adjusted timings

.sops.yaml

@@ -1,14 +1,17 @@
 keys:
   - &john-p14s age1f6drjusg866yscj8029tk4yfpgecklrvezldm02ankm6h8nnwu5s2u6ahy
   - &john-pc age1ykcs39e62pz3xu6cedg8ea685kv5d5qsrhgkndygzm8rx30xd5ys5t3qxt
+  - &test-nix age1gvplss0ddmyf6vpjy363wu3n057vhm0j6n7tc94cxd8kadapypws5mtaj0
 creation_rules:
   - path_regex: \.yaml$
     key_groups:
     - age:
       - *john-p14s
       - *john-pc
+      - *test-nix
   - path_regex: \.json$
     key_groups:
     - age:
       - *john-p14s
       - *john-pc
+      - *test-nix

README.md

@@ -15,7 +15,15 @@ nix flake show --all-systems
 ## Layout
 
 - Everything under `./modules` gets auto-imported by `import-tree`
-- 
+
+| Directory     | Description |
+| ------------- | ----------- |
+| `hosts`       | Provides either `homeConfigurations` or `nixosConfigurations` |
+| `nix-tools`   | Nix-specific tools, like factory functions for use in the flakes |
+| `nixos`       | `flake.modules.nixos` |
+| `programs`    | flakes that provide `flake.modules` attributes for specific programs |
+| `services`    | flakes that provide configuration for running services |
+| `users`       | flakes that provide configuration for individual users with the `flake.factory.user` factory |
 
 ## Mechanics
 

flake.lock

@@ -2,11 +2,11 @@
   "nodes": {
     "flake-file": {
       "locked": {
-        "lastModified": 1772999280,
-        "narHash": "sha256-XX60YlqSKa/QNIJVnLeEXNDQPwrQucMuITef6rEJqIs=",
+        "lastModified": 1773554778,
+        "narHash": "sha256-keH0VNsci9e0Uwt3Msp/N+pltaP8Lb6lt09Q3WvDPw4=",
         "owner": "vic",
         "repo": "flake-file",
-        "rev": "e2a19eb539fa7be4537f6e73e7556edf031eed7f",
+        "rev": "f4780a86bd4c756475d839b286f8a40aabdbc802",
         "type": "github"
       },
       "original": {
@@ -76,11 +76,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1772985285,
-        "narHash": "sha256-wEEmvfqJcl9J0wyMgMrj1TixOgInBW/6tLPhWGoZE3s=",
+        "lastModified": 1773608492,
+        "narHash": "sha256-QZteyExJYSQzgxqdsesDPbQgjctGG7iKV/6ooyQPITk=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "5be5d8245cbc7bc0c09fbb5f38f23f223c543f85",
+        "rev": "9a40ec3b78fc688d0908485887d355caa5666d18",
         "type": "github"
       },
       "original": {
@@ -91,11 +91,11 @@
     },
     "import-tree": {
       "locked": {
-        "lastModified": 1772999353,
-        "narHash": "sha256-dPb0WxUhFaz6wuR3B6ysqFJpsu8txKDPZvS47AT2XLI=",
+        "lastModified": 1773554199,
+        "narHash": "sha256-6apV5N1F5tTD8JY9AUGnkWmy56HqDPn4MNFRsq4Rg+s=",
         "owner": "vic",
         "repo": "import-tree",
-        "rev": "545a4df146fce44d155573e47f5a777985acf912",
+        "rev": "c6ebc59c85ee54cfb68163d06d1a3149ce0fe431",
         "type": "github"
       },
       "original": {
@@ -127,11 +127,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1772773019,
-        "narHash": "sha256-E1bxHxNKfDoQUuvriG71+f+s/NT0qWkImXsYZNFFfCs=",
+        "lastModified": 1773389992,
+        "narHash": "sha256-wvfdLLWJ2I9oEpDd9PfMA8osfIZicoQ5MT1jIwNs9Tk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "aca4d95fce4914b3892661bcb80b8087293536c6",
+        "rev": "c06b4ae3d6599a672a6210b7021d699c351eebda",
         "type": "github"
       },
       "original": {
@@ -143,11 +143,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1772771118,
-        "narHash": "sha256-SDEGkbscgwFhxzfvNdDNcvsA82gAQcyOh0/BZOb6fWg=",
-        "rev": "e38213b91d3786389a446dfce4ff5a8aaf6012f2",
+        "lastModified": 1773507054,
+        "narHash": "sha256-yzDBkI1CpeZrAt4l1nGvTOs3OFtXCS7a7Gi5Y1h878w=",
+        "rev": "e80236013dc8b77aa49ca90e7a12d86f5d8d64c9",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre958959.e38213b91d37/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre963414.e80236013dc8/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
@@ -190,11 +190,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772944399,
-        "narHash": "sha256-xTzsSd3r5HBeufSZ3fszAn0ldfKctvsYG7tT2YJg5gY=",
+        "lastModified": 1773550941,
+        "narHash": "sha256-wa/++bL2QeMUreNFBZEWluQfOYB0MnQIeGNMuaX9sfs=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "c8e69670b316d6788e435a3aa0bda74eb1b82cc0",
+        "rev": "c469b6885f0dcd5c7c56bd935a0f08dbcd9e79e1",
         "type": "github"
       },
       "original": {

keys/root_ca.crt

@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBlDCCATqgAwIBAgIRAKDvqOX8WVhJ/ev02Y1gXKQwCgYIKoZIzj0EAwIwKDEO
+MAwGA1UEChMFSmFudXMxFjAUBgNVBAMTDUphbnVzIFJvb3QgQ0EwHhcNMjUxMjE4
+MDYwMjI4WhcNMzUxMjE2MDYwMjI4WjAoMQ4wDAYDVQQKEwVKYW51czEWMBQGA1UE
+AxMNSmFudXMgUm9vdCBDQTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABMt6kNpx
+Q9vySc1N6F9jJObeQXZI+9f33E1cN4zbEuNpmtpRl0WaPa1AGNbSi5sIbiH7wDv2
+llXfCqYWkeoCE5mjRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/
+AgEBMB0GA1UdDgQWBBRo55byyyo2sePP+8zz+uM4mXNV+zAKBggqhkjOPQQDAgNI
+ADBFAiB6zxTbvWMZWgDQhKGh+MnGQQ7f8UGhzinOfRG7a/HdOAIhAIVWt6MLl6QU
+FOvl/qIFGd7YJeWU5aahPABVttxjSMn/
+-----END CERTIFICATE-----

