reorg

.sops.yaml

@@ -2,10 +2,10 @@ keys:
   - &john-p14s age1f6drjusg866yscj8029tk4yfpgecklrvezldm02ankm6h8nnwu5s2u6ahy
   - &john-pc age1ykcs39e62pz3xu6cedg8ea685kv5d5qsrhgkndygzm8rx30xd5ys5t3qxt
   - &test-nix age1gvplss0ddmyf6vpjy363wu3n057vhm0j6n7tc94cxd8kadapypws5mtaj0
-  - &soteria age1h0prahyukq4l564yqwgcpg3g6gdrjflk0suklussjjrjstxd9uesws8633
+  - &soteria age1p4gyh5260ewp7t2ctzv5ewj4a06szl389fm4gzy6vltxhjj73ers87u33g
   - &janus age1qahhlzeanprtykym9jymk2t95uedr7cwx9sdshx46q2m6u66fucsqua8l3
 creation_rules:
-  - path_regex: modules/hosts/janus/secrets\.yaml$
+  - path_regex: janus/secrets\.yaml$
     key_groups:
     - age:
       - *janus
@@ -22,8 +22,8 @@ creation_rules:
   - path_regex: soteria/secrets\.yaml$
     key_groups:
     - age:
-      - *john-pc
       - *soteria
+      - *john-pc
       - *test-nix
   - path_regex: john-p14s/secrets\.yaml$
     key_groups:

