name tweak

modules/features/ssh-certs.nix

@@ -9,7 +9,7 @@ in
       inherit pkgs;
       package = (pkgs.symlinkJoin {
         name = "ssh-certs";
-        meta.mainProgram = "sign-ssh-user-cert";
+        meta.mainProgram = "ssh-user-cert-sign";
         paths = [
           (inputs.self.wrappers.signUserWrapper.apply {
             inherit pkgs;
@@ -18,11 +18,18 @@ in
             validUsers = [ "john" "root" "appdaemon" ];
           }).wrapper
 
+          (inputs.self.wrappers.userCheckWrapper.apply {
+            inherit pkgs;
+          }).wrapper
+
           (inputs.self.wrappers.signHostWrapper.apply {
             inherit pkgs;
             provisioner = "admin";
             overwrite = true;
-            # extraPrincipals = [ "home-pc" ];
+          }).wrapper
+
+          (inputs.self.wrappers.hostCheckWrapper.apply {
+            inherit pkgs;
           }).wrapper
         ];
       });
@@ -35,6 +42,9 @@ in
         type = lib.types.nullOr lib.types.str;
         default = "admin";
       };
+      provisionerPasswordFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+      };
       extraPrincipals = lib.mkOption {
         type = lib.types.listOf lib.types.str;
         default = [ ];
@@ -43,7 +53,7 @@ in
     };
 
     config = {
-      binName = "sign-ssh-host-cert";
+      binName = "ssh-host-cert-sign";
       package = config.pkgs.step-cli;
       extraPackages = with config.pkgs; [ hostname iproute2 systemd ];
       preHook = ''
@@ -66,6 +76,9 @@ in
           "--principal" "$IP_ADDRESS"
         ]
         ++ lib.optionals (config.provisioner != null) [ "--provisioner" "${config.provisioner}" ]
+        ++ lib.optionals (config.provisionerPasswordFile != null) [
+          "--provisioner-password-file" "${config.provisionerPasswordFile}"
+        ]
         ++ lib.optionals config.overwrite [ "-f" ]
         ++ mkPrincipalArgs config.extraPrincipals;
       postHook = ''
@@ -74,12 +87,50 @@ in
     };
   });
 
+  flake.wrappers.renewHostWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
+    options = {
+      sshHostKeyFile = lib.mkOption {
+        type = lib.types.str;
+        default = "/etc/ssh/ssh_host_ed25519_key";
+      };
+      overwrite = lib.mkEnableOption "Overwrite existing cert file?";
+    };
+
+    config = {
+      binName = "ssh-host-cert-renew";
+      package = config.pkgs.step-cli;
+      extraPackages = with config.pkgs; [ systemd ];
+      args =
+        [ "ssh" "renew" "${config.sshHostKeyFile}-cert.pub" "${config.sshHostKeyFile}" ]
+        ++ lib.optionals config.overwrite [ "-f" ];
+    };
+  });
+
+  flake.wrappers.hostCheckWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
+    options = {
+      certPath = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = "/etc/ssh/ssh_host_ed25519_key-cert.pub";
+      };
+    };
+
+    config = {
+      binName = "ssh-host-cert-check";
+      package = config.pkgs.openssh;
+      exePath = lib.getExe' config.pkgs.openssh "ssh-keygen";
+      args = [ "-Lf" "${config.certPath}" ];
+    };
+  });
+
   flake.wrappers.signUserWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
     options = {
       provisioner = lib.mkOption {
         type = lib.types.nullOr lib.types.str;
         default = "admin";
       };
+      provisionerPasswordFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+      };
       validUsers = lib.mkOption {
         description = "A list of the user names that this cert will be valid for";
         type = lib.types.listOf lib.types.str;
@@ -89,12 +140,55 @@ in
     };
 
     config = {
-      binName = "sign-ssh-user-cert";
+      binName = "ssh-user-cert-sign";
       package = config.pkgs.step-cli;
       args = [ "ssh" "certificate" "--sign" ]
         ++ lib.optionals (config.provisioner != null) [ "--provisioner" "${config.provisioner}" ]
+        ++ lib.optionals (config.provisionerPasswordFile != null) [
+          "--provisioner-password-file" "${config.provisionerPasswordFile}"
+        ]
         ++ lib.optionals config.overwrite [ "-f" ]
         ++ mkPrincipalArgs config.validUsers;
     };
   });
+
+  flake.wrappers.userCheckWrapper = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
+    options = {
+      certPath = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = "$HOME/.ssh/id_ed25519-cert.pub";
+      };
+    };
+
+    config = {
+      binName = "ssh-user-cert-check";
+      package = config.pkgs.openssh;
+      exePath = lib.getExe' config.pkgs.openssh "ssh-keygen";
+      args = [ "-Lf" "${config.certPath}" ];
+    };
+  });
+
+  flake.wrappers.renewalCheck = inputs.wrappers.lib.wrapModule ({config, lib, wlib, ... }: {
+    options = {
+      certPath = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = "$HOME/.ssh/id_ed25519-cert.pub";
+      };
+      expires-in = lib.mkOption {
+        type = lib.types.str;
+        default = "4h";
+      };
+    };
+    config = {
+      binName = "ssh-renewal-check";
+      package = config.pkgs.step-cli;
+      preHook = ''
+        echo "Checking SSH cert at ${config.certPath}"
+      '';
+      args = [
+        "ssh" "needs-renewal" "${config.certPath}"
+        "--expires-in" "${config.expires-in}"
+      ];
+    };
+  });
 }