keys/secrets.yaml

@@ -1,3 +1,8 @@
+janus:
+    fingerprint: ENC[AES256_GCM,data:A0eNE3nX8hVq8m4bNFvkTGR15Xh9QV44JpOJFyhZojPOTirRGEq/MCSNIqpKfoFUB4TXdRZIN95pAoNlO7Z2dQ==,iv:3TQ9ZcjRmnQzkNA5Cv/cpEIT8gTJ1w3cTjTVtxtuzq4=,tag:hIwcjdZ6R8UzUgh/VoDz3A==,type:str]
+    admin_jwk: ENC[AES256_GCM,data:HhsnsCsR87ItjEKP3MsHpxb/WZHvxRrMIhbBgW7qq/0=,iv:b5MKd5TFkxFjd1zY0Lfi2QDv4sLmyKn7riW8s/EfDeA=,tag:GkGfyAM2RtKzuo567bAjiA==,type:str]
+test-nix:
+    ssh_host_key: ENC[AES256_GCM,data:04CRKNCycc8Dre44ERtytmX6NHdZOIds95ckYzmi/i74qEYyN/L5XsuKKmjH2WCn3brvK4pZLLIZWzxC5VJ85q+O8Tfd3qdFROTG5qYRvmK5huxphPaIWSUI2ZEdLqecpRtmq7Zeq+Xa2+JKC0ehg2sqavotkPM5vIeVsaStD5rMVSgnuGaTS3WuPPfEjJPfsCyGPup4ysgxKxfc3JXOR+T8t6w4ccG0Si6tGz6io0Sl9tgPzrYqwqTaMtWLUA50luJg+D8ZxpMjpqFNbIry2tKwettzwXtGz7xGYnjvuk+1sCdYl8PXOMRT2KwAy5usCJsWFRTXJzZ5kxzwAYLwmhlsfPuxwTrR5fRETJPglRP/1muq8piIZn6yHtq9dCSrNcDCZnjnjG+cby28yPLYKhDgVNF5DObob8e6Fp/nP00sdi4Bt1aHRR5pjK/9mpsWE6ikO83SUi4xSoL1LKZM2kC5DL8XBJP7nWQTwijp84m3htMKvrKfFo68G9xP4v/DhVcHLsoNGLytH5omAuGL,iv:0cAtrXlPBis8nYw1XT4kSPRuwVkq0XSh6jjY9mpewIA=,tag:WFsiOe/l8cVicOqX2C94xA==,type:str]
 restic_password:
     john_ubuntu: ENC[AES256_GCM,data:Q4lUaFFDgoK9k4kQj7hSVKaFDGW0T+6V+OpFU5R528R3EKM7YJMgcFX+sK3mWl9XA4/6E1GeINpIqOpx+FP5Cf/8qt9sXBXCmXXSYdA4IH3RS6a1NkcIVjsTMvpn4q/fslCeYN4LB+r4pBGmdca105miqVun8J69cZGwjZ+wuxrMAP+mdnHdSUPycjNWJJzmEa3waQsygAi4A5cAN5sigOPBxe2pCTh/FEKoTgWmzHGJvcjrzuL6wNOpQrkMWwTsHCtbe9dyMP/fQpoBgYDT4W9Rd4XHhbrooje+g3x48EL1rkRIVVNRavpRUih/mjcdJGzzJ6jZmLLcc1f7SZIKZht7f+ZcdZl3rKQB+WanZgK/KAgKBRCrbIk2eeBZwkcRSw5kmGFU7x0azdIipJYj+3KHHQS5S2VW4j2tQG74xK3qaNJcSMjpKmdI1dHcPf0x2ILaDDV9Ts0H4GTOB2zO9iGy7x2tdPd4tugxxk5rr5rphTZL3lgUf0Ri/qMkJh9I8CsjUdvRycHeIEUZPmEVaIqJC2jrd2pBslis5VWD/6PHQBCob07d1fcpIYox4YXM3GcLg3OxiD8nZ7DTzGRMhciZtTKKWbBT8qzPud4ZQvDkT5l+XOpeM13wXFIMa13CwOzYeyWjycED0VQ/i3XRw9+9lg3cosfxaPdaFtv4MjV7Od62G/UJw3OxaQOHM2y24N+Q0pSBoTdDAFwDCH/kcqZji6ZrVTu4Rad8opcILJJcqC+pjegDvBtUdDz+G3/dFiS6m8RYIRb7qB5yEX/lCgzlECmRS2XP8uraNJ5NN8rtk0gdBtaI9/78YyAjLLGkjIcIR4uJA5buCZBR9jIdqf4f52fowbx18VPrwFXN2mYX6mPsKbDmaz0ILHq/I9n8bS/KM7gIQmTw/RAUwnmL4IRu8zHn6nmIqj6d8AkjYx7s6pG8OF8LgfhqZT7tdPKCd+n/HnYn1fZGSw26zHzPd4nKnVV1e3NYvX6CVwVycerGs9elOKtOI8GsrWYyXzJbfC+nWxbHKI/t6sxyzTBrHPR4r6l/CchQF+SfBs5aELKExe7h325qBB2y6EFdkbxTj1tPGqxttp9xJB1LUyNtwsEAkpD44JNqPxZCYHQbeVE3Oo3TYtRUSVWREc1WNIsfSG/anScYUhDEah9YyIdiG+O71QqegunusLoxmpF2rQtx7shtAvJV3skDBB0tFDoQyIV+yPo7kPV0D7Ig+Ba+mk5ASJrT9DXZ53Q2CCTLAuslU4MP7g22RX8rU3s2hFJq8m7wvMwpqa9Tr6O38i1wX4PhG1VRMM8EIlMQnLWWKmni6NbOYiRxFYJMioxH5SyE4ODQYXy5YIuLoRsX8VR6UqJ1GZb7sJf3M1aPOFOHzTN9hnziTRRe1KCMoBrAghrqhvL1VRr9X5PYMxnjBh6o0d5YTN0WOGD2iEVbCzqxFXcxQZBBp4KyNAAhFhGNw8WUp/rVoyCYn7+OEYFspY4FmGMTYhvxbq5LEptXeQgOP2ggBkqsw8sYP9oj1cb4kzBNv8M7nR9kM1EqvZpFV47phoTbBeMY4DZOJodkASFVM5/7ijWy/M9rtWMFMCXKURKkAQJRFADs0KqMJ5osnFFnubX7vKgK736XXF4+wIQuuHqEsYDZ90ftInxq8sYRnb2FZ0EV4yc8qqnz++fjwrAA5EV+zhL6l6hum1zL8JkUJ1ICKZ905If6nIeoul8MY3B1Cz4W+osN2Wtl8OeJ2t3iZx3wk/unVa8uDZH1owu47He68e2V8vpYxOaW4/hLyy/XuL5DukETrhRjC+7GbEaKaCwoA2UwAdqU,iv:N8ek+tp16WiZgjTDxXb0CRXH+MbLsl/oZ/OwcOoVRO0=,tag:uIzCSX0R/EObF/RdWxj64w==,type:str]
 api:
@@ -7,22 +12,31 @@ sops:
         - recipient: age1f6drjusg866yscj8029tk4yfpgecklrvezldm02ankm6h8nnwu5s2u6ahy
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoWkxDSnlNT2Vua1ZXWC8r
-            SU9UMnhaVXVEVlZGL3dtYTBJSzNGbHVaSTJNCm9ZTFM3RndpRktUcWhwZk1Fc2dk
-            ZGtoWXdoOWVyK1F0YStSS3dsMkg2R28KLS0tIFkrdVFZNlVxRjhPaWdMZXl2elV3
-            TVpyTzFsNFNmd3FNU0tlMnlTOHNTQWsKfKdN4epZokF74bCNr9+jxulZJFBQM83P
-            quMhl+H85My8jAsEeC9CW7y2jdNPJkfk9gHun4ozoW8U7o6y5RLfJg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0UEpja2kxdThZVWZhOGVP
+            S0NtSi84MjhnN0RORkh2NjZ4YlYvWS9kZDBNClFzYnVxWnhmQkpCRkRFVUx1RDdX
+            ZHFqYXRqYXM0cWJzcU5EeEtSR1BUVzAKLS0tIDdEY2pnVTJqWlNZVkZldXVYVmFH
+            dVNBRUVodU5sRnpVcG1GZ1RiZzhjTXMKefqBvvD/qZwcSHmFjUnleukVRLueG36Y
+            Q81KlwQweF2F8kHl7Bqsi+3hH1dZZbVm3vjuGpWFOoti7fowUV55Kw==
             -----END AGE ENCRYPTED FILE-----
         - recipient: age1ykcs39e62pz3xu6cedg8ea685kv5d5qsrhgkndygzm8rx30xd5ys5t3qxt
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSakZRUnkraWtId2h3eUhB
-            REpkUHhYMm1MSmtFU2pvd1BpQ0xRTTlCWkZJCkxrTm1sdDBqclJ3RHR6VkllOFpo
-            ZXRtS2lsazRDS2lyRnZmT3FTTjJ6WUUKLS0tIExxNlFoeDhHQ3l5a1VvUHNRWUdw
-            Mms2UEhFSU82UWR5Z1VvU25qenJUQm8KtQeZDIfJIczm1l8ql/WmVEf8KI9dg0vw
-            9rNSjtBkEttVd21zUSOziG4513abllE8NFTkAc1z3HacuXpHTBnd5A==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqZFZxbDhVUWFEUGhPMlZI
+            SFdBYkpxSnAxTUZXbjVwQnlZQ3l1SWtuZGg0CmVBdnVHbTNUcmwvK01iMnZKZTJh
+            ajFla3kzYUl4ZWY3czA0WUdNM2lpVFUKLS0tIHo5Uk1pV296MXdnUTZGQ25haWZG
+            QWZDWGRaRDBhY1ZkZk5oTHY0ZVV2RXMKanv+WWRhf5nl+aw/T6QZFVQQmhV1DZfB
+            jkSzOAKOgPx7toYFmpq9E8fAH+zrMzDbxI2z2uyrOFI6v+QE0Ul/iQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-08-03T17:03:22Z"
-    mac: ENC[AES256_GCM,data:c3rcMHTRxbnpQoW5eLn0X1aCL1v2ft05UTcHaCuGiCaF3b/loVjEQr30pepBgR07PSleTIi375Y0Rj8ik8Ot3j+Zl5BR32bEtqf6gcWwz6oSmeORDrJS15698d7/avJl82/EC0ZN77j+fcdkWZrCJHb47HGfRxKl9L5HbyWasA4=,iv:g3d3C571uYpTTFixYZg+ztg8jTdof1g6Hb5gtRvpRkk=,tag:8kAxrUwUVeWvpYjWMDE+AA==,type:str]
+        - recipient: age1gvplss0ddmyf6vpjy363wu3n057vhm0j6n7tc94cxd8kadapypws5mtaj0
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZcGtMNi9RSG5aTVV5cWdT
+            NittUXN0Qnpld1YvOU50OUh3Z3ZiSzhHOHdNCnc4TmdYbS9QQnBLbldHSytIdkJl
+            R0psQWxkZTgyZTRzckkrTGpyNCsvR2sKLS0tIEdLb05aT2I2S3BKcFRrVmtvTGw5
+            Z1orRCtkTDVXSktuck5pTmV4K05qZHMKZlHHu07q+GnyDDgdwW2Ic3P23PmoSPwn
+            WuNLZdlZQleROaRb+zpD+9P1HGGJ3mWAlNlnmjGrRk453k1PbBQ5Og==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-15T15:06:29Z"
+    mac: ENC[AES256_GCM,data:cF/TJ8VkzrHRUrO5iGdRdlFtqV/5EQ15JwQKIywJvsh0NERK67T21czSP7923MiL0u5QTVPn/rO8R5E/8gBu3r8+fLq+CFl9PDQHEX2JhnYOD5WZR412WMZq3MVR94IMTOrQANMVpS4uhMyvnrqOe4AenxLDyzrYhkwf1KQh4w0=,iv:Qwy8z4uXGMlf+kTMNiE42M9l8LtSJ+O7diknRrsSeYI=,tag:qlCY9r8HnEDmq/jw59C/sg==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.10.2
+    version: 3.12.1