keys/secrets.yaml

@@ -11,47 +11,47 @@ sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwWlpYV1o3SVdJdmJ5TWM3
-            Qmg4WVkvL21aQ2wvMUcxeGIxL2FQRUNOZFhZCkFqT3RtNTZvODJZczVwcEZkMzBp
-            eFFTVmJLb1ZOQVVVSWl4OVNQWkM4VWcKLS0tIEV4WmhEOGpkUWFBTCtqaldxdXFO
-            T20rVXNrY0ZBWlBaS0lWdGIrYUFNdm8KL06MsEu0fy6gKX5khZoxaypKDgEEJnTL
-            hCh4sCmTC3l7vQLv6deWf1Xhc8vSYhhNaWFCZ+KSaUen+6Bm/WrRIg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5dTVZQ2hFanhqbVJXTmxG
+            YUFFanBiTzgyek1WZW5YajlaL3hVNElORHpJCm1JN2hxell5dmJVczlBbVI2VktH
+            Z21lelF6UDBHcXIyUDE0clpxcEV4MGsKLS0tIG0zMktBVEt1SFZ6aGFaNW0wdzlB
+            QkpQc3lkNmZCd0d6ZVRCc1ZaWjFYaDAK9RXWeW6dCIhYfVGPywsHlRigORVMuVfl
+            d+Evyp72wV5C1MnhV9jv8O4S8aQkcNae1PALacnFw0GJAI1iXn0bqw==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1f6drjusg866yscj8029tk4yfpgecklrvezldm02ankm6h8nnwu5s2u6ahy
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwRGVJTXJtSk9KUFpCdksv
-            SUJ4YXBSTndhZkVHNlV2TTlyS0MrQXdqOG1jCkk0c3p0ZUlHMzZmR0FTUTMxOTl1
-            c0dFTW9yZFpuSUdwVUs0dlJiL2d2cFUKLS0tIE1VWldEYmR6cWFoRTkycmllVnpt
-            TGYxU2J0NzAvMjBMOXVMZEJTYTNkamMK2zfuTeHJ/8I07oNhp3MN1wKlmtVpahke
-            cz8FVesp/+53HxfQAdnC7l/Cv7P71aVEyr2/oTEd4gt9HsHVVw3O6A==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBTWt3MEFDL3JGOUw0LzNa
+            RmNLMmFRRzh5NEtZWENjNTlrcDg1MHpjWWg0Cjl5THh3ckdyMWVqR0M2Q0Y0czUr
+            Y0ZNRGVIbS9TNXlCcFo3R3lPZUl4cW8KLS0tIDN4QmhSYjBPMDZLWURhMndsK2hE
+            WVY1T0JnZ3dmSjNIMDNBYmhMellvMWcKp15FwF7lJnHoZ/tLNQTGvwP7Kffj8hms
+            6G5ZG2howsNFiRFFdo/uL08ShaycL2PAL/Kge/0pPL1ygiDaDLjGGg==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1ykcs39e62pz3xu6cedg8ea685kv5d5qsrhgkndygzm8rx30xd5ys5t3qxt
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwR3VEWmZ4REpUN0M5NTRT
-            U1l1S0k1MnFrYnhRanB4UStOQU0vYXE0TjFZCld2cDBlRXNyRlJWMlZ4TENadURy
-            cUN0RmpYYld3WlY0TzkyNXlqbFVnKzgKLS0tIHhtSG5VU3RMclMyZFJmbk1DMkV6
-            elRhVTV6Tk5OTjUybldvUXY3Sk9hdkEKg17Pagk12Pvj6cNr49HN8tImM4w7pnkc
-            XLCWIHUCe3QpJlgs4USXbyA06PmsNl7PVvCoxmf6tPegt+SFMTuDRQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwT1FoTDNmRXM4Tk9HZHNu
+            ZSszMEM1R0Z5bzY1ZzRvR3VGR2srVVdXbDBNCmp2c0tacndoQ3RiZUpNTnk1MTNH
+            V0Q4ckhWaDBjemYxZEhrSGJHcVlwYzQKLS0tIHNDZkNrNmZvM2plNEp2TTJmVlpT
+            U1JhN2MrT2NzeURuVzRIZlNEVEd0S0EKBcTG4hWKdXqNfajVZ5DOClOeZsFYktPb
+            dAauLGwx1zkXbVxopUpH5+vCXp02kvvwgO9kiqJvSf0U+l/5VIp6Ww==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1gvplss0ddmyf6vpjy363wu3n057vhm0j6n7tc94cxd8kadapypws5mtaj0
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMUUtJWklHTGpLYTJuMkZi
-            N2YzMlBUU3dxUGZwSUJjRktVYmp4RlowZ0c0CmdWdmFOQndpQWM0a0VOZUtlckhz
-            SktRclh5ZFZLaCt2RjhIdGU1aUs0c2sKLS0tIGI4UGFUcHhPVis5Z3dhanhiMGwv
-            OXRWQnNKcU9XRVJRWWdUNTZyZUdETzAKSchzGq3teDdBiyzJEujlxPaoJsVww4JX
-            3VvsUZLxnV1yWu83X1bp6uZA3YLMdQgPcHezdgmIyixp+ATHh9fgzw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5bTVkK0pQL3kxZzdaN0xq
+            YU9rVTNvQXE1V1d0Ykx1bEN3cXp4eWdKaWpjCkEzNUs0N1JlMjlrdnA4UUxIRkZ1
+            aFl2Qk9PeTNTQ0grMjFJMzZvT05adGMKLS0tIEIwd3NyQ0xWWkVBMFl4Z0VUVFBY
+            eWFlSFYrL1E1aXN2bVp5YTF5VXVOYUEK3NhyHGnY+a/Fj6TJFzljSX+49G9x5F3x
+            M16Nx7JGsD5IV6GfdiMYSEwgT1pm0/XY8rhvWBO1fArkleMz1HKewg==
             -----END AGE ENCRYPTED FILE-----
-          recipient: age1h0prahyukq4l564yqwgcpg3g6gdrjflk0suklussjjrjstxd9uesws8633
+          recipient: age1p4gyh5260ewp7t2ctzv5ewj4a06szl389fm4gzy6vltxhjj73ers87u33g
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtOHFwemUyc2pEKzlibVBo
-            MlI4R0VTMHpwK21MaXZkSUp5dnIwUnVZOFRvCjVsM3FrclFJL0s2a1RwU1F2VXNF
-            MnRBOVUydFdEWXY3Mk9oTGw5Z05Zb28KLS0tIE9QRFdCVGR1Z0UyeE5KSzgrWnpP
-            Q25nZWx3bFdlek1OSjJsSk1QREdGRU0K++hDWzoKbBkGkMAkruuEwQKa1Jrc8POs
-            liN274cEdi1T6nmwBJ05w0alUR2XuYEn9HNKdvz8EntNuKIhCpHing==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwWGpwUkRueVhhcVErQ0ZF
+            RXdxV1lMNzh6VFhubmc3TDBMaSsrYjhlS1Q0CnlZMmJSaXN5d1daRmpUVTlWeU1i
+            Nkxsd3JoTGpoelhiTXBMclhoL3RKQlEKLS0tIHRyQjk0akN3WnhKKy82T0ZOYTNK
+            QU5tYkZuTVc2Yzc0bzJrNXd1aWJMVlEKoMHFqDQYmT+q4eSNtmIb6drI/pFt9Z4W
+            gHI/QxeWQq6BWssk4EAonRXhIE0iJPOsXz2zyT+dRRDqcKBod9h01w==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1qahhlzeanprtykym9jymk2t95uedr7cwx9sdshx46q2m6u66fucsqua8l3
     lastmodified: "2026-03-15T15:06:29Z"