modules/features/ssh.nix

@@ -0,0 +1,281 @@
+# New attempt at consolidating SSH config that wraps the step client, SSH certs, and all that in a top-level module
+{ self, inputs, ... }:
+let
+  caPatterns = [ "*.john-stream.com" "192.168.1.*" "fded:fb16:653e:25da:be24:11ff:*" ];
+in
+{
+  flake.modules.nixos.ssh-new = { config, pkgs, lib, ... }:
+    let
+      cfg = config.ssh-new;
+      hostKeyFile = "${cfg.host.configDir}/${cfg.host.keyFile}";
+      hostCertFile = "${hostKeyFile}-cert.pub";
+      userCAFile = "${cfg.host.configDir}/${cfg.certificates.user.CAFile}";
+      sshHostCAContent = lib.removeSuffix "\n" (builtins.readFile ../hosts/janus/public/ssh_host_ca_key.pub);
+      CAknownHosts = (lib.genAttrs caPatterns (_: {
+          certAuthority = true;
+          publicKey = sshHostCAContent;
+      }));
+
+      wrappers = inputs.self.wrappers;
+      provisionerPasswordFile = config.sops.secrets."janus/admin_jwk".path;
+      sshHostCertSign = (wrappers.signHostWrapper.apply {
+        inherit pkgs provisionerPasswordFile;
+        inherit (cfg.certificates) provisioner;
+        inherit (cfg.certificates.host) extraPrincipals;
+      }).wrapper;
+      sshHostCertRenew = (wrappers.renewHostWrapper.apply {
+        inherit pkgs;
+        sshHostKeyFile = hostKeyFile;
+        overwrite = true;
+      }).wrapper;
+      sshHostCertCheck = (wrappers.hostCheckWrapper.apply {
+        inherit pkgs;
+        certPath = hostCertFile;
+      }).wrapper;
+      sshHostRenewalCheck = (wrappers.renewalCheck.apply {
+        inherit pkgs;
+        certPath = hostCertFile;
+        expires-in = "4h";
+      }).wrapper;
+      sshUserCertSign = (wrappers.signUserWrapper.apply {
+        inherit pkgs provisionerPasswordFile;
+        inherit (cfg.certificates) provisioner;
+        validUsers = [ "root" "john" "appdaemon" ];
+      }).wrapper;
+      sshUserCertCheck = (wrappers.userCheckWrapper.apply {
+        inherit pkgs;
+        certPath = "${cfg.user.keyFile}-cert.pub";
+      }).wrapper;
+    in
+    {
+      options.ssh-new = {
+        user = {
+          keyFile = lib.mkOption {
+            type = lib.types.str;
+            default = "$HOME/.ssh/id_ed25519";
+          };
+        };
+        host = {
+          configDir = lib.mkOption {
+            type = lib.types.str;
+            default = "/etc/ssh";
+          };
+          keyFile = lib.mkOption {
+            description = "String path to the host private key file";
+            type = lib.types.str;
+            default = "ssh_host_ed25519_key";
+          };
+          keyType = lib.mkOption {
+            description = "OpenSSH host key type for ssh.hostKey.";
+            type = lib.types.enum [ "ed25519" "rsa" "ecdsa" ];
+            default = "ed25519";
+          };
+          extraSettings = lib.mkOption {
+            description = "Extra settings to merge";
+            type = lib.types.attrs;
+            default = { };
+          };
+        };
+        certificates = {
+          provisioner = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+          };
+          host = {
+            enable = lib.mkEnableOption "Enable SSH host certs";
+            autoRenew = lib.mkEnableOption "Auto-renew the SSH host certs with a systemd service/timer";
+            extraPrincipals = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
+              default = [ ];
+            };
+          };
+          user = {
+            enable = lib.mkEnableOption "Enable SSH user certs";
+            CAFile = lib.mkOption {
+              description = "Filename of the SSH user CA with the config directory";
+              type = lib.types.str;
+              default = "ssh_user_ca_key.pub";
+            };
+            extraPrincipals = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
+              default = [ ];
+            };
+          };
+        };
+      };
+
+      config = {
+        services.openssh = {
+          enable = true;
+          openFirewall = true;
+          hostKeys = [
+            {
+              path = hostKeyFile;
+              type = cfg.host.keyType;
+            }
+          ];
+          settings = lib.mkMerge [
+            {
+              PasswordAuthentication = false;
+              KbdInteractiveAuthentication = false;
+            }
+            cfg.host.extraSettings
+            (lib.mkIf cfg.certificates.host.enable {
+              HostCertificate = "${hostKeyFile}-cert.pub";
+            })
+            (lib.mkIf cfg.certificates.user.enable {
+              TrustedUserCAKeys = "${cfg.host.configDir}/${cfg.certificates.user.CAFile}";
+            })
+          ];
+        };
+
+        environment.etc."ssh/${cfg.certificates.user.CAFile}" = lib.mkIf cfg.certificates.user.enable {
+          source = ../hosts/janus/public/ssh_user_ca_key.pub;
+        };
+
+        environment.systemPackages = (