keys/ssh_user_ca.pub

@@ -0,0 +1 @@
+ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNpgz9xYE3K+JeQ7vtDA07iWlp0xTXB+G8MBzX6/RluXs8E6v+ahx90M093EYIOImaW6npWQ0JnFtmZaet5l9Ao=

modules/hosts/janus.nix

@@ -1,21 +1,49 @@
 { inputs, ... }:
 let
+  username = "john";
   hostname = "janus";
-  username ="john";
+  caURL = "https://janus.john-stream.com/";
 in
 {
   flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
-    modules = [
-      inputs.self.modules.nixos.lxc
-      inputs.self.modules.nixos.zsh
+    modules = with inputs.self.modules; [
+      nixos.lxc
+      nixos.sops
+      nixos.step-ssh-host
       inputs.home-manager.nixosModules.home-manager
-      inputs.self.modules.nixos."${username}"
-      # inputs.self.modules.nixos.step-ca
-      inputs.self.modules.nixos.docker
+      nixos."${username}"
+      nixos.zsh
+      nixos.docker
+      nixos.login-text
+      nixos.mtls
       {
+        networking.hostName = hostname;
+        step-ssh-host = {
+          hostname = hostname;
+          caURL = caURL;
+        };
+        mtls = {
+          enable = true;
+          subject = hostname;
+          caURL = caURL;
+          san = [
+            "${hostname}.john-stream.com"
+            "192.168.1.244"
+          ];
+        };
+
         home-manager.users."${username}" = {
+          imports = with inputs.self.modules.homeManager; [
+            sops
+            step-ssh-user
+          ];
+          
           shell.program = "zsh";
           docker.enable = true;
+          # step-ssh-user = {
+          #   enable = true;
+          #   principals = [ "${hostname}" ];
+          # };
           ssh.matchSets = {
             certs = true;
             homelab = true;

modules/hosts/john-pc-ubuntu.nix

@@ -1,75 +1,104 @@
 { inputs, ... }:
 let
-	hostname = "john-pc-ubuntu";
+  username = "john";
+  hostname = "john-pc-ubuntu";
+  testTarget = "fded:fb16:653e:25da:be24:11ff:fea0:753f";
 in
 {
-	flake.modules.homeManager."${hostname}" = { pkgs, config, ... }:
-	let
-		flakeDir = "${config.xdg.configHome}/home-manager/jsl-dendritic";
-	in
-	{
-		imports = with inputs.self.modules.homeManager; [
-			rebuild
-			zsh
-			john
-			desktop
-			docker
-			ssh
-			resticprofile
-			sops
-		];
+  flake.modules.homeManager."${hostname}" = { pkgs, config, ... }:
+  let
+    flakeDir = "${config.xdg.configHome}/home-manager/jsl-dendritic";
+    certDir = "${config.mtls.certDir}";
+    CACert = "${certDir}/root_ca.crt";
+    mtlsBundle = "${certDir}/${config.mtls.bundleFilename}";
+    resticPasswordFile = "${config.xdg.configHome}/restic/password.txt";
+  in
+  {
+    imports = with inputs.self.modules.homeManager; [
+      rebuild
+      john
+      sops
+      step-ssh-user
+      mtls
+      restic
+      docker
+      desktop
+    ];
+    targets.genericLinux.enable = true;
 
-		home.packages = with pkgs; [
-			nixos-rebuild
-			(writeShellScriptBin "test-push" ''
-				nixos-rebuild switch --flake ${flakeDir}#janus --target-host root@fded:fb16:653e:25da:be24:11ff:fea0:753f
-			'')
-		];
-		# TODO: Add host-specific settings here:
-		# - sops secret for `restic_password/john_ubuntu`
-		# - resticprofile profile definition
-		# - zsh RESTIC* session variables
+    shell.program = "zsh";
 
-		# TODO: make this more restrictive, rather than allowing all unfree packages
-		nixpkgs.config.allowUnfree = true;
-		nixpkgs.config.permittedInsecurePackages = [ "openssl-1.1.1w" ];
+    home.username = "${username}";
+    home.homeDirectory = "/home/${username}";
 
-		homeManagerFlakeDir = flakeDir;
-		docker.enable = true;
-		ssh.matchSets = {
-			certs = true;
-			appdaemon = true;
-			homelab = true;
-			dev = true;
-		};
-		shell.program = "zsh";
-		sops.secrets."restic_password/john_ubuntu" = {
-			path = "${config.xdg.configHome}/resticprofile/password.txt";
-		};
-		programs.resticprofile = {
-			enable= true;
-			profiles = {
-				default = {
-					"inherit" = "base";
-					repository = "rest:https://soteria.john-stream.com/john-ubuntu";
-					cacert = "${config.home.homeDirectory}/.step/certs/root_ca.crt";
-					tls-client-cert = "${config.home.homeDirectory}/.step/certs/mtls.pem";
-					backup = {
-						source = [
-							"${config.xdg.userDirs.documents}"
-							"/conf"
-						];
-						schedule = "*-*-* *:15,30,45:00";
-					};
-				};
-			};
-		};
-	};
+    home.packages = with pkgs; [
+      nixos-rebuild
+      (writeShellScriptBin "test-push" ''
+        nixos-rebuild switch --flake ${flakeDir}#soteria --target-host root@${testTarget}
+      '')
+    ];
 
-	flake.homeConfigurations."${hostname}" = inputs.home-manager.lib.homeManagerConfiguration {
-		pkgs = import inputs.nixpkgs { system = "x86_64-linux"; };
-		modules = with inputs.self.modules; [
-			homeManager."${hostname}"
-		];
-	};
+    mtls = {
+      enable = true;
+      caURL = "https://janus.john-stream.com/";
+      provisioner = "admin";
+      subject = hostname;
+      san = [
+        "${hostname}"
+        "192.168.1.85"
+        "spiffe://john-stream.com/ubuntu"
+      ];
+      lifetime = "1h";
+      renew.onCalendar = "*:1/10";
+    };
+
+    # TODO: Add host-specific settings here:
+    # - sops secret for `restic_password/john_ubuntu`
+    # - zsh RESTIC* session variables
+
+    # TODO: make this more restrictive, rather than allowing all unfree packages
+    nixpkgs.config.allowUnfree = true;
+    nixpkgs.config.permittedInsecurePackages = [ "openssl-1.1.1w" ];
+
+    homeManagerFlakeDir = flakeDir;
+    docker.enable = true;
+
+    step-ssh-user = {
+      enable = true;
+      principals = ["root" "${username}" "appdaemon"];
+      provisioner = "admin";
+    };
+    ssh = {
+      certificates.enable = true;
+      matchSets = {
+        certs = true;
+        appdaemon = true;
+        homelab = true;
+        dev = true;
+      };
+    };
+    sops.secrets."restic_password/john_ubuntu" = {
+      path = resticPasswordFile;
+      mode = "0400";
+    };
+    restic = {
+      passwordFile = resticPasswordFile;
+      OnCalendar = "*:0/15";
+      paths = [ "${config.xdg.userDirs.documents}" "/conf" ];
+      exclude = [
+        "/home/*/Pictures"
+        "/home/*/Videos"
+        "/home/*/go"
+        "/home/*/snap"
+        "/home/john/john-nas"
+      ];
+    };
+  };
+
+  flake.homeConfigurations."${hostname}" = inputs.home-manager.lib.homeManagerConfiguration {
+    pkgs = import inputs.nixpkgs { system = "x86_64-linux"; };
+    modules = with inputs.self.modules; [
+      homeManager."${hostname}"
+    ];
+  };
 }