modules/features/ssh/default.nix

@@ -2,6 +2,7 @@
 { self, inputs, ... }:
 let
   caPatterns = [ "*.john-stream.com" "192.168.1.*" "fded:fb16:653e:25da:be24:11ff:*" ];
+  sshHostCAPath = ../../hosts/janus/public/ssh_host_ca_key.pub;
 in
 {
   flake.modules.nixos.ssh-new = { config, pkgs, lib, ... }:
@@ -10,10 +11,9 @@ in
       hostKeyFile = "${cfg.host.configDir}/${cfg.host.keyFile}";
       hostCertFile = "${hostKeyFile}-cert.pub";
       userCAFile = "${cfg.host.configDir}/${cfg.certificates.user.CAFile}";
-      sshHostCAContent = lib.removeSuffix "\n" (builtins.readFile ../hosts/janus/public/ssh_host_ca_key.pub);
       CAknownHosts = (lib.genAttrs caPatterns (_: {
           certAuthority = true;
-          publicKey = sshHostCAContent;
+          publicKey = lib.removeSuffix "\n" (builtins.readFile sshHostCAPath);
       }));
 
       wrappers = inputs.self.wrappers;
@@ -129,7 +129,7 @@ in
         };
 
         environment.etc."ssh/${cfg.certificates.user.CAFile}" = lib.mkIf cfg.certificates.user.enable {
-          source = ../hosts/janus/public/ssh_user_ca_key.pub;
+          source = ../../hosts/janus/public/ssh_user_ca_key.pub;
         };
 
         environment.systemPackages = (
@@ -143,7 +143,7 @@ in
 
         sops = lib.mkIf cfg.certificates.host.autoRenew {
           secrets."janus/admin_jwk" = {
-            sopsFile = ../../keys/secrets.yaml;
+            sopsFile = ../../../keys/secrets.yaml;
             owner = "root";
             group = "root";
             mode = "0400";
@@ -198,7 +198,7 @@ in
   flake.modules.homeManager.ssh-new = { config, pkgs, lib, ... }:
     let
       cfg = config.ssh-new;
-      sshHostCAContent = lib.removeSuffix "\n" (builtins.readFile ../hosts/janus/public/ssh_host_ca_key.pub);
+      sshHostCAContent = lib.removeSuffix "\n" (builtins.readFile sshHostCAPath);
       knownHostsText = lib.concatMapStrings
         (pattern: "@cert-authority ${pattern} ${sshHostCAContent}\n")
         caPatterns;
@@ -266,6 +266,10 @@ in
               HostName = "fded:fb16:653e:25da:be24:11ff:fe6b:4d57";
               User = "root";
             };
+            "soteria" = {
+              HostName = "fded:fb16:653e:25da:be24:11ff:fe54:aa39";
+              User = "root";
+            };
             "hermes" = {
               HostName = "192.168.1.150";
               User = "root";