+          lib.optionals cfg.certificates.host.enable [
+            sshHostCertSign
+            sshHostCertRenew
+            sshHostRenewalCheck
+            sshHostCertCheck
+          ]
+        );
+
+        sops = lib.mkIf cfg.certificates.host.autoRenew {
+          secrets."janus/admin_jwk" = {
+            sopsFile = ../../keys/secrets.yaml;
+            owner = "root";
+            group = "root";
+            mode = "0400";
+          };
+        };
+
+        systemd = lib.mkIf cfg.certificates.host.autoRenew {
+          services.ssh-certs-renew = {
+            description = "SSH host certificate renewal";
+            wantedBy = [ "multi-user.target" ];
+            after = [ "network-online.target" ];
+            wants = [ "network-online.target" ];
+            path = with pkgs; [ step-cli systemd ];
+            serviceConfig = {
+              Type = "oneshot";
+              User = "root";
+              Group = "root";
+              ExecCondition = lib.getExe sshHostRenewalCheck;
+              ExecStart = lib.getExe sshHostCertRenew;
+            };
+          };
+          timers.ssh-certs-renew = {
+            description = "Periodic Step SSH host certificate renewal";
+            wantedBy = [ "timers.target" ];
+            timerConfig = {
+              OnBootSec = "5m";
+              OnUnitActiveSec = "4h";
+              RandomizedDelaySec = "15m";
+              Persistent = true;
+              Unit = "ssh-certs-renew.service";
+            };
+          };
+        };
+
+        # This winds up in /etc/ssh/ssh_known_hosts, which applies to all users
+        programs.ssh.knownHosts = lib.mkIf cfg.certificates.user.enable CAknownHosts;
+
+        home-manager.users.root = lib.mkIf cfg.certificates.user.enable {
+          home.stateVersion = lib.mkDefault config.system.stateVersion;
+          imports = with inputs.self.modules.homeManager; [
+            ssh-new
+          ];
+          home.packages = [
+            sshUserCertSign
+            sshUserCertCheck
+          ];
+          ssh-new.certificates.enable = true;
+        };
+      };
+    };
+
+  flake.modules.homeManager.ssh-new = { config, pkgs, lib, ... }:
+    let
+      cfg = config.ssh-new;
+      sshHostCAContent = lib.removeSuffix "\n" (builtins.readFile ../hosts/janus/public/ssh_host_ca_key.pub);
+      knownHostsText = lib.concatMapStrings
+        (pattern: "@cert-authority ${pattern} ${sshHostCAContent}\n")
+        caPatterns;
+    in
+    {
+      options.ssh-new = {
+        keyFile = lib.mkOption {
+          type = lib.types.str;
+          default = "${config.home.homeDirectory}/.ssh/id_ed25519";
+        };
+        certificates = {
+          enable = lib.mkEnableOption "Enable SSH client certificates";
+        };
+      };
+
+      config = {
+        home.file.".ssh/known_hosts" = lib.mkIf cfg.certificates.enable {
+          text = knownHostsText;
+        };
+        programs.ssh = {
+          enable = true;
+          enableDefaultConfig = false;
+          settings = {
+            # These settings apply to all connections
+            "*" = lib.mkMerge (
+              [
+                # Default settings
+                {
+                  Compression = false;
+                  ServerAliveInterval = 60;
+                  ServerAliveCountMax = 3;
+                  TCPKeepAlive = "yes";
+                  ConnectTimeout = 3;
+
+                  PubkeyAuthentication = "yes";
+                  PasswordAuthentication = "no";
+                  PreferredAuthentications = "publickey";
+                  IdentitiesOnly = true;
+                  IdentityFile = cfg.keyFile;
+
+                  StrictHostKeyChecking = "accept-new";
+                  UserKnownHostsFile = "${config.home.homeDirectory}/.ssh/known_hosts";
+
+                  HashKnownHosts = lib.mkDefault false;
+                  AddKeysToAgent = lib.mkDefault "yes";
+                  ForwardAgent = lib.mkDefault false;
+
+                  RequestTTY = lib.mkDefault "auto";
+                  SetEnv.TERM = "xterm-256color";
+                }
+              ]
+              # SSH certificate settings
+              ++ lib.optionals cfg.certificates.enable [
+                {
+                  CertificateFile = "${cfg.keyFile}-cert.pub";
+                }
+              ]
+            );
+
+            "gitea" = {
+              HostName = "192.168.1.104";
+              User = "john";
+            };
+            "janus" = {
+              HostName = "fded:fb16:653e:25da:be24:11ff:fe6b:4d57";
+              User = "root";
+            };
+            "hermes" = {
+              HostName = "192.168.1.150";
+              User = "root";
+            };
+            "jdl-docker" = {
+              HostName = "jdl-docker.tailcf205.ts.net";
+              User = "john";
+            };
+          };
+        };
+      };
+    };
+}

