broke out the password file

flake.lock

@@ -2,11 +2,11 @@
   "nodes": {
     "flake-file": {
       "locked": {
-        "lastModified": 1772999280,
+        "lastModified": 1773554778,
-        "narHash": "sha256-XX60YlqSKa/QNIJVnLeEXNDQPwrQucMuITef6rEJqIs=",
+        "narHash": "sha256-keH0VNsci9e0Uwt3Msp/N+pltaP8Lb6lt09Q3WvDPw4=",
         "owner": "vic",
         "repo": "flake-file",
-        "rev": "e2a19eb539fa7be4537f6e73e7556edf031eed7f",
+        "rev": "f4780a86bd4c756475d839b286f8a40aabdbc802",
         "type": "github"
       },
       "original": {
@@ -76,11 +76,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1772985285,
+        "lastModified": 1773608492,
-        "narHash": "sha256-wEEmvfqJcl9J0wyMgMrj1TixOgInBW/6tLPhWGoZE3s=",
+        "narHash": "sha256-QZteyExJYSQzgxqdsesDPbQgjctGG7iKV/6ooyQPITk=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "5be5d8245cbc7bc0c09fbb5f38f23f223c543f85",
+        "rev": "9a40ec3b78fc688d0908485887d355caa5666d18",
         "type": "github"
       },
       "original": {
@@ -91,11 +91,11 @@
     },
     "import-tree": {
       "locked": {
-        "lastModified": 1772999353,
+        "lastModified": 1773554199,
-        "narHash": "sha256-dPb0WxUhFaz6wuR3B6ysqFJpsu8txKDPZvS47AT2XLI=",
+        "narHash": "sha256-6apV5N1F5tTD8JY9AUGnkWmy56HqDPn4MNFRsq4Rg+s=",
         "owner": "vic",
         "repo": "import-tree",
-        "rev": "545a4df146fce44d155573e47f5a777985acf912",
+        "rev": "c6ebc59c85ee54cfb68163d06d1a3149ce0fe431",
         "type": "github"
       },
       "original": {
@@ -127,11 +127,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1772773019,
+        "lastModified": 1773389992,
-        "narHash": "sha256-E1bxHxNKfDoQUuvriG71+f+s/NT0qWkImXsYZNFFfCs=",
+        "narHash": "sha256-wvfdLLWJ2I9oEpDd9PfMA8osfIZicoQ5MT1jIwNs9Tk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "aca4d95fce4914b3892661bcb80b8087293536c6",
+        "rev": "c06b4ae3d6599a672a6210b7021d699c351eebda",
         "type": "github"
       },
       "original": {
@@ -143,11 +143,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1772771118,
+        "lastModified": 1773507054,
-        "narHash": "sha256-SDEGkbscgwFhxzfvNdDNcvsA82gAQcyOh0/BZOb6fWg=",
+        "narHash": "sha256-yzDBkI1CpeZrAt4l1nGvTOs3OFtXCS7a7Gi5Y1h878w=",
-        "rev": "e38213b91d3786389a446dfce4ff5a8aaf6012f2",
+        "rev": "e80236013dc8b77aa49ca90e7a12d86f5d8d64c9",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre958959.e38213b91d37/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre963414.e80236013dc8/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
@@ -190,11 +190,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772944399,
+        "lastModified": 1773550941,
-        "narHash": "sha256-xTzsSd3r5HBeufSZ3fszAn0ldfKctvsYG7tT2YJg5gY=",
+        "narHash": "sha256-wa/++bL2QeMUreNFBZEWluQfOYB0MnQIeGNMuaX9sfs=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "c8e69670b316d6788e435a3aa0bda74eb1b82cc0",
+        "rev": "c469b6885f0dcd5c7c56bd935a0f08dbcd9e79e1",
         "type": "github"
       },
       "original": {