modules/features/ssh/ssh-wrappers.nix

@@ -4,38 +4,6 @@ let
     builtins.concatLists (map (principal: [ "--principal" principal ]) principals);
 in
 {
-  perSystem = { system, self', pkgs, lib, ... }: {
-    packages.ssh-certs = inputs.wrappers.lib.wrapPackage {
-      inherit pkgs;
-      package = (pkgs.symlinkJoin {
-        name = "ssh-certs";
-        meta.mainProgram = "ssh-user-cert-sign";
-        paths = [
-          (inputs.self.wrappers.signUserWrapper.apply {
-            inherit pkgs;
-            provisioner = "admin";
-            overwrite = true;
-            validUsers = [ "john" "root" "appdaemon" ];
-          }).wrapper
-
-          (inputs.self.wrappers.userCheckWrapper.apply {
-            inherit pkgs;
-          }).wrapper
-
-          (inputs.self.wrappers.signHostWrapper.apply {
-            inherit pkgs;
-            provisioner = "admin";
-            overwrite = true;
-          }).wrapper
-
-          (inputs.self.wrappers.hostCheckWrapper.apply {
-            inherit pkgs;
-          }).wrapper
-        ];
-      });
-    };
-  };
-
   flake.wrappers.signHostWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
     options = {
       provisioner = lib.mkOption {
@@ -81,9 +49,6 @@ in
         ]
         ++ lib.optionals config.overwrite [ "-f" ]
         ++ mkPrincipalArgs config.extraPrincipals;
-      postHook = ''
-        systemctl reload-or-restart sshd
-      '';
     };
   });
 

modules/hosts/janus/README.md

@@ -34,7 +34,7 @@ If rotating provisioner password, also set:
 Secret source-of-truth after this split:
 
 - `modules/hosts/janus/secrets.yaml`: Janus runtime CA secrets (`ca_password`, `intermediate_ca_key`, `ssh_host_ca_key`, `ssh_user_ca_key`, `admin_provisioner_encrypted_key`)
-- `keys/secrets.yaml`: shared Janus provisioner secret (`janus.admin_jwk`) consumed by `ssh-certs` across hosts
+- `keys/secrets.yaml`: shared Janus provisioner secret (`janus.admin_jwk`) consumed across hosts
 
 Then update public artifacts in repo from generated output:
 

modules/hosts/john-kde/default.nix

@@ -33,7 +33,6 @@ in
     home.packages = with pkgs; [
       selfPkgs.jsl-zsh
       selfPkgs.my-neovim
-      selfPkgs.ssh-certs
       # selfPkgs.step-bootstrap
       # selfPkgs.wg-platform
       # self'.packages.myWrappedPackage

modules/hosts/john-pc/default.nix

@@ -38,7 +38,6 @@ in
     home.packages = with pkgs; [
       nil # Nix language server
       selfPkgs.jsl-zsh
-      # selfPkgs.ssh-certs
       (inputs.self.wrappers.test-push.apply {
         inherit pkgs flakeDir;
         host = testHost;

modules/hosts/soteria/default.nix

@@ -3,17 +3,21 @@
 let
   username = "john";
   hostname = "soteria";
+  ipv4 = "192.168.1.233";
+  ipv6 = "fded:fb16:653e:25da:be24:11ff:fe54:aa39";
+  names = [ "${hostname}.john-stream.com" ipv4 ipv6 ];
 in
 {
   flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
     modules = with inputs.self.modules; [
       nixos.lxc
-      nixos.mysops
-      nixos."${username}"
-      nixos.ssh-certs
       nixos.login-text
+      inputs.home-manager.nixosModules.home-manager
+      nixos."${username}"
+      nixos.ssh-new
+      # nixos.mtls
+      nixos.mysops
       nixos.docker
-      nixos.mtls
       nixos.step-client
       nixos.forgejo
       nixos.restic-server
@@ -34,54 +38,56 @@ in
           }
         ];
 