modules/features/step-client.nix

@@ -2,7 +2,7 @@
 let
   defaultCaUrl = "https://janus.john-stream.com/";
   defaultFingerprint = "2036c44f7b5901566ff7611ea6c927291ecc6d2dd00779c0eead70ec77fa10d6";
-  defaultRoot = ../hosts/janus/root_ca.crt;
+  defaultRoot = ../hosts/janus/public/root_ca.crt;
 
   mkStepBootstrap = { pkgs, caUrl, fingerprint, install ? false }:
     (inputs.self.wrappers.stepBootstrap.apply {

modules/hosts/janus/README.md

@@ -38,14 +38,14 @@ Secret source-of-truth after this split:
 
 Then update public artifacts in repo from generated output:
 
-- `modules/hosts/janus/root_ca.crt` from `/tmp/janus-step-ca-bootstrap/step/certs/root_ca.crt`
-- `modules/hosts/janus/intermediate_ca.crt` from `/tmp/janus-step-ca-bootstrap/step/certs/intermediate_ca.crt` (public certificate; intentionally committed, not stored in SOPS)
+- `modules/hosts/janus/public/root_ca.crt` from `/tmp/janus-step-ca-bootstrap/step/certs/root_ca.crt`
+- `modules/hosts/janus/public/intermediate_ca.crt` from `/tmp/janus-step-ca-bootstrap/step/certs/intermediate_ca.crt` (public certificate; intentionally committed, not stored in SOPS)
 - `modules/hosts/janus/fingerprint` from:
 	```shell
 	step certificate fingerprint /tmp/janus-step-ca-bootstrap/step/certs/root_ca.crt
 	```
-- `modules/hosts/janus/ssh_user_ca_key.pub` from `/tmp/janus-step-ca-bootstrap/step/certs/ssh_user_ca_key.pub`
-- `modules/hosts/janus/ssh_host_ca_key.pub` from `/tmp/janus-step-ca-bootstrap/step/certs/ssh_host_ca_key.pub`
+- `modules/hosts/janus/public/ssh_user_ca_key.pub` from `/tmp/janus-step-ca-bootstrap/step/certs/ssh_user_ca_key.pub`
+- `modules/hosts/janus/public/ssh_host_ca_key.pub` from `/tmp/janus-step-ca-bootstrap/step/certs/ssh_host_ca_key.pub`
 
 ## First boot checks
 

modules/hosts/janus/default.nix

@@ -4,19 +4,19 @@ let
   hostname = "janus";
   ipv4 = "192.168.1.32";
   ipv6 = "fded:fb16:653e:25da:be24:11ff:fe6b:4d57";
+  names = [ "${hostname}.john-stream.com" ipv4 ipv6 ];
 in
 {
   flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
     modules = with inputs.self.modules; [
       nixos.lxc
-      nixos.mysops
-      nixos.ssh-certs
-      nixos.step-client
-      nixos.step-ca
+      nixos.login-text
       inputs.home-manager.nixosModules.home-manager
       nixos."${username}"
-      nixos.docker
-      nixos.login-text
+      nixos.ssh-new
+      nixos.mysops
+      nixos.step-ca       # Runs the step-ca server
+      nixos.step-client   # Uses the step-ca server as a client
       nixos.mtls
       ({ config, lib, pkgs, ... }: {
         networking.hostName = hostname;
@@ -24,18 +24,19 @@ in
           "Step-CA" = "step-ca";
         };
         sops.defaultSopsFile = ./secrets.yaml;
-        ssh-certs = {
-          hostname = hostname;
-          extraPrincipals = [ ipv4 ipv6 ];
+        ssh-new.certificates = {
+          provisioner = "admin";
+          host = {
+            enable = true;
+            extraPrincipals = names;
+            autoRenew = true;
+          };
+          user.enable = true;
         };
         step-ca = {
-          rootCertPath = ./root_ca.crt;
-          intermediateCertPath = ./intermediate_ca.crt;
-          dnsNames = [
-            "${hostname}.john-stream.com"
-            ipv4
-            ipv6
-          ];
+          rootCertPath = ./public/root_ca.crt;
+          intermediateCertPath = ./public/intermediate_ca.crt;
+          dnsNames = names;
           secrets = {
             sopsFile = ./secrets.yaml;
             caPassword = "janus/ca_password";
@@ -49,10 +50,7 @@ in
         mtls = {
           enable = true;
           subject = hostname;
-          san = [
-            "${hostname}.john-stream.com"
-            ipv4
-          ];
+          san = names;
           bootstrap = {
             enable = true;
             after = [ "sops-nix.service" "step-ca.service" ];
@@ -60,24 +58,6 @@ in
             provisionerPasswordFile = config.sops.secrets."janus/admin_jwk".path;
           };
         };
-
-        users.users."${username}" = {
-          shell = lib.mkForce (
-            lib.getExe inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.jsl-zsh
-          );
-        };
-
-        # users.users."${username}".openssh.authorizedKeys.keys = [
-        #   "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMOkGLo4N/L3RYvaIZ1FmePlxa1HK0fMciZxKtRhN58F root@janus"
-        # ];
-
-        home-manager.users."${username}" = {
-          imports = with inputs.self.modules.homeManager; [
-            mysops
-            step-client
-          ];
-          docker.enable = true;
-        };
       })
     ];
   };