modules/hosts/soteria.nix

@@ -0,0 +1,45 @@
+{ inputs, ... }:
+let
+  username = "john";
+  hostname = "soteria";
+  caURL = "https://janus.john-stream.com/";
+in
+{
+  flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
+    modules = with inputs.self.modules; [
+      nixos.lxc
+      nixos.sops
+      nixos.step-ssh-host
+      inputs.home-manager.nixosModules.home-manager
+      nixos."${username}"
+      nixos.zsh
+      nixos.login-text
+      nixos.mtls
+      nixos.restic-server
+      {
+        networking.hostName = hostname;
+        step-ssh-host = {
+          hostname = hostname;
+          caURL = caURL;
+        };
+        mtls = {
+          enable = true;
+          subject = hostname;
+          caURL = caURL;
+          san = [
+            "${hostname}.john-stream.com"
+            # "192.168.1.244"
+          ];
+        };
+
+        home-manager.users."${username}" = {
+          imports = with inputs.self.modules.homeManager; [
+            sops
+            step-ssh-user
+          ];
+          shell.program = "zsh";
+        };
+      }
+    ];
+  };
+}

modules/hosts/test-nix.nix

@@ -1,36 +1,31 @@
 { inputs, ... }:
 let
-  name = "test-nix";
   username = "john";
+  hostname = "test-nix";
 in
 {
-  flake.modules.nixos."${name}" = { pkgs, lib, ...}: {
-    networking.hostName = "${name}";
-    services.openssh = {
-      enable = true;
-      # require public key authentication for better security
-      settings.PasswordAuthentication = false;
-      settings.KbdInteractiveAuthentication = false;
-    };
-
-    virtualisation.docker = {
-      enable = true;
-    };
-    home-manager.users."${username}" = {
-      docker.enable = true;
-    };
-    users.users.john = {
-      extraGroups = [ "docker" ];
-    };
-  };
-
-  # Generic bootstrapping lxc, use a specific host file for more
-  flake.nixosConfigurations."${name}" = inputs.nixpkgs.lib.nixosSystem {
-    modules = [
-      inputs.self.modules.nixos.lxc
+  flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
+    modules = with inputs.self.modules; [
+      nixos.lxc
+      nixos.sops
+      nixos.step-ssh-host
       inputs.home-manager.nixosModules.home-manager
-      inputs.self.modules.nixos."${name}"
-      inputs.self.modules.nixos.john
+      nixos."${username}"
+      nixos.zsh
+      nixos.docker
+      {
+        home-manager.users."${username}" = {
+          imports = with inputs.self.modules.homeManager; [
+            sops
+          ];
+          shell.program = "zsh";
+          docker.enable = true;
+          ssh.matchSets = {
+            certs = true;
+            homelab = true;
+          };
+        };
+      }
     ];
   };
 }

modules/nix-tools/user.nix

@@ -15,20 +15,27 @@
           "wheel"
         ];
       };
+
+      # Removes password for sudo
+      security.sudo-rs = lib.mkIf isAdmin {
+        enable = true;
+        extraRules = [{
+          users = [ "${username}" ];
+          commands = [{
+            command = "ALL";
+            options = [ "NOPASSWD" ];
+          }];
+        }];
+      };
+
       # https://github.com/Doc-Steve/dendritic-design-with-flake-parts/wiki/Dendritic_Aspects#multi-context-aspect
       home-manager.users."${username}" = {
+        home.username = "${username}";
+        home.homeDirectory = "/home/${username}";
         imports = [
           self.modules.homeManager."${username}"
         ];
       };
     };
-
-    homeManager."${username}" = {
-      home.username = "${username}";
-      home.homeDirectory = "/home/${username}";
-      imports = with self.modules.homeManager; [
-        base
-      ];
-    };
   };
 }

modules/nixos/login-text.nix

@@ -0,0 +1,46 @@
+{ inputs, ... }: {
+  flake.modules.nixos.login-text = { config, ... }: {
+    programs.rust-motd = {
+      enable = true;
+      refreshInterval = "*:0/5";
+      order = [
+        "global"
+        "last_login"
+        "service_status"
+        # "uptime"
+        "memory"
+        "filesystems"
+      ];
+      settings = {
+        global = {
+          time_format = "%Y-%m-%d %H:%M:%S %Z";
+        };
+
+        last_login = {
+          john = 3;
+          root = 3;
+        };
+
+        service_status = {
+          Docker = "docker";
+          SSH = "sshd.socket";
+          "SSH Cert Renewal" = "step-ssh-host-renew.timer";
+          "mTLS Renewal" = "mtls-renew.timer";
+        };
+
+        # This calculation is wrong for LXCs
+        # uptime = {
+        #   prefix = "Uptime";
+        # };
+
+        memory = {
+          swap_pos = "beside";
+        };
+
+        filesystems = {
+          root = "/";
+        };
+      };
+    };
+  };
+}

modules/nixos/lxc.nix

@@ -3,14 +3,13 @@
   flake.modules.nixos.lxc = { pkgs, lib, ...}: {
     imports = with inputs.self.modules.nixos; [
       ({ modulesPath, ... }: { imports = [ "${modulesPath}/virtualisation/proxmox-lxc.nix" ]; })
-      ssh
     ];
     nixpkgs.hostPlatform = lib.mkForce "x86_64-linux";
     system.stateVersion = "25.11";
     nix.settings.experimental-features = [ "nix-command" "flakes" ];
     environment.systemPackages = with pkgs; [ git zsh ];
 
-    security.sudo-rs.enable = true;
+    # security.sudo-rs.enable = true;
     programs.nix-ld.enable = true;
     nix.optimise.automatic = true;
     nix.gc = {
@@ -18,6 +17,7 @@
       dates = "weekly";
       options = "--delete-older-than 30d";
     };
+    programs.bash.enable = true;
   };
 
   # Generic bootstrapping lxc, use a specific host file for more

modules/programs/base.nix

@@ -1,10 +0,0 @@
-{ inputs, pkgs, ... }:
-{
-  flake.modules.homeManager.base = { pkgs, ... }:
-  {
-    imports = with inputs.self.modules.homeManager; [
-      git
-      shell-tools
-    ];
-  };
-}

modules/programs/bash.nix

@@ -1,7 +1,7 @@
 {
-  flake.modules.homeManager.bash = { pkgs, ... }:
+  flake.modules.homeManager.bash = { pkgs, lib, config, ... }:
   {
-    programs.bash = {
+    programs.bash = lib.mkIf (config.shell.program == "bash") {
       enable = true;
       enableCompletion = true;
       package = pkgs.bash;

modules/programs/shell-tools.nix

@@ -10,7 +10,7 @@
 
     imports = with inputs.self.modules.homeManager; [
       bash
-      # zsh
+      zsh
 
       # Tools
       eza
@@ -18,10 +18,8 @@
     ];
 
     config = {
-      programs.bash.enable = lib.mkForce (config.shell.program == "bash");
-      programs.zsh.enable  = lib.mkForce (config.shell.program == "zsh");
       home.shell.enableShellIntegration = true;
-
+      programs.zsh.enable  = lib.mkForce (config.shell.program == "zsh");
       home.packages = with pkgs; [
         wget
         curl
@@ -32,6 +30,7 @@
         btop
         uv
         xclip
+        jq
       ];
     };
   };

modules/programs/sops.nix

@@ -9,7 +9,19 @@ in
     sops-nix.url = "github:Mic92/sops-nix";
     sops-nix.inputs.nixpkgs.follows = "nixpkgs";
   };
-  
+
+  flake.modules.nixos.sops = {
+    imports = with inputs.sops-nix.nixosModules; [
+      sops
+    ];
+
+    sops.defaultSopsFile = ../../keys/secrets.yaml;
+    sops.secrets."test-nix/ssh_host_key" = {
+      owner = "john";
+      path = "/home/john/.ssh/host_key";
+    };
+  };
+
   # Define the homeModules that are used by flake-parts
   # https://flake.parts/options/home-manager.html#opt-flake.modules.homeManager
   flake.modules.homeManager.sops = { inputs, config, pkgs, lib, ... }:
@@ -18,6 +30,7 @@ in
     sopsConfigPath = ../../.sops.yaml;
     sopsSecretsPath = ../../keys/secrets.yaml;
     ageKeyFile = "${config.xdg.configHome}/sops/age/keys.txt";
+    flakeDir = "${config.xdg.configHome}/home-manager/jsl-dendritic";
   in
   {
     home.packages = with pkgs; [
@@ -31,7 +44,7 @@ in
         echo $(show-age-key)
       '')
       (writeShellScriptBin "show-age-key" "${lib.getExe' pkgs.age "age-keygen"} -y ${ageKeyFile}")
-      (writeShellScriptBin "edit-secrets" "${sopsBin} --config ${sopsConfigPath} ${sopsSecretsPath}")
+      (writeShellScriptBin "edit-secrets" "${sopsBin} --config ${sopsConfigPath} ${flakeDir}/keys/secrets.yaml")
       (writeShellScriptBin "ls-secrets" "${lib.getExe pkgs.eza} -alT --follow-symlinks ~/.config/sops-nix/secrets")
     ];
 