modules/hosts/janus.nix

@@ -2,6 +2,7 @@
 let
   username = "john";
   hostname = "janus";
+  caURL = "https://janus.john-stream.com/";
 in
 {
   flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
@@ -14,9 +15,22 @@ in
       nixos.zsh
       nixos.docker
       nixos.login-text
+      nixos.mtls
       {
         networking.hostName = hostname;
-        step-ssh-host.hostname = hostname;
+        step-ssh-host = {
+          hostname = hostname;
+          caURL = caURL;
+        };
+        mtls = {
+          enable = true;
+          subject = hostname;
+          caURL = caURL;
+          san = [
+            "${hostname}.john-stream.com"
+            "192.168.1.244"
+          ];
+        };
 
         home-manager.users."${username}" = {
           imports = with inputs.self.modules.homeManager; [
@@ -26,10 +40,10 @@ in
           
           shell.program = "zsh";
           docker.enable = true;
-          step-ssh-user = {
+          # step-ssh-user = {
-            enable = true;
+          #   enable = true;
-            principals = [ "${hostname}" ];
+          #   principals = [ "${hostname}" ];
-          };
+          # };
           ssh.matchSets = {
             certs = true;
             homelab = true;

modules/hosts/john-pc-ubuntu.nix

@@ -8,21 +8,21 @@ in
   flake.modules.homeManager."${hostname}" = { pkgs, config, ... }:
   let
     flakeDir = "${config.xdg.configHome}/home-manager/jsl-dendritic";
-    certDir = "${config.home.homeDirectory}/.step/certs";
+    certDir = "${config.mtls.certDir}";
     CACert = "${certDir}/root_ca.crt";
-    tlsKey = "${certDir}/key.pem";
+    mtlsBundle = "${certDir}/${config.mtls.bundleFilename}";
-    tlsCert = "${certDir}/cert.pem";
+    resticPasswordFile = "${config.xdg.configHome}/restic/password.txt";
-    mtlsCert = "${certDir}/mtls.pem";
   in
   {
     imports = with inputs.self.modules.homeManager; [
       rebuild
       john
-      resticprofile
       sops
+      step-ssh-user
+      mtls
+      restic
       docker
       desktop
-      step-ssh-user
     ];
     targets.genericLinux.enable = true;
 
@@ -34,26 +34,26 @@ in
     home.packages = with pkgs; [
       nixos-rebuild
       (writeShellScriptBin "test-push" ''
-        nixos-rebuild switch --flake ${flakeDir}#janus --target-host root@${testTarget}
+        nixos-rebuild switch --flake ${flakeDir}#soteria --target-host root@${testTarget}
-      '')
-      (writeShellScriptBin "mtls-generate" ''
-        ${lib.getExe pkgs.step-cli} ca certificate \
-          john-pc-ubuntu ${tlsCert} ${tlsKey} \
-          --provisioner admin \
-          --san 192.168.1.85 \
-          --san spiffe://john-stream.com/ubuntu
-        cat ${tlsCert} ${tlsKey} > ${mtlsCert}
-      '')
-      (writeShellScriptBin "mtls-check" ''
-        ${lib.getExe pkgs.openssl} x509 \
-        -noout -subject -issuer \
-        -ext subjectAltName,extendedKeyUsage \
-        -enddate -in ${mtlsCert}
       '')
     ];
+
+    mtls = {
+      enable = true;
+      caURL = "https://janus.john-stream.com/";
+      provisioner = "admin";
+      subject = hostname;
+      san = [
+        "${hostname}"
+        "192.168.1.85"
+        "spiffe://john-stream.com/ubuntu"
+      ];
+      lifetime = "1h";
+      renew.onCalendar = "*:1/10";
+    };
+
     # TODO: Add host-specific settings here:
     # - sops secret for `restic_password/john_ubuntu`
-    # - resticprofile profile definition
     # - zsh RESTIC* session variables
 