modules/hosts/john-pc/default.nix

@@ -3,11 +3,8 @@ let
   username = "john";
   hostname = "john-pc-ubuntu";
 
-  # testTarget = "fded:fb16:653e:25da:be24:11ff:fe89:1cc3"; # soteria
-  # testTarget = "fded:fb16:653e:25da:be24:11ff:fea0:753f"; # test-nix
   testHost = "soteria"; # which host to test build
   testTarget = "test-nix";
-
 in
 {
   flake.modules.homeManager."${hostname}" = { config, pkgs, lib, ... }:
@@ -41,11 +38,7 @@ in
     home.packages = with pkgs; [
       nil # Nix language server
       selfPkgs.jsl-zsh
-      # selfPkgs.my-neovim
-      selfPkgs.ssh-certs
-      # selfPkgs.step-bootstrap
-      # selfPkgs.wg-platform
-      # self'.packages.myWrappedPackage
+      # selfPkgs.ssh-certs
       (inputs.self.wrappers.test-push.apply {
         inherit pkgs flakeDir;
         host = testHost;
@@ -55,20 +48,18 @@ in
 
     homeManagerFlakeDir = flakeDir;
     docker.enable = true;
-
-    ssh = {
+    ssh-new = {
       certificates.enable = true;
-      knownHosts = [
-        "@cert-authority fded:fb16:653e:25da:be24:11ff:* ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNug18oLH0vZxnibXJzMJvTWFPZTnSlhCDDVi+rHhgnIum6ZXQ4SF+VHOOAM5BbzZmMKitNJ5lcrGP15Eur7DzQ="
-      ];
-      matchSets = {
-        certs = true;
-        appdaemon = true;
-        homelab = true;
-        dev = true;
-        tailscale = true;
-      };
     };
+    # ssh = {
+    #   matchSets = {
+    #     certs = true;
+    #     appdaemon = true;
+    #     homelab = true;
+    #     dev = true;
+    #     tailscale = true;
+    #   };
+    # };
 
     # This provides the keys at build time and will be included in the nix store
     sops.defaultSopsFile = ../../../keys/secrets.yaml;

modules/nixos/login-text.nix

@@ -2,7 +2,7 @@
   flake.modules.nixos.login-text = { config, lib, ... }:
     let
       defaultServiceStatus = {
-        SSH = "sshd.socket";
+        "SSH Socket" = "sshd.socket";
         "SSH Cert Renewal" = "ssh-certs-renew.timer";
       };
     in {

modules/nixos/lxc.nix

@@ -15,12 +15,9 @@
       nix.settings.experimental-features = [ "nix-command" "flakes" ];
       environment.systemPackages = with pkgs; [
         git
-        zsh
         selfPackages.jsl-zsh-tty
       ];
-      environment.shells = lib.mkAfter [
-        rootShellPath
-      ];
+      environment.shells = lib.mkAfter [ rootShellPath ];
       users.users.root.shell = lib.mkForce rootShellPath;
 
       # security.sudo-rs.enable = true;

modules/programs/onepassword.nix

@@ -16,5 +16,9 @@
       [[ssh-keys]]
       vault = "Private"
     '';
+
+    programs.ssh.settings."*" = {
+      IdentityAgent = "${config.home.homeDirectory}/.1password/agent.sock";
+    };
   };
 }

modules/programs/sops.nix

@@ -35,9 +35,10 @@ in
 
       config =
         let
+          identityFile = config.ssh-new.keyFile;
           my-sops = (inputs.self.wrappers.mySops.apply {
             inherit pkgs;
-            sshKey = config.ssh.identityFile;
+            sshKey = identityFile;
           }).wrapper;
         in
         {
@@ -46,7 +47,7 @@ in
           sops = {
             defaultSopsFile = ../../keys/secrets.yaml;
             defaultSopsFormat = "yaml";
-            age.sshKeyPaths = [ "${config.ssh.identityFile}" ];
+            age.sshKeyPaths = [ identityFile ];
           };
 