@@ -52,13 +65,8 @@ in
       defaultSopsFile = sopsSecretsPath;
       defaultSopsFormat = "yaml";
       age.sshKeyPaths = [ "${config.ssh.IdentityFile}" ];
-      # age.keyFile = "${ageKeyFile}";
-      # age.generateKey = true;
-
-      secrets."api/gmail_client_secret" = {
-        path = "${config.xdg.configHome}/resticprofile/dendrite.txt";
-      };
 
+      secrets."api/gmail_client_secret" = { };
       templates."gmail_creds" = {
         path = "${config.xdg.configHome}/sops-nix/gmail_api_credentials.json";
         content = ''

modules/programs/step-client.nix

@@ -0,0 +1,69 @@
+{ inputs, ... }:
+let
+  caURL = "https://janus.john-stream.com/";
+  stepFingerprint = "2036c44f7b5901566ff7611ea6c927291ecc6d2dd00779c0eead70ec77fa10d6";
+in
+{
+  #
+  # Home Manager Module
+  #
+  flake.modules.homeManager.step-ssh-user = { config, pkgs, lib, ... }:
+  let
+    cfg = config.step-ssh-user;
+    firstPrincipal = lib.head cfg.principals;
+    principalArgs = lib.concatMapStringsSep " "
+      (principal: "--principal \"${principal}\"") cfg.principals;
+  in
+  {
+    options.step-ssh-user = {
+      enable = lib.mkEnableOption "opionated step client config for SSH certs";
+      caURL = lib.mkOption {
+        type = lib.types.str;
+        default = "${caURL}";
+      };
+      fingerprint = lib.mkOption {
+        type = lib.types.str;
+        default = "${stepFingerprint}";
+      };
+      rootCertFile = {
+        path = lib.mkOption {
+          type = lib.types.str;
+          description = "String path to where the root_ca.crt file will be stored for the user";
+          default = ".step/certs/root_ca.crt";
+        };
+        source = lib.mkOption {
+          type = lib.types.path;
+          description = "Nix path to the root cert file within the repo";
+          default = ../../keys/root_ca.crt;
+        };
+      };
+      provisioner = lib.mkOption {
+        type = lib.types.str;
+        default = "admin";
+      };
+      principals = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        # default = [ ];
+      };
+    };
+    config = lib.mkIf cfg.enable {
+      home.file."${cfg.rootCertFile.path}".source = cfg.rootCertFile.source;
+      home.file.".step/config/defaults.json".text = builtins.toJSON {
+        "ca-url" = cfg.caURL;
+        fingerprint = cfg.fingerprint;
+        root = "${config.home.homeDirectory}/${cfg.rootCertFile.path}";
+      };
+      sops.secrets."janus/admin_jwk".mode = "0400";
+      home.packages = with pkgs; [
+        (writeShellScriptBin "sign-ssh-cert" ''
+          ${lib.getExe pkgs.step-cli} ssh certificate \
+          --sign \
+          ${principalArgs} \
+          --provisioner "${cfg.provisioner}" \
+          --provisioner-password-file "${config.sops.secrets."janus/admin_jwk".path}" \
+          "${firstPrincipal}" "${config.ssh.IdentityFile}.pub"
+        '')
+      ];
+    };
+  };
+}

modules/programs/zsh.nix

@@ -7,9 +7,10 @@ in
     nixos.zsh = { pkgs, ... }: {
       users.users."${username}".shell = pkgs.zsh;
       programs.zsh.enable = true;
-      home-manager.sharedModules = [
-        inputs.self.modules.homeManager.zsh
-      ];
+      # Already being imported by the john.nix module
+      # home-manager.sharedModules = [
+      #   inputs.self.modules.homeManager.zsh
+      # ];
     };
 
     homeManager.zsh = { pkgs, config, ... }: {

modules/services/restic/base.yaml

@@ -1,42 +0,0 @@
-base:
-	repository: local:/mnt/backup
-	password-file: '{{ .ConfigDir }}/password.txt'
-	status-file: '{{ .ConfigDir }}/backup-status.json'
-	retention:
-		after-backup: true
-		keep-last: '10'
-		keep-hourly: '8'
-		keep-daily: '14'
-		keep-weekly: '8'
-	backup:
-		verbose: true
-		exclude:
-			- .cache
-			- .devenv
-			- .rustup
-			- .cargo
-			- .venv
-			- .pyenv
-			- .vscode*
-			- data/postgres
-			- build
-			- __pycache__
-			- '*.log'
-			- '*.egg-info'
-			- '*.csv'
-			- '*.m4a'
-			- .local/share/Steam
-			- .local/share/Trash
-			- build
-			- dist
-			- /home/*/Pictures
-			- /home/*/Videos
-			- /home/*/go
-			- /home/*/snap
-			- /home/john/john-nas
-		schedule-permission: user
-		schedule-priority: background
-		check-after: true
-	prune:
-		schedule-permission: user
-		schedule-lock-wait: 1h

modules/services/restic/restic.nix

@@ -0,0 +1,109 @@
+{ inputs, ... }: {
+  flake.modules.nixos.restic-server = { config, pkgs, lib, ... }: {
+    services.restic.server = {
+      enable = true;
+      dataDir = "/mnt/restic";
+      listenAddress = "0.0.0.0:8080";
+      extraFlags = [ "--no-auth" ];
+    };
+  };
+
+  flake.modules.homeManager.restic = { config, pkgs, lib, ... }:
+    let
+      cfg = config.restic;
+    in
+    {
+      options.restic = {
+        repoName = lib.mkOption {
+          description = "Name of the restic repo to use";
+          type = lib.types.str;
+          default = "john-ubuntu";
+        };
+        passwordFile = lib.mkOption {
+          description = "String path to the restic password file";
+          type = lib.types.str;
+        };
+        paths = lib.mkOption {
+          description = "List of string paths to include in the backup";
+          type = lib.types.listOf lib.types.str;
+          default = [ ];
+        };
+        exclude = lib.mkOption {
+          description = "List of string paths to include in the backup. There are already some common ones included by default.";
+          type = lib.types.listOf lib.types.str;
+          default = [ ];
+        };
+        OnCalendar = lib.mkOption {
+          description = "";
+          type = lib.types.str;
+        };
+        RandomizedDelaySec = lib.mkOption {
+          description = "";
+          type = lib.types.str;
+          default = "1m";
+        };
+      };
+
+      config = let
+        resticRepository = "rest:https://soteria.john-stream.com/${cfg.repoName}";
+        caCert = "${config.mtls.certDir}/root_ca.crt";
+        mtlsClientCert = "${config.mtls.certDir}/${config.mtls.bundleFilename}";
+      in
+      {
+        home.sessionVariables = {
+          RESTIC_REPOSITORY = resticRepository;
+          RESTIC_PASSWORD_FILE = cfg.passwordFile;
+          RESTIC_CACERT = caCert;
+          RESTIC_TLS_CLIENT_CERT = mtlsClientCert;
+        };
+        
+        # This is necessary because the restic service in home manager doesn't otherwise expose these options.
+        systemd.user.services."restic-backups-${cfg.repoName}".Service.Environment = [
+          "RESTIC_CACERT=${caCert}"
+          "RESTIC_TLS_CLIENT_CERT=${mtlsClientCert}"
+        ];
+
+        services.restic = {
+          enable = true;
+          backups.${cfg.repoName} = {
+            repository = resticRepository;
+            passwordFile = cfg.passwordFile;
+            paths = cfg.paths;
+            timerConfig = {
+              OnCalendar = cfg.OnCalendar;
+              RandomizedDelaySec = cfg.RandomizedDelaySec;
+              Persistent = true;
+            };
+            runCheck = true;
+            pruneOpts = [
+              "--keep-last 10"
+              "--keep-hourly 8"
+              "--keep-daily 14"
+              "--keep-weekly 8"
+              "--keep-monthly 12"
+            ];
+            exclude = cfg.exclude ++ [
+              ".cache"
+              ".devenv"
+              ".rustup"
+              ".cargo"
+              ".venv"
+              ".pyenv"
+              ".vscode*"
+              "data/postgres"
+              "build"
+              "dist"
+              "__pycache__"
+              "*.log"
+              "*.egg-info"
+              "*.csv"
+              "*.m4a"
+              ".local/share/Steam"
+              ".local/share/Trash"
+            ];
+          };
+        };
+
+      };
+    };
+}