-        users.users."${username}".extraGroups = [ "mtls" ];
-        mtls = {
-          enable = true;
-          subject = hostname;
-          san = [
-            "${hostname}.john-stream.com"
-            # "192.168.1.142"
-            "forgejo.john-stream.com"
-            "192.168.1.244"
-          ];
-          lifetime = "12h";
-          renew.onCalendar = "*:3/15";
-          renew.reloadUnits = [ "forgejo.service" "restic-rest-server.service" ];
-          certReaders = [ config.services.forgejo.user "restic" ];
-        };
-        forgejo = {
-          enable = true;
-          root_url = "https://forgejo.john-stream.com";
-          https = true;
-          port = 443;
-        };
+        # users.users."${username}".extraGroups = [ "mtls" ];
+        # mtls = {
+        #   enable = true;
+        #   subject = hostname;
+        #   san = names;
+        #   lifetime = "12h";
+        #   renew.onCalendar = "*:3/15";
+        #   renew.reloadUnits = [ "forgejo.service" "restic-rest-server.service" ];
+        #   certReaders = [ config.services.forgejo.user "restic" ];
+        # };
 
-        resticServer = {
-          enable = true;
-          dataDir = "/mnt/restic";
-          privateRepos = true;
-          listenAddress = "0.0.0.0:8000";
-          tls = {
-            certFile = config.mtls.certFile;
-            keyFile = config.mtls.keyFile;
-          };
-        };
+        # forgejo = {
+        #   enable = true;
+        #   root_url = "https://forgejo.john-stream.com";
+        #   https = true;
+        #   port = 443;
+        # };
+
+        # resticServer = {
+        #   enable = true;
+        #   dataDir = "/mnt/restic";
+        #   privateRepos = true;
+        #   listenAddress = "0.0.0.0:8000";
+        #   tls = {
+        #     certFile = config.mtls.certFile;
+        #     keyFile = config.mtls.keyFile;
+        #   };
+        # };
 
         loginText.extraServiceStatus = {
           Docker = "docker";
           "mTLS Renewal" = "mtls-renew.timer";
-          Forgejo = "forgejo.service";
+          "Forgejo" = "forgejo.service";
           "Forgejo Backup" = "forgejo-dump.timer";
           "Restic REST Server" = "restic-rest-server.service";
         };
 
-        ssh-certs.hostname = hostname;
+        ssh-new.certificates = {
+          provisioner = "admin";
+          host = {
+            enable = true;
+            extraPrincipals = names;
+            autoRenew = true;
+          };
+          user.enable = true;
+        };
 
         # This provides the secrets at install time
         sops.defaultSopsFile = ./secrets.yaml;
 
-        # programs.zsh.enable = true;
-
         home-manager.users."${username}".imports = [ inputs.self.modules.homeManager.soteria ];
 
         environment.systemPackages = [
@@ -93,10 +99,10 @@ in
   };
 
   flake.modules.homeManager.soteria = { config, pkgs, lib, ... }: {
-    imports = [
-      inputs.self.modules.homeManager.rebuild
-      inputs.self.modules.homeManager.mysops
-      inputs.self.modules.homeManager.step-client
+    imports = with inputs.self.modules.homeManager; [
+      rebuild
+      mysops
+      step-client
       ({ config, pkgs, lib, ... }: {
         homeManagerFlakeDir = "${config.xdg.configHome}/home-manager";
         docker.enable = true;
@@ -107,12 +113,12 @@ in
     ];
   };
 
-  flake.homeConfigurations.soteria = withSystem "x86_64-linux" (ctx@{ config, inputs', ...}:
-    inputs.home-manager.lib.homeManagerConfiguration {
-      pkgs = inputs'.nixpkgs.legacyPackages;
-      modules = [
-        inputs.self.modules.homeManager."${username}"
-        inputs.self.modules.homeManager.soteria
-      ];
-  });
+  # flake.homeConfigurations.soteria = withSystem "x86_64-linux" (ctx@{ config, inputs', ...}:
+  #   inputs.home-manager.lib.homeManagerConfiguration {
+  #     pkgs = inputs'.nixpkgs.legacyPackages;
+  #     modules = [
+  #       inputs.self.modules.homeManager."${username}"
+  #       inputs.self.modules.homeManager.soteria
+  #     ];
+  # });
 }

