracySec = "1us";
+      RandomizedDelaySec = randomizedDelaySec;
+      Unit = unit;
+    };
+  };
+
+  mkHomeManagerMtlsRenewService = {
+    pkgs,
+    tlsCert,
+    tlsKey,
+    mtlsBundle,
+    reloadUnits ? [ ],
+    postCommands ? [ ],
+  }:
+  let
+    renewScript = mkMtlsRenewScript {
+      inherit pkgs tlsCert tlsKey mtlsBundle reloadUnits postCommands;
+      systemctlArgs = [ "--user" ];
+    };
+  in
+  {
+    Unit = {
+      Description = "Renew the mTLS certificate when Smallstep marks it ready";
+      After = [ "network-online.target" ];
+      Wants = [ "network-online.target" ];
+    };
+    Service = {
+      Type = "oneshot";
+      ExecStart = lib.getExe renewScript;
+    };
+  };
+
+  mkHomeManagerMtlsRenewTimer = {
+    onCalendar,
+    randomizedDelaySec,
+    unit ? "mtls-renew.service",
+  }: {
+    Unit = {
+      Description = "Periodic Smallstep renewal for the mTLS certificate";
+    };
+    Timer = {
+      Persistent = true;
+      OnCalendar = onCalendar;
+      AccuracySec = "1us";
+      RandomizedDelaySec = randomizedDelaySec;
+      Unit = unit;
+    };
+    Install = {
+      WantedBy = [ "timers.target" ];
+    };
+  };
+
+in
+{
+  flake.modules.nixos.mtls = { config, lib, pkgs, ... }:
+    let
+      cfg = config.mtls;
+      certDir = "/etc/step/certs";
+      tlsKey = "${certDir}/${cfg.keyFilename}";
+      tlsCert = "${certDir}/${cfg.certFilename}";
+      mtlsBundle = "${certDir}/${cfg.bundleFilename}";
+      rootCA = "${certDir}/root_ca.crt";
+      sanArgs = lib.concatMapStringsSep " " (san: "--san \"${san}\"") cfg.san;
+    in
+    {
+      options.mtls = opts;
+      config = lib.mkIf cfg.enable {
+        environment.systemPackages = with pkgs; lib.optionals cfg.enable [
+          (writeShellScriptBin "mtls-generate" ''
+            set -euo pipefail
+            ${lib.getExe pkgs.step-cli} ca certificate \
+              ${cfg.subject} ${tlsCert} ${tlsKey} \
+              --ca-url ${cfg.caURL} \
+              --root ${rootCA} \
+              --provisioner ${cfg.provisioner} \
+              --not-before=-5m --not-after=${cfg.lifetime} \
+              ${sanArgs} \
+              "$@"
+            cat ${tlsCert} ${tlsKey} > ${mtlsBundle}
+          '')
+          (writeShellScriptBin "mtls-check" ''
+            ${lib.getExe pkgs.openssl} x509 \
+            -noout -subject -issuer \
+            -ext subjectAltName,extendedKeyUsage \
+            -enddate -in ${mtlsBundle}
+          '')
+        ];
+
+        systemd.services.mtls-renew = lib.mkIf cfg.renew.enable (mkNixosMtlsRenewService {
+          inherit pkgs tlsCert tlsKey mtlsBundle;
+          inherit (cfg.renew) reloadUnits postCommands user group;
+        });
+
+        systemd.timers.mtls-renew = lib.mkIf cfg.renew.enable (mkNixosMtlsRenewTimer {
+          inherit (cfg.renew) onCalendar randomizedDelaySec;
+        });
+      };
+    };
+
+  flake.modules.homeManager.mtls = { config, lib, pkgs, ... }:
+    let
+      cfg = config.mtls;
+      certDir = cfg.certDir;
+      tlsKey = "${certDir}/${cfg.keyFilename}";
+      tlsCert = "${certDir}/${cfg.certFilename}";
+      mtlsBundle = "${certDir}/${cfg.bundleFilename}";
+      rootCA = "${certDir}/root_ca.crt";
+      sanArgs = lib.concatMapStringsSep " " (san: "--san \"${san}\"") cfg.san;
+    in
+    {
+      options.mtls = opts // {
+        certDir = lib.mkOption {
+          description = "String path to where the mtls certs will be stored.";
+          type = lib.types.str;
+          default ="${config.home.homeDirectory}/.step/certs";
+        };
+      };
+
+      config = {
+        home.packages = with pkgs; lib.optionals cfg.enable [
+          step-cli
+          (writeShellScriptBin "mtls-generate" ''
+            set -euo pipefail
+            ${lib.getExe pkgs.step-cli} ca certificate \
+              ${cfg.subject} ${tlsCert} ${tlsKey} \
+              --not-before=-5m --not-after=${cfg.lifetime} \
+              --provisioner ${cfg.provisioner} \
+              ${sanArgs} \
+              "$@"
+            cat ${tlsCert} ${tlsKey} > ${mtlsBundle}
+          '')
+          (writeShellScriptBin "mtls-check" ''
+            ${lib.getExe pkgs.openssl} x509 \
+            -noout -subject -issuer \
+            -ext subjectAltName,extendedKeyUsage \
+            -enddate -in ${mtlsBundle}
+          '')
+          (mkMtlsRenewScript { inherit pkgs tlsCert tlsKey mtlsBundle; })
+        ];
+
+        systemd.user.services.mtls-renew = lib.mkIf cfg.renew.enable (mkHomeManagerMtlsRenewService {
+          inherit pkgs tlsCert tlsKey mtlsBundle;
+          inherit (cfg.renew) reloadUnits postCommands;
+        });
+
+        systemd.user.timers.mtls-renew = lib.mkIf cfg.renew.enable (mkHomeManagerMtlsRenewTimer {
+          inherit (cfg.renew) onCalendar randomizedDelaySec;
+        });
+      };
+    };
+}