modules/services/restic/resticprofile.nix

@@ -1,86 +0,0 @@
-{ inputs, ... }:
-{
-  perSystem = { pkgs, ... }:
-    let
-      resticprofilePkg = pkgs.buildGoModule rec {
-        pname = "resticprofile";
-        version = "0.32.0";
-        src = pkgs.fetchFromGitHub {
-          owner = "creativeprojects";
-          repo   = "resticprofile";
-          rev    = "v${version}";
-          sha256 = "sha256-fmYsoGYppNgbtoX18aF5UHBG9ieYorBJ9JZkwrR+UBI=";
-        };
-        vendorHash = "sha256-/GVWjOvkYe7xMRjANKIKV6FSU0F5VY1ZP/ppgAJyhvw=";
-        goPackagePath = "github.com/creativeprojects/resticprofile";
-        doCheck = false;
-        meta = with pkgs.lib; {
-          description = "Configuration profiles manager and scheduler for restic backup";
-          homepage    = "https://creativeprojects.github.io/resticprofile/";
-          license     = licenses.gpl3Only;
-          maintainers = [ ];
-          mainProgram = "resticprofile";
-        };
-      };
-    in {
-      packages = {
-        resticprofile = resticprofilePkg;
-        default = resticprofilePkg;
-      };
-    };
-
-  flake.modules.homeManager.resticprofile = { config, lib, pkgs, ... }:
-    let
-      cfg = config.programs.resticprofile;
-      yamlFormat = pkgs.formats.yaml { };
-      baseProfile = import ../../../resticprofile/base.nix;
-      # baseProfile = builtins.fromJSON (builtins.readFile ./base.yaml)
-      profiles = lib.recursiveUpdate baseProfile cfg.profiles;
-    in {
-      options.programs.resticprofile = {
-        enable = lib.mkEnableOption "Enable resticprofile (Restic backup profile manager)";
-        package = lib.mkPackageOption pkgs "resticprofile" { };
-        profiles = lib.mkOption {
-          type = lib.types.attrsOf yamlFormat.type;
-          default = { };
-          description = ''
-            Additional resticprofile configuration merged on top of the base profile.
-            Each attribute becomes a profile entry in
-            `$XDG_CONFIG_HOME/resticprofile/profiles.yaml`.
-          '';
-        };
-      };
-
-      config = lib.mkIf cfg.enable (
-        let
-          resticprofilePackage = lib.mkDefault
-            inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.resticprofile;
-          resticprofileBin = lib.getExe cfg.package;
-          rpScript = pkgs.writeShellScriptBin "rp" ''
-            set -e
-            sudo ${resticprofileBin} --config "${config.xdg.configHome}/resticprofile/profiles.yaml" $@
-          '';
-          rpbackupScript = pkgs.writeShellScriptBin "rp-backup" ''
-            ${lib.getExe rpScript} run-schedule backup@default
-          '';
-        in {
-          programs.resticprofile.package = resticprofilePackage;
-          home.packages = [
-            cfg.package
-            rpScript
-            rpbackupScript
-            (pkgs.writeShellScriptBin "rps" ''
-              set -e
-              ${lib.getExe rpScript} unschedule --all
-              ${lib.getExe rpScript} schedule --all
-            '')
-            (pkgs.writeShellScriptBin "rp-test" "${lib.getExe rpbackupScript} --dry-run")
-          ];
-          xdg.configFile."resticprofile/profiles.yaml".source = yamlFormat.generate "profiles" {
-            version = "2";
-            profiles = profiles;
-          };
-        }
-      );
-    };
-}

modules/services/ssh.nix

@@ -1,19 +1,58 @@
 {inputs, ... }:
 let
   userName = "john";
+  sshHostCAPubKey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNug18oLH0vZxnibXJzMJvTWFPZTnSlhCDDVi+rHhgnIum6ZXQ4SF+VHOOAM5BbzZmMKitNJ5lcrGP15Eur7DzQ=";
 in
 {
-  flake.modules.nixos.ssh = {
-    services.openssh = {
-      enable = true;
-      # require public key authentication for better security
-      settings.PasswordAuthentication = false;
-      settings.KbdInteractiveAuthentication = false;
+  flake.modules.nixos.ssh = { pkgs, config, lib, ... }:
+  let
+    cfg = config.ssh;
+    userCAPath = "ssh/ssh_user_ca.pub";
+    hostKeyFile = "ssh/ssh_host_ed25519_key";
+  in
+  {
+    options.ssh = {
+      certificates = {
+        enable = lib.mkEnableOption "Enable SSH host certificates";
+        userCA = lib.mkOption {
+          type = lib.types.path;
+          default = ../../keys/ssh_user_ca.pub;
+        };
+      };
     };
 
-    home-manager.sharedModules = with inputs.self.modules.homeManager; [
-      ssh
-    ];
+    config = {
+      services.openssh = {
+        enable = true;
+        # require public key authentication for better security
+        settings = lib.mkMerge [
+          {
+            PasswordAuthentication = false;
+            KbdInteractiveAuthentication = false;
+            HostKey = "/etc/${hostKeyFile}";
+          }
+          (lib.mkIf cfg.certificates.enable {
+            TrustedUserCAKeys = "/etc/${userCAPath}";
+            HostCertificate = "/etc/${hostKeyFile}-cert.pub";
+          })
+        ];
+      };
+
+      environment.etc."${userCAPath}" = lib.mkIf cfg.certificates.enable {
+        source = cfg.certificates.userCA;
+      };
+
+      programs.ssh.knownHosts = lib.mkIf cfg.certificates.enable {
+        "192.168.1.*" = { 
+          certAuthority = true;
+          publicKey = sshHostCAPubKey;
+        };
+        "*.john-stream.com" = {
+          certAuthority = true;
+          publicKey = sshHostCAPubKey;
+        };
+      };
+    };
   };
 
   flake.modules.homeManager.ssh = { pkgs, config, lib, ... }:
@@ -26,6 +65,19 @@ in
         description = "Path to the SSH identity file.";
       };
 
+      certificates = {
+        enable = lib.mkEnableOption "Enable SSH user certificates";
+        # sshCertProvisioner = lib.mkOption {
+        #   type = lib.types.str;
+        #   default = "admin";
+        # };
+      };
+
+      knownHostsFile = lib.mkOption {
+        type = lib.types.str;
+        default = "${config.home.homeDirectory}/.ssh/known_hosts";
+      };
+
       matchSets = {
         appdaemon = lib.mkEnableOption "Enable AppDaemon SSH targets";
         certs = lib.mkEnableOption "Enable Janus and Soteria SSH targets";
@@ -36,23 +88,21 @@ in
 
     # All this stuff has to be wrapped in a config attribute because of the presence of the options here?
     config = let
-      identityFile = config.ssh.IdentityFile;
+      cfg = config.ssh;
+      identityFile = cfg.IdentityFile;
       publicKeyFile = "${identityFile}.pub";
       certificateFile = "${identityFile}-cert.pub";
-      userKnownHostsFile = "${config.home.homeDirectory}/.ssh/known_hosts";
+      provisionerPasswordPath = config.sops.secrets."janus/admin_jwk".path;
     in {
-      home.packages = [
-        (pkgs.writeShellScriptBin "sign-ssh-cert" ''
-          echo "Signing ${publicKeyFile}"
-          echo "Copy the Step-CA JWK Provisioner password from 1password"
-          step ssh certificate --sign \
-          --principal root \
-          --principal ${userName} \
-          --principal appdaemon \
-          --provisioner admin \
-          ${userName} ${publicKeyFile}
-        '')
-      ];
+      home.file.".ssh/known_hosts" = {
+        text = lib.concatStringsSep "\n" (
+          [
+            "fded:fb16:653e:25da:be24:11ff:fea0:753f ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ9ZqiWPrCwHjxFCiu0lT4rlQs7KyMapxKJQQ5PJP1eh"
+          ]
+          ++ (lib.optional cfg.certificates.enable "@cert-authority 192.168.1.* ${sshHostCAPubKey}")
+          ++ (lib.optional cfg.certificates.enable "@cert-authority *.john-stream.com ${sshHostCAPubKey}")
+        );
+      };
 
       programs.ssh = {
         enable = true;
@@ -75,13 +125,13 @@ in
               inherit identityFile certificateFile;
 
               hashKnownHosts = false;
-              userKnownHostsFile = "${userKnownHostsFile}";
+              userKnownHostsFile = cfg.knownHostsFile;
 
               addKeysToAgent = "yes";
               forwardAgent = false;
             };
           }
-          (lib.mkIf config.ssh.matchSets.appdaemon {
+          (lib.mkIf cfg.matchSets.appdaemon {
             "appdaemon" = {
               hostname = "192.168.1.242";
               user = "appdaemon";
@@ -91,7 +141,7 @@ in
               user = "appdaemon";
             };
           })
-          (lib.mkIf config.ssh.matchSets.certs {
+          (lib.mkIf cfg.matchSets.certs {
             "janus" = {
               hostname = "janus.john-stream.com";
               user = "root";
@@ -101,7 +151,7 @@ in
               user = "john";
             };
           })
-          (lib.mkIf config.ssh.matchSets.homelab {
+          (lib.mkIf cfg.matchSets.homelab {
             "docs" = {
               hostname = "192.168.1.110";
               user = "root";
@@ -119,7 +169,7 @@ in
               user = "panoptes";
             };
           })
-          (lib.mkIf config.ssh.matchSets.dev {
+          (lib.mkIf cfg.matchSets.dev {
             "test-nix" = {
               hostname = "fded:fb16:653e:25da:be24:11ff:fea0:753f";
               user = "john";