           home.packages = with pkgs; [

modules/services/ssh.nix

@@ -1,249 +0,0 @@
-{ inputs, ... }:
-let
-  userName = "john";
-  sshHostCAPubKeyPath = ../hosts/janus/ssh_host_ca_key.pub;
-in
-{
-  flake.modules.nixos.ssh = { config, pkgs, lib, ... }:
-  let
-    cfg = config.ssh;
-    configDir = "/etc/ssh";
-    sshHostCAPubKey = lib.removeSuffix "\n" (builtins.readFile sshHostCAPubKeyPath);
-  in
-  {
-    options.ssh = {
-      hostKey = lib.mkOption {
-        description = "String path to the host private key file";
-        type = lib.types.str;
-        default = "ssh_host_ed25519_key";
-      };
-      hostKeyType = lib.mkOption {
-        description = "OpenSSH host key type for ssh.hostKey.";
-        type = lib.types.enum [ "ed25519" "rsa" "ecdsa" ];
-        default = "ed25519";
-      };
-      fallbackHostKeys = lib.mkOption {
-        description = "Additional non-certificate host keys that keep sshd reachable during certificate bootstrap.";
-        type = with lib.types; listOf (submodule {
-          options = {
-            path = lib.mkOption {
-              description = "Path to the host private key file.";
-              type = str;
-            };
-            type = lib.mkOption {
-              description = "OpenSSH host key type.";
-              type = enum [ "ed25519" "rsa" "ecdsa" ];
-            };
-          };
-        });
-        default = [
-          {
-            path = "${configDir}/ssh_host_rsa_key";
-            type = "rsa";
-          }
-        ];
-      };
-      certificates = {
-        enable = lib.mkEnableOption "Enable SSH host certificates";
-        userCA = lib.mkOption {
-          description = "Content for the SSH user CA file (public key)";
-          type = lib.types.path;
-          default = sshHostCAPubKeyPath;
-        };
-        userCAFile = lib.mkOption {
-          description = "String path to the SSh user CA";
-          type = lib.types.str;
-          default = "ssh_user_ca_key.pub";
-        };
-      };
-    };
-
-    config = {
-      services.openssh = {
-        enable = true;
-        hostKeys = cfg.fallbackHostKeys ++ [
-          {
-            path = "${configDir}/${cfg.hostKey}";
-            type = cfg.hostKeyType;
-          }
-        ];
-        # require public key authentication for better security
-        settings = lib.mkMerge [
-          {
-            PasswordAuthentication = false;
-            KbdInteractiveAuthentication = false;
-          }
-          (lib.mkIf cfg.certificates.enable {
-            TrustedUserCAKeys = "${configDir}/${cfg.certificates.userCAFile}";
-            HostCertificate = "${configDir}/${cfg.hostKey}-cert.pub";
-          })
-        ];
-      };
-
-      environment.etc."ssh/${cfg.certificates.userCAFile}" = lib.mkIf cfg.certificates.enable {
-        source = cfg.certificates.userCA;
-      };
-
-      programs.ssh.knownHosts = lib.mkIf cfg.certificates.enable {
-        "192.168.1.*" = {
-          certAuthority = true;
-          publicKey = sshHostCAPubKey;
-        };
-        "*.john-stream.com" = {
-          certAuthority = true;
-          publicKey = sshHostCAPubKey;
-        };
-      };
-    };
-  };
-
-  flake.modules.homeManager.ssh = { config, pkgs, lib, ... }:
-  let
-    cfg = config.ssh;
-    configDir = "${config.home.homeDirectory}/.ssh";
-    identityFile = cfg.identityFile;
-    publicKeyFile = "${identityFile}.pub";
-    certificateFile = "${identityFile}-cert.pub";
-    sshHostCAPubKey = lib.removeSuffix "\n" (builtins.readFile sshHostCAPubKeyPath);
-  in
-  {
-    options.ssh = with lib; {
-      identityFile = mkOption {
-        # Intentionally not using a path type here because that will end up with the private key getting copied into the store
-        type = types.str;
-        default = "${config.home.homeDirectory}/.ssh/id_ed25519";
-        description = "Path to the SSH identity file.";
-      };
-
-      certificates = {
-        enable = mkEnableOption "Enable SSH client certificates";
-      };
-