modules/hosts/soteria/secrets.yaml

@@ -9,33 +9,33 @@ forgejo:
 restic_password: ENC[AES256_GCM,data:u7QOZXJkxVG4J75K5nphb2uJGdz6jbWuVSsKKu+41fshp7cVoRijtr/Cs02LjVse,iv:bt1W2FeBTG6ypBFYzMPXPIkYTSn0uHURY2ui6MRgYY8=,tag:DObAMws/zQcM+UKUe9EECA==,type:str]
 sops:
     age:
-        - recipient: age1ykcs39e62pz3xu6cedg8ea685kv5d5qsrhgkndygzm8rx30xd5ys5t3qxt
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5QThHOFdVQ0F6ZDE3QXdL
-            QVF0WW5yRkNtNXIyRm1LeEhwY2dRRWo0WENZCmZoWmlXZDh4ZGlUR2JYOUxuaVAx
-            WjhXVHBMNWdrdkgvTENJR2RpWldkNTAKLS0tIEF1bS9JSnFTbytBa1U5RjVzWkd3
-            S0pKVVI2RFN5a1BMYXBEY3VOUUM5QTAKNarYZm9DKRQhosSJBn9yryFxDkmFTV/o
-            i8b/tZ1ZybjEXX+X1EsgylM5u8iKkbEyUzqKO0E0gpg4qXSsJaMMYQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLM3NML2ozWExSTlY3ZXJH
+            ZEpaN1RIOWVjNXRRQTlLQVZKTUUvZnBxREd3Cmp6b29aRDlUdDFwMVhwS2thODNO
+            QzNWSVIrak1uMGRuUlBONkR2aW1nbXMKLS0tIDh2YmFaRXBvZ0Q2blhjTVphL3J3
+            TkROaHdwWWN4YnkyczZLbDJYRTNrQTQKvHSXjP9EZkq9DrPZZHTIlFrPUhez6jZT
+            LJvkmQgKluer7+lWr8XuuqtQsvhtef1di82SBG6C6YK0zWIxrMjFkA==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1h0prahyukq4l564yqwgcpg3g6gdrjflk0suklussjjrjstxd9uesws8633
-          enc: |
+          recipient: age1p4gyh5260ewp7t2ctzv5ewj4a06szl389fm4gzy6vltxhjj73ers87u33g
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhdEN2M1lkMFoyQzg3bCsz
-            cVB0NUlkV1JPRjQ1TW5RSVFHUjdNMERoRXlzCk9tc25iMG00TkZjWjk2S2cyVE1J
-            cUFITDh2SkZGN0lpeWJVcWM3V3JrTTQKLS0tIENOWVBzTFYrdHRsMERwV0RKS01j
-            QVI5TVl4L0dwOWpoQ1I2THZ6cWovWGMKIo1x1ZbdTyr/dNlPhvuomfk2MoPLsHyU
-            N3CP3Scu3aZ7vqVua7uwtv4xQqyQI/yOnFjwxrVYPJ+N5Y/b4wsC6A==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwWThXZGtFSjFZVU1UWG9v
+            Wk9sVEVWemtVWTJ6TGlOd3ZhVUZBYnJ1OFFRClpFNmEwTG1PR0pQUFJuTTVVZGRD
+            bnpPdjZGVUJvS0NyWGJQbEV4cUlHZncKLS0tIDFNU1VxNjZYSks1OTMrblJPbDI1
+            bHIrUnhsMWNhWVpVc3hCazlKTlV5YncKgR/AbgCE9JU8U8PH3ouYTZJOqL7rRODr
+            5D2zT9pcTC3LQGZrhNtgjAi6IucU4yDAU7UhT3D7cZawwFTKVaoplw==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1gvplss0ddmyf6vpjy363wu3n057vhm0j6n7tc94cxd8kadapypws5mtaj0
-          enc: |
+          recipient: age1ykcs39e62pz3xu6cedg8ea685kv5d5qsrhgkndygzm8rx30xd5ys5t3qxt
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGSGQvL2ZYM2dtV1JWaDR1
-            RjJnN0YwWFM4d1IwTElqUnZQQkVDTmdydUJjCjdCUWxCVDNXUHVLd2ZHcDA5L0Mw
-            cEVxVE84L2xmQnRoYmsxVEdMSEZjdGcKLS0tIHViRVJyTWt4Q3JrMWtYaS9QdHlS
-            Yjd0MUcxcExvWVpCOUR3MkdZdGQyWUkKnru0Y2A98+0Mps7EtVK7ct3vPqIGveUt
-            E5fzpcKvdefzObrx7BPTwJ19t2fZg/dSi7HKwx3vmKZSzyQaqJOzsg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3K054SHE0V1RCYlRlTXJT
+            bXo4ZnE1cFozY3R2dmg5S1BacC9xb2oweWpBClJJVnkrSytFaG8xR1l4SU5FNGxi
+            UndnNzYwMUlXSjRYK3c3MzI4NmRVRVEKLS0tIFQ4NFdPeGI4LytWK0JPcUV4VjM2
+            b1dtYWdFTTFQcW5PQml2OWs1Z0VZOFUKrDX7y3cU8KPRLKlO/HI/jdynqwO1TAS0
+            WY4F0qFKmWwsJJjbnjdpYYP3O1/8RNeXjnUg8fGYY75sf7iAYWSe/w==
             -----END AGE ENCRYPTED FILE-----
+          recipient: age1gvplss0ddmyf6vpjy363wu3n057vhm0j6n7tc94cxd8kadapypws5mtaj0
     lastmodified: "2026-04-04T23:18:43Z"
     mac: ENC[AES256_GCM,data:qBgeli5lHb4pyA8nAADBuRBAaq8VbAIsFI37OZtgnbnoHW2crxo3YC+EknaIYnZpZ48kwVhQS5lGRjI6JsWWhTH3+LVAhTmS2Qj/pZTD/JDLK6XJGXS4U9nB7m9aGYyW8gFCy9/DfoJWGsS//+ZmUikKPfd5kMZgh1zGoYCIGug=,iv:h+2fA+bO2SMCNrEslP36x3BPRaIy25cU/DNX8CYSC6A=,tag:RvVyUZ4ONRaKaqGiT31eUQ==,type:str]
     unencrypted_suffix: _unencrypted