modules/services/step-ca/mtls.nix

@@ -0,0 +1,306 @@
+{ inputs, lib, ... }:
+let
+  # Options that will be in common between
+  opts = {
+    enable = lib.mkEnableOption "Enable mTLS";
+    caURL = lib.mkOption {
+      description = "URL to the certificate authority";
+      type = lib.types.str;
+    };
+    subject = lib.mkOption {
+      description = "The Common Name, DNS Name, or IP address that will be set as the Subject Common Name for the certificate. If no Subject Alternative Names (SANs) are configured (via the --san flag) then the subject will be set as the only SAN.";
+      type = lib.types.str;
+    };
+    keyFilename = lib.mkOption {
+      description = "String filename for the private key";
+      type = lib.types.str;
+      default = "key.pem";
+    };
+    certFilename = lib.mkOption {
+      description = "String filename for the public certificate";
+      type = lib.types.str;
+      default = "cert.pem";
+    };
+    bundleFilename = lib.mkOption {
+      description = "String filename for the mTLS key bundle";
+      type = lib.types.str;
+      default = "mtls.pem";
+    };
+    san = lib.mkOption {
+      description = "List of SAN to give the mTLS cert";
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+    };
+    provisioner = lib.mkOption {
+      type = lib.types.str;
+      default = "admin";
+    };
+    lifetime = lib.mkOption {
+      type = lib.types.str;
+      default = "6h";
+    };
+    renew = {
+      enable = lib.mkOption {
+        description = "Enable automatic mTLS certificate renewal using a systemd timer.";
+        type = lib.types.bool;
+        default = true;
+      };
+      onCalendar = lib.mkOption {
+        description = "systemd OnCalendar schedule for mTLS certificate renewal checks.";
+        type = lib.types.str;
+        default = "*:1/15";
+      };
+      randomizedDelaySec = lib.mkOption {
+        description = "Randomized delay added to renewal timer runs to avoid synchronized renewals.";
+        type = lib.types.str;
+        default = "5m";
+      };
+      user = lib.mkOption {
+        description = "User account to run the mTLS renewal service as.";
+        type = lib.types.str;
+        default = "root";
+      };
+      group = lib.mkOption {
+        description = "Group to run the mTLS renewal service as. Defaults to the configured renewal user when null.";
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+      };
+      reloadUnits = lib.mkOption {
+        description = "systemd units to try-reload-or-restart after a successful certificate renewal.";
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+      };
+      postCommands = lib.mkOption {
+        description = "Shell commands to run after a successful certificate renewal.";
+        type = lib.types.listOf lib.types.lines;
+        default = [ ];
+      };
+    };
+  };
+
+  mkMtlsRenewScript = {
+    pkgs,
+    tlsCert,
+    tlsKey,
+    mtlsBundle,
+    reloadUnits ? [ ],
+    postCommands ? [ ],
+    systemctlArgs ? [ ],
+  }:
+  let
+    renewReloadScript = lib.concatMapStringsSep "\n" (unit: ''
+      if ${lib.getExe' pkgs.systemd "systemctl"} ${lib.escapeShellArgs systemctlArgs} --quiet is-active "${unit}"; then
+        ${lib.getExe' pkgs.systemd "systemctl"} ${lib.escapeShellArgs systemctlArgs} try-reload-or-restart "${unit}"
+      fi
+    '') reloadUnits;
+    renewPostCommands = lib.concatStringsSep "\n" postCommands;
+  in
+    pkgs.writeShellScriptBin "mtls-renew" ''
+      set -euo pipefail
+
+      if ${lib.getExe pkgs.step-cli} certificate needs-renewal "${tlsCert}"; then
+        echo "Renewing mTLS certificate"
+      else
+        echo "Skipping renew"
+        exit "$?"
+      fi
+
+      ${lib.getExe pkgs.step-cli} ca renew --force "${tlsCert}" "${tlsKey}"
+
+      umask 077
+      ${lib.getExe' pkgs.coreutils "cat"} "${tlsCert}" "${tlsKey}" > "${mtlsBundle}"
+
+      ${renewReloadScript}
+      ${renewPostCommands}
+    '';
+
+  mkNixosMtlsRenewService = {
+    pkgs,
+    tlsCert,
+    tlsKey,
+    mtlsBundle,
+    reloadUnits ? [ ],
+    postCommands ? [ ],
+    user ? "root",
+    group ? null,
+  }:
+  let
+    serviceGroup = if group == null then user else group;
+    renewScript = mkMtlsRenewScript {
+      inherit pkgs tlsCert tlsKey mtlsBundle reloadUnits postCommands;
+    };
+  in
+  {
+    description = "Renew the mTLS certificate when Smallstep marks it ready";
+    wantedBy = [ ];
+    after = [ "network-online.target" ];
+    wants = [ "network-online.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      User = user;
+      Group = serviceGroup;
+      ExecStart = lib.getExe renewScript;
+    };
+  };
+
+  mkNixosMtlsRenewTimer = {
+    onCalendar,
+    randomizedDelaySec,
+    unit ? "mtls-renew.service",
+  }: {
+    description = "Periodic Smallstep renewal for the mTLS certificate";
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      Persistent = true;
+      OnCalendar = onCalendar;
+      AccuracySec = "1us";
+      RandomizedDelaySec = randomizedDelaySec;
+      Unit = unit;
+    };
+  };
+
+  mkHomeManagerMtlsRenewService = {
+    pkgs,
+    tlsCert,
+    tlsKey,
+    mtlsBundle,
+    reloadUnits ? [ ],
+    postCommands ? [ ],
+  }:
+  let
+    renewScript = mkMtlsRenewScript {
+      inherit pkgs tlsCert tlsKey mtlsBundle reloadUnits postCommands;
+      systemctlArgs = [ "--user" ];
+    };
+  in
+  {
+    Unit = {
+      Description = "Renew the mTLS certificate when Smallstep marks it ready";
+      After = [ "network-online.target" ];
+      Wants = [ "network-online.target" ];
+    };
+    Service = {
+      Type = "oneshot";
+      ExecStart = lib.getExe renewScript;
+    };
+  };
+
+  mkHomeManagerMtlsRenewTimer = {
+    onCalendar,
+    randomizedDelaySec,
+    unit ? "mtls-renew.service",
+  }: {
+    Unit = {
+      Description = "Periodic Smallstep renewal for the mTLS certificate";
+    };
+    Timer = {
+      Persistent = true;
+      OnCalendar = onCalendar;
+      AccuracySec = "1us";
+      RandomizedDelaySec = randomizedDelaySec;
+      Unit = unit;
+    };
+    Install = {
+      WantedBy = [ "timers.target" ];
+    };
+  };
+
+in
+{
+  flake.modules.nixos.mtls = { config, lib, pkgs, ... }:
+    let
+      cfg = config.mtls;
+      certDir = "/etc/step/certs";
+      tlsKey = "${certDir}/${cfg.keyFilename}";
+      tlsCert = "${certDir}/${cfg.certFilename}";
+      mtlsBundle = "${certDir}/${cfg.bundleFilename}";
+      rootCA = "${certDir}/root_ca.crt";
+      sanArgs = lib.concatMapStringsSep " " (san: "--san \"${san}\"") cfg.san;
+    in
+    {
+      options.mtls = opts;
+      config = lib.mkIf cfg.enable {
+        environment.systemPackages = with pkgs; lib.optionals cfg.enable [
+          (writeShellScriptBin "mtls-generate" ''
+            set -euo pipefail
+            ${lib.getExe pkgs.step-cli} ca certificate \
+              ${cfg.subject} ${tlsCert} ${tlsKey} \
+              --ca-url ${cfg.caURL} \
+              --root ${rootCA} \
+              --provisioner ${cfg.provisioner} \
+              --not-before=-5m --not-after=${cfg.lifetime} \
+              ${sanArgs} \
+              "$@"
+            cat ${tlsCert} ${tlsKey} > ${mtlsBundle}
+          '')
+          (writeShellScriptBin "mtls-check" ''
+            ${lib.getExe pkgs.openssl} x509 \
+            -noout -subject -issuer \
+            -ext subjectAltName,extendedKeyUsage \
+            -enddate -in ${mtlsBundle}
+          '')
+        ];
+
+        systemd.services.mtls-renew = lib.mkIf cfg.renew.enable (mkNixosMtlsRenewService {
+          inherit pkgs tlsCert tlsKey mtlsBundle;
+          inherit (cfg.renew) reloadUnits postCommands user group;
+        });
+
+        systemd.timers.mtls-renew = lib.mkIf cfg.renew.enable (mkNixosMtlsRenewTimer {
+          inherit (cfg.renew) onCalendar randomizedDelaySec;
+        });
+      };
+    };
+
+  flake.modules.homeManager.mtls = { config, lib, pkgs, ... }:
+    let
+      cfg = config.mtls;
+      certDir = cfg.certDir;
+      tlsKey = "${certDir}/${cfg.keyFilename}";
+      tlsCert = "${certDir}/${cfg.certFilename}";
+      mtlsBundle = "${certDir}/${cfg.bundleFilename}";
+      rootCA = "${certDir}/root_ca.crt";
+      sanArgs = lib.concatMapStringsSep " " (san: "--san \"${san}\"") cfg.san;
+    in
+    {
+      options.mtls = opts // {
+        certDir = lib.mkOption {
+          description = "String path to where the mtls certs will be stored.";
+          type = lib.types.str;
+          default ="${config.home.homeDirectory}/.step/certs";
+        };
+      };
+
+      config = {
+        home.packages = with pkgs; lib.optionals cfg.enable [
+          step-cli
+          (writeShellScriptBin "mtls-generate" ''
+            set -euo pipefail
+            ${lib.getExe pkgs.step-cli} ca certificate \
+              ${cfg.subject} ${tlsCert} ${tlsKey} \
+              --not-before=-5m --not-after=${cfg.lifetime} \
+              --provisioner ${cfg.provisioner} \
+              ${sanArgs} \
+              "$@"
+            cat ${tlsCert} ${tlsKey} > ${mtlsBundle}
+          '')
+          (writeShellScriptBin "mtls-check" ''
+            ${lib.getExe pkgs.openssl} x509 \
+            -noout -subject -issuer \
+            -ext subjectAltName,extendedKeyUsage \
+            -enddate -in ${mtlsBundle}
+          '')
+          (mkMtlsRenewScript { inherit pkgs tlsCert tlsKey mtlsBundle; })
+        ];
+
+        systemd.user.services.mtls-renew = lib.mkIf cfg.renew.enable (mkHomeManagerMtlsRenewService {
+          inherit pkgs tlsCert tlsKey mtlsBundle;
+          inherit (cfg.renew) reloadUnits postCommands;
+        });
+
+        systemd.user.timers.mtls-renew = lib.mkIf cfg.renew.enable (mkHomeManagerMtlsRenewTimer {
+          inherit (cfg.renew) onCalendar randomizedDelaySec;
+        });
+      };
+    };
+}