-      knownHostsFile = mkOption {
-        type = types.str;
-        default = "${configDir}/known_hosts";
-      };
-
-      knownHosts = mkOption {
-        description = "";
-        type = types.listOf types.str;
-        default = [ ];
-      };
-
-      matchSets = {
-        appdaemon = mkEnableOption "Enable AppDaemon SSH targets";
-        certs = mkEnableOption "Enable Janus and Soteria SSH targets";
-        homelab = mkEnableOption "Enable various Homelab targets";
-        dev = mkEnableOption "Enable development targets";
-        tailscale = mkEnableOption "Enable tailscale targets";
-      };
-    };
-
-    config = {
-      home.file.".ssh/known_hosts" = {
-        text = lib.concatStringsSep "\n" (
-          cfg.knownHosts ++ lib.optionals cfg.certificates.enable [
-            "@cert-authority 192.168.1.* ${sshHostCAPubKey}"
-            "@cert-authority *.john-stream.com ${sshHostCAPubKey}"
-          ]
-        );
-      };
-
-      programs.ssh = {
-        enable = true;
-        enableDefaultConfig = false;
-        extraConfig = ''
-          SetEnv TERM="xterm-256color"
-        '';
-
-        settings = lib.mkMerge [
-          {
-            "john-pc-ubuntu" = {
-              HostName = "192.168.1.85";
-            };
-
-            "*" = lib.mkMerge [
-              {
-                User = "john";
-                IdentityAgent = "${config.home.homeDirectory}/.1password/agent.sock";
-
-                Compression = false;
-                ServerAliveInterval = 0;
-                ServerAliveCountMax = 3;
-
-                IdentitiesOnly = true;
-                IdentityFile = identityFile;
-
-                HashKnownHosts = false;
-                UserKnownHostsFile = cfg.knownHostsFile;
-
-                AddKeysToAgent = "yes";
-                ForwardAgent = false;
-              }
-              (lib.mkIf cfg.certificates.enable { CertificateFile = certificateFile; })
-            ];
-          }
-          (lib.mkIf cfg.matchSets.appdaemon {
-            "appdaemon" = {
-              HostName = "192.168.1.242";
-              User = "appdaemon";
-            };
-            "ad-nix" = {
-              HostName = "192.168.1.201";
-              User = "appdaemon";
-            };
-          })
-          (lib.mkIf cfg.matchSets.certs {
-            "janus" = {
-              HostName = "fded:fb16:653e:25da:be24:11ff:fe6b:4d57";
-              User = "root";
-            };
-            "soteria" = {
-              HostName = "soteria.john-stream.com";
-              User = "john";
-            };
-          })
-          (lib.mkIf cfg.matchSets.homelab {
-            "docs" = {
-              HostName = "192.168.1.110";
-              User = "root";
-              RequestTTY = "force";
-              RemoteCommand = "~/.nix-profile/bin/jsl-zsh";
-            };
-            "gitea" = {
-              HostName = "192.168.1.104";
-              User = "john";
-            };
-            "hermes" = {
-              HostName = "192.168.1.150";
-              User = "root";
-              # Enabling this breaks the ability of Zed to install its remote stuff
-              # RequestTTY = "force";
-              # RemoteCommand = "/root/.nix-profile/bin/jsl-zsh";
-            };
-            "panoptes" = {
-              HostName = "192.168.1.107";
-              User = "panoptes";
-            };
-          })
-          (lib.mkIf cfg.matchSets.dev {
-            "test-nix" = {
-              HostName = "fded:fb16:653e:25da:be24:11ff:fea0:753f";
-              User = "john";
-              RequestTTY = "auto";
-              # RemoteCommand = "/run/current-system/sw/bin/jsl-zsh";
-            };
-          })
-          (lib.mkIf cfg.matchSets.tailscale {
-            "jdl-docker" = {
-              HostName = "jdl-docker.tailcf205.ts.net";
-              User = "john";
-              RequestTTY = "auto";
-              # RemoteCommand = "~/.nix-profile/bin/jsl-zsh";
-            };
-          })
-        ];
-      };
-    };
-  };
-}