modules/services/step-ca/ssh-host.nix

@@ -0,0 +1,116 @@
+{ inputs, ... }: {
+  flake.modules.nixos.step-ssh-host = { config, pkgs, lib, ... }:
+  let
+    cfg = config.step-ssh-host;
+    rootCertPath = "/etc/step/certs/root_ca.crt";
+    provisionerPasswordPath = config.sops.secrets."janus/admin_jwk".path;
+    sshKeyPath = "/etc/ssh/ssh_host_ed25519_key";
+    sshCertPath = "${sshKeyPath}-cert.pub";
+  in
+  {
+    # NixOS Options
+    options.step-ssh-host = {
+      hostname = lib.mkOption {
+        description = "Networking host name";
+        type = lib.types.str;
+      };
+      caURL = lib.mkOption {
+        description = "URL for the certificate authority";
+        type = lib.types.str;
+      };
+      rootCertFile = {
+        path = lib.mkOption {
+          description = "String path to where the root_ca.crt file will be stored for the user";
+          type = lib.types.str;
+          default = "step/certs/root_ca.crt";
+        };
+        source = lib.mkOption {
+          description = "Nix path to the root cert file within the repo";
+          type = lib.types.path;
+          default = ../../../keys/root_ca.crt;
+        };
+      };
+      provisioner = lib.mkOption {
+        description = "Provisioner inside Step CA to use for the SSH certificates";
+        type = lib.types.str;
+        default = "admin";
+      };
+    };
+
+    imports = with inputs.self.modules.nixos; [ ssh ];
+    # NixOS Config
+    config = {
+      ssh.certificates.enable = true;
+      sops.secrets."janus/admin_jwk" = {
+        owner = "root";
+        group = "root";
+        mode = "0400";
+      };
+      networking.nameservers = [ "192.168.1.150" ];
+      networking.dhcpcd.extraConfig = "nohook resolv.conf";
+
+      environment.etc."${cfg.rootCertFile.path}".source = cfg.rootCertFile.source;
+      environment.systemPackages = with pkgs; [
+        step-cli
+        (writeShellScriptBin "ssh-host-cert-renew" ''
+          ${lib.getExe pkgs.step-cli} ssh certificate \
+          --host --sign \
+          --root "${rootCertPath}" \
+          --ca-url ${cfg.caURL} \
+          --provisioner "${cfg.provisioner}" \
+          --provisioner-password-file "${provisionerPasswordPath}" \
+          --principal "${cfg.hostname}" \
+          --principal "${cfg.hostname}.john-stream.com" \
+          "${cfg.hostname}" "${sshKeyPath}.pub"
+        '')
+        (writeShellScriptBin "ssh-host-cert-check" "${lib.getExe' pkgs.openssh "ssh-keygen"} -Lf ${sshCertPath}")
+      ];
+
+      systemd.services.step-ssh-host-renew = {
+        description = "Renew Step SSH host certificate if needed";
+        wantedBy = [ ];
+        after = [ "network-online.target" ];
+        wants = [ "network-online.target" ];
+        path = [ pkgs.step-cli pkgs.openssh pkgs.coreutils pkgs.systemd ];
+        serviceConfig = {
+          Type = "oneshot";
+          User = "root";
+          Group = "root";
+        };
+        script = ''
+          set -euo pipefail
+          if ${lib.getExe pkgs.step-cli} ssh needs-renewal "${sshCertPath}" --expires-in "4h"; then
+            echo "Renewing SSH host certificate"
+          else
+            rc=$?
+            if [ "$rc" -eq 1 ]; then
+              echo "SSH host cert does not need renewal"
+              exit 0
+            fi
+
+            if [ "$rc" -eq 2 ]; then
+              echo "SSH host cert missing: ${sshCertPath}" >&2
+              exit 1
+            fi
+
+            echo "step ssh needs-renewal failed with rc=$rc" >&2
+            exit "$rc"
+          fi
+        '';
+      };
+
+      systemd.timers.step-ssh-host-renew = {
+        description = "Periodic Step SSH host certificate renewal";
+        wantedBy = [ "timers.target" ];
+
+        timerConfig = {
+          OnBootSec = "5m";
+          OnUnitActiveSec = "4h";
+          RandomizedDelaySec = "15m";
+          Persistent = true;
+          Unit = "step-ssh-host-renew.service";
+        };
+      };
+    };
+  };
+}