modules/services/step-ca/ssh-host.nix

@@ -0,0 +1,116 @@
+{ inputs, ... }: {
+  flake.modules.nixos.step-ssh-host = { config, pkgs, lib, ... }:
+  let
+    cfg = config.step-ssh-host;
+    rootCertPath = "/etc/step/certs/root_ca.crt";
+    provisionerPasswordPath = config.sops.secrets."janus/admin_jwk".path;
+    sshKeyPath = "/etc/ssh/ssh_host_ed25519_key";
+    sshCertPath = "${sshKeyPath}-cert.pub";
+  in
+  {
+    # NixOS Options
+    options.step-ssh-host = {
+      hostname = lib.mkOption {
+        description = "Networking host name";
+        type = lib.types.str;
+      };
+      caURL = lib.mkOption {
+        description = "URL for the certificate authority";
+        type = lib.types.str;
+      };
+      rootCertFile = {
+        path = lib.mkOption {
+          description = "String path to where the root_ca.crt file will be stored for the user";
+          type = lib.types.str;
+          default = "step/certs/root_ca.crt";
+        };
+        source = lib.mkOption {
+          description = "Nix path to the root cert file within the repo";
+          type = lib.types.path;
+          default = ../../../keys/root_ca.crt;
+        };
+      };
+      provisioner = lib.mkOption {
+        description = "Provisioner inside Step CA to use for the SSH certificates";
+        type = lib.types.str;
+        default = "admin";
+      };
+    };
+
+    imports = with inputs.self.modules.nixos; [ ssh ];
+    # NixOS Config
+    config = {
+      ssh.certificates.enable = true;
+      sops.secrets."janus/admin_jwk" = {
+        owner = "root";
+        group = "root";
+        mode = "0400";
+      };
+      networking.nameservers = [ "192.168.1.150" ];
+      networking.dhcpcd.extraConfig = "nohook resolv.conf";
+
+      environment.etc."${cfg.rootCertFile.path}".source = cfg.rootCertFile.source;
+      environment.systemPackages = with pkgs; [
+        step-cli
+        (writeShellScriptBin "ssh-host-cert-renew" ''
+          ${lib.getExe pkgs.step-cli} ssh certificate \
+          --host --sign \
+          --root "${rootCertPath}" \
+          --ca-url ${cfg.caURL} \
+          --provisioner "${cfg.provisioner}" \
+          --provisioner-password-file "${provisionerPasswordPath}" \
+          --principal "${cfg.hostname}" \
+          --principal "${cfg.hostname}.john-stream.com" \
+          "${cfg.hostname}" "${sshKeyPath}.pub"
+        '')
+        (writeShellScriptBin "ssh-host-cert-check" "${lib.getExe' pkgs.openssh "ssh-keygen"} -Lf ${sshCertPath}")
+      ];
+
+      systemd.services.step-ssh-host-renew = {
+        description = "Renew Step SSH host certificate if needed";
+        wantedBy = [ ];
+        after = [ "network-online.target" ];
+        wants = [ "network-online.target" ];
+        path = [ pkgs.step-cli pkgs.openssh pkgs.coreutils pkgs.systemd ];
+        serviceConfig = {
+          Type = "oneshot";
+          User = "root";
+          Group = "root";
+        };
+        script = ''
+          set -euo pipefail
+          if ${lib.getExe pkgs.step-cli} ssh needs-renewal "${sshCertPath}" --expires-in "4h"; then
+            echo "Renewing SSH host certificate"
+          else
+            rc=$?
+            if [ "$rc" -eq 1 ]; then
+              echo "SSH host cert does not need renewal"
+              exit 0
+            fi
+
+            if [ "$rc" -eq 2 ]; then
+              echo "SSH host cert missing: ${sshCertPath}" >&2
+              exit 1
+            fi
+
+            echo "step ssh needs-renewal failed with rc=$rc" >&2
+            exit "$rc"
+          fi
+        '';
+      };
+
+      systemd.timers.step-ssh-host-renew = {
+        description = "Periodic Step SSH host certificate renewal";
+        wantedBy = [ "timers.target" ];
+
+        timerConfig = {
+          OnBootSec = "5m";
+          OnUnitActiveSec = "4h";
+          RandomizedDelaySec = "15m";
+          Persistent = true;
+          Unit = "step-ssh-host-renew.service";
+        };
+      };
+    };
+  };
+}

modules/users/john.nix

@@ -1,4 +1,4 @@
-{ inputs, lib, ... }:
+{ inputs, ... }:
 let
   username = "john";
 in
@@ -12,39 +12,35 @@ in
       keygrip = [
       ];
       authorizedKeys = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIAUa4dcg1TWc4pW++uodyhX4eOqrX/QYIxFWtEP7HFJ john@john-pc-ubuntu"
+        # "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIAUa4dcg1TWc4pW++uodyhX4eOqrX/QYIxFWtEP7HFJ john@john-pc-ubuntu"
         "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMOkGLo4N/L3RYvaIZ1FmePlxa1HK0fMciZxKtRhN58F root@janus"
       ];
     };
 
-    modules = lib.mkMerge [
-      (inputs.self.factory.user username true)
-      {
-        #
-        # NixOS
-        #
-        nixos."${username}" = { pkgs, ... }: {
-          users.users."${username}" = {
-            openssh.authorizedKeys.keys = inputs.self.meta.users."${username}".authorizedKeys;
-            extraGroups = [ "docker" ];
-          };
+    modules = {
+      nixos."${username}" = {
+        imports = [
+          (inputs.self.factory.user username true).nixos."${username}"
+        ];
+        users.users."${username}" = {
+          openssh.authorizedKeys.keys = inputs.self.meta.users."${username}".authorizedKeys;
+          extraGroups = [ "docker" ];
         };
+      };
 
-        #
-        # Home Manager
-        #
-        homeManager."${username}" = with inputs.self.meta.users."${username}"; {
-          home.stateVersion = "25.11";
-          xdg.enable = true;
+      homeManager."${username}" = with inputs.self.meta.users."${username}"; {
+        home.stateVersion = "25.11";
+        xdg.enable = true;
 
-          programs.git.settings.user.name = name;
-          programs.git.settings.user.email = email;
+        programs.git.settings.user.name = name;
+        programs.git.settings.user.email = email;
 
-          imports = with inputs.self.modules.homeManager; [
-            # base
-          ];
-        };
-      }
-    ];
+        imports = with inputs.self.modules.homeManager; [
+          ssh
+          shell-tools
+          git
+        ];
+      };
+    };
   };
 }