modules/services/step-ca/ssh-host.nix

@@ -2,41 +2,33 @@
   flake.modules.nixos.ssh-certs = { config, pkgs, lib, ... }:
   let
     cfg = config.ssh-certs;
-    provisionerPasswordPath = config.sops.secrets."janus/admin_jwk".path;
+    wrappers = inputs.self.wrappers;
     sshKeyPath = "/etc/ssh/ssh_host_ed25519_key";
     sshCertPath = "${sshKeyPath}-cert.pub";
-    mkPrincipalArgs = principals:
-      lib.concatMapStringsSep " " (principal: ''--principal "${principal}"'') principals;
-    principalArgs = mkPrincipalArgs ([
-      cfg.hostname
-      "${cfg.hostname}.john-stream.com"
-    ] ++ cfg.extraPrincipals);
-    sshHostCertRenew = pkgs.writeShellScriptBin "ssh-host-cert-renew" ''
-      set -euo pipefail
 
-      if [ ! -s "${sshKeyPath}.pub" ]; then
-        ${lib.getExe' pkgs.openssh "ssh-keygen"} -y -f "${sshKeyPath}" > "${sshKeyPath}.pub"
-        chmod 0644 "${sshKeyPath}.pub"
-      fi
-
-      ${lib.getExe pkgs.step-cli} ssh certificate \
-        --host --sign \
-        --provisioner "${cfg.provisioner}" \
-        --provisioner-password-file "${provisionerPasswordPath}" \
-        ${principalArgs} \
-        "${cfg.hostname}" "${sshKeyPath}.pub"
-    '';
-    sshHostCertCheck = pkgs.writeShellScriptBin "ssh-host-cert-check" ''
-      ${lib.getExe' pkgs.openssh "ssh-keygen"} -Lf ${sshCertPath}
-    '';
+    sshHostCertSign = (wrappers.signHostWrapper.apply {
+      inherit pkgs;
+      inherit (cfg) provisioner extraPrincipals;
+      provisionerPasswordFile = config.sops.secrets."janus/admin_jwk".path;
+    }).wrapper;
+    sshHostCertRenew = (wrappers.renewHostWrapper.apply {
+      inherit pkgs;
+      sshHostKeyFile = sshKeyPath;
+      overwrite = true;
+    }).wrapper;
+    sshHostCertCheck = (wrappers.hostCheckWrapper.apply {
+      inherit pkgs;
+      certPath = sshCertPath;
+    }).wrapper;
+    sshHostRenewalCheck = (wrappers.renewalCheck.apply {
+      inherit pkgs;
+      certPath = sshCertPath;
+      expires-in = "4h";
+    }).wrapper;
   in
   {
     # NixOS Options
     options.ssh-certs = {
-      hostname = lib.mkOption {
-        description = "Networking host name to register with the CA";
-        type = lib.types.str;
-      };
       provisioner = lib.mkOption {
         description = "Provisioner inside Step CA to use for the SSH certificates";
         type = lib.types.str;
@@ -64,59 +56,30 @@
       networking.nameservers = [ "192.168.1.150" ];
       networking.dhcpcd.extraConfig = "nohook resolv.conf";
       environment.systemPackages = [
+        sshHostCertSign
         sshHostCertRenew
+        sshHostRenewalCheck
         sshHostCertCheck
       ];
 
       systemd.services.ssh-certs-renew = {
-        description = "Renew Step SSH host certificate if needed";
+        description = "SSH host certificate renewal";
         wantedBy = [ "multi-user.target" ];
-        before = [ "sshd.service" ];
         after = [ "network-online.target" ];
         wants = [ "network-online.target" ];
-        path = with pkgs; [ coreutils systemd step-cli openssh ];
+        path = with pkgs; [ step-cli systemd ];
         serviceConfig = {
           Type = "oneshot";
           User = "root";
           Group = "root";
+          ExecCondition = lib.getExe sshHostRenewalCheck;
+          ExecStart = lib.getExe sshHostCertRenew;
         };
-        script = ''
-          set -euo pipefail
-
-          renew=0
-          if [ ! -s "${sshCertPath}" ]; then
-            echo "SSH host cert missing: ${sshCertPath}"
-            renew=1
-          elif ${lib.getExe pkgs.step-cli} ssh needs-renewal "${sshCertPath}" --expires-in "4h"; then
-            echo "SSH host cert needs renewal"
-            renew=1
-          else
-            rc=$?
-            if [ "$rc" -eq 1 ]; then
-              echo "SSH host cert does not need renewal"
-              exit 0
-            fi
-
-            if [ "$rc" -eq 2 ]; then
-              echo "SSH host cert missing or unreadable: ${sshCertPath}"
-              renew=1
-            else
-              echo "step ssh needs-renewal failed with rc=$rc" >&2
-              exit "$rc"
-            fi
-          fi
-
-          if [ "$renew" -eq 1 ]; then
-            ${lib.getExe sshHostCertRenew}
-            ${lib.getExe sshHostCertCheck}
-          fi
-        '';
       };
 
       systemd.timers.ssh-certs-renew = {
         description = "Periodic Step SSH host certificate renewal";
         wantedBy = [ "timers.target" ];
-
         timerConfig = {
           OnBootSec = "5m";
           OnUnitActiveSec = "4h";
@@ -125,10 +88,6 @@
           Unit = "ssh-certs-renew.service";
         };
       };
-
-      # Ensure sshd waits for a cert reconciliation attempt at boot.
-      systemd.services.sshd.wants = [ "ssh-certs-renew.service" ];
-      systemd.services.sshd.after = [ "ssh-certs-renew.service" ];
     };
   };
 }

modules/users/john.nix

@@ -36,10 +36,10 @@ in
         selfPkgs = inputs.self.packages.${pkgs.stdenv.hostPlatform.system};
       in {
         home.stateVersion = "25.11";
-        imports = [
-          inputs.self.modules.homeManager.shell-tools
-          inputs.self.modules.homeManager.ssh
-          inputs.self.modules.homeManager.git
+        imports = with inputs.self.modules.homeManager; [
+          ssh-new
+          shell-tools
+          git
         ];
         xdg.enable = true;
         home.packages = [