modules/services/step-ca/step-ca.nix

@@ -0,0 +1,22 @@
+{ inputs, ... }:
+let
+  ipAddress = "0.0.0.0";
+in
+{
+  flake.modules.nixos.step-ca = { pkgs, ... }: {
+    # https://github.com/NixOS/nixpkgs/blob/nixos-23.05/nixos/modules/services/security/step-ca.nix
+    services.step-ca = {
+      enable = true;
+      openFirewall = true;
+      address = ipAddress;
+      port = 8443;
+
+      # https://smallstep.com/docs/step-ca/configuration/#configuration-options
+      settings = {
+        root = "";
+        crt = "";
+      };
+    };
+    environment.systemPackages = with pkgs; [ step-ca step-cli ];
+  };
+}

modules/users/john.nix

@@ -0,0 +1,46 @@
+{ inputs, ... }:
+let
+  username = "john";
+in
+{
+  flake = {
+    meta.users."${username}" = {
+      email = "32917998+jsl12@users.noreply.github.com";
+      name = "John Lancaster";
+      username = "${username}";
+      key = "";
+      keygrip = [
+      ];
+      authorizedKeys = [
+        # "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIAUa4dcg1TWc4pW++uodyhX4eOqrX/QYIxFWtEP7HFJ john@john-pc-ubuntu"
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMOkGLo4N/L3RYvaIZ1FmePlxa1HK0fMciZxKtRhN58F root@janus"
+      ];
+    };
+
+    modules = {
+      nixos."${username}" = {
+        imports = [
+          (inputs.self.factory.user username true).nixos."${username}"
+        ];
+        users.users."${username}" = {
+          openssh.authorizedKeys.keys = inputs.self.meta.users."${username}".authorizedKeys;
+          extraGroups = [ "docker" ];
+        };
+      };
+
+      homeManager."${username}" = with inputs.self.meta.users."${username}"; {
+        home.stateVersion = "25.11";
+        xdg.enable = true;
+
+        programs.git.settings.user.name = name;
+        programs.git.settings.user.email = email;
+
+        imports = with inputs.self.modules.homeManager; [
+          ssh
+          shell-tools
+          git
+        ];
+      };
+    };
+  };
+}

resticprofile/base.nix

@@ -1,4 +1,3 @@
-{ lib, config, ... }:
 {
   base = {
     repository = "local:/mnt/backup";