modules/hosts/test-nix.nix

@@ -1,31 +0,0 @@
-{ inputs, ... }:
-let
-  username = "john";
-  hostname = "test-nix";
-in
-{
-  flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
-    modules = with inputs.self.modules; [
-      nixos.lxc
-      nixos.mysops
-      nixos.step-ssh-host
-      inputs.home-manager.nixosModules.home-manager
-      nixos."${username}"
-      nixos.docker
-      {
-        step-ssh-host.hostname = hostname;
-        sops.defaultSopsFile = ../../keys/secrets.yaml;
-        home-manager.users."${username}" = {
-          imports = with inputs.self.modules.homeManager; [
-            mysops
-          ];
-          docker.enable = true;
-          ssh.matchSets = {
-            certs = true;
-            homelab = true;
-          };
-        };
-      }
-    ];
-  };
-}

modules/nixos/lxc.nix

@@ -20,6 +20,9 @@
       environment.shells = lib.mkAfter [ rootShellPath ];
       users.users.root.shell = lib.mkForce rootShellPath;
 
+      networking.nameservers = [ "192.168.1.150" ];
+      networking.dhcpcd.extraConfig = "nohook resolv.conf";
+
       # security.sudo-rs.enable = true;
       programs.nix-ld.enable = true;
       nix.optimise.automatic = true;

modules/services/step-ca/ssh-host.nix

@@ -41,11 +41,11 @@
       };
     };
 
-    imports = with inputs.self.modules.nixos; [ ssh ];
+    # imports = with inputs.self.modules.nixos; [ ssh ];
 
     # NixOS Config
     config = {
-      ssh.certificates.enable = true;
+      # ssh.certificates.enable = true;
       sops.secrets."janus/admin_jwk" = {
         # Shared provisioner credential is intentionally centralized.
         sopsFile = ../../../keys/secrets.yaml;