     # TODO: make this more restrictive, rather than allowing all unfree packages
@@ -78,25 +78,19 @@ in
       };
     };
     sops.secrets."restic_password/john_ubuntu" = {
-      path = "${config.xdg.configHome}/resticprofile/password.txt";
+      path = resticPasswordFile;
+      mode = "0400";
     };
-    programs.resticprofile = {
+    restic = {
-      enable= true;
+      passwordFile = resticPasswordFile;
-      profiles = {
+      paths = [ "${config.xdg.userDirs.documents}" "/conf" ];
-        default = {
+      exclude = [
-          "inherit" = "base";
+        "/home/*/Pictures"
-          repository = "rest:https://soteria.john-stream.com/john-ubuntu";
+        "/home/*/Videos"
-          cacert = "${CACert}";
+        "/home/*/go"
-          tls-client-cert = "${mtlsCert}";
+        "/home/*/snap"
-          backup = {
+        "/home/john/john-nas"
-            source = [
-              "${config.xdg.userDirs.documents}"
-              "/conf"
       ];
-            schedule = "*-*-* *:15,30,45:00";
-          };
-        };
-      };
     };
   };
 

modules/hosts/soteria.nix

@@ -0,0 +1,45 @@
+{ inputs, ... }:
+let
+  username = "john";
+  hostname = "soteria";
+  caURL = "https://janus.john-stream.com/";
+in
+{
+  flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
+    modules = with inputs.self.modules; [
+      nixos.lxc
+      nixos.sops
+      nixos.step-ssh-host
+      inputs.home-manager.nixosModules.home-manager
+      nixos."${username}"
+      nixos.zsh
+      nixos.login-text
+      nixos.mtls
+      nixos.restic-server
+      {
+        networking.hostName = hostname;
+        step-ssh-host = {
+          hostname = hostname;
+          caURL = caURL;
+        };
+        mtls = {
+          enable = true;
+          subject = hostname;
+          caURL = caURL;
+          san = [
+            "${hostname}.john-stream.com"
+            # "192.168.1.244"
+          ];
+        };
+
+        home-manager.users."${username}" = {
+          imports = with inputs.self.modules.homeManager; [
+            sops
+            step-ssh-user
+          ];
+          shell.program = "zsh";
+        };
+      }
+    ];
+  };
+}

modules/nixos/login-text.nix

@@ -7,7 +7,7 @@
         "global"
         "last_login"
         "service_status"
-        "uptime"
+        # "uptime"
         "memory"
         "filesystems"
       ];
@@ -17,19 +17,21 @@
         };
 
         last_login = {
-          john = 5;
+          john = 3;
           root = 3;
         };
 
         service_status = {
-          SSH = "sshd.socket";
-          "SSH Certs" = "step-ssh-host-renew.timer";
           Docker = "docker";
+          SSH = "sshd.socket";
+          "SSH Cert Renewal" = "step-ssh-host-renew.timer";
+          "mTLS Renewal" = "mtls-renew.timer";
         };
 
-        uptime = {
+        # This calculation is wrong for LXCs
-          prefix = "Uptime";
+        # uptime = {
-        };
+        #   prefix = "Uptime";
+        # };
 
         memory = {
           swap_pos = "beside";
@@ -37,7 +39,6 @@
 
         filesystems = {
           root = "/";
-          nix = "/nix/store";
         };
       };
     };

modules/programs/step-client.nix

@@ -4,116 +4,6 @@ let
   stepFingerprint = "2036c44f7b5901566ff7611ea6c927291ecc6d2dd00779c0eead70ec77fa10d6";
 in
 {
-  #
-  # NixOS Module
-  #
-  flake.modules.nixos.step-ssh-host = { config, pkgs, lib, ... }:
-  let
-    cfg = config.step-ssh-host;
-    stepBin = lib.getExe pkgs.step-cli;
-    rootCertPath = "/etc/step/certs/root_ca.crt";
-    provisionerPasswordPath = config.sops.secrets."janus/admin_jwk".path;
-    sshKeyPath = "/etc/ssh/ssh_host_ed25519_key";
-    sshCertPath = "${sshKeyPath}-cert.pub";
-  in
-  {
-    # NixOS Options
-    options.step-ssh-host = {
-      hostname = lib.mkOption {
-        type = lib.types.str;
-      };
-      caURL = lib.mkOption {
-        type = lib.types.str;
-        default = "${caURL}";
-      };
-      rootCertFile = lib.mkOption {
-        type = lib.types.path;
-        description = "Public Step root CA certificate file from the repo.";
-        default = ../../keys/root_ca.crt;
-      };
-      sshHostProvisioner = lib.mkOption {
-        type = lib.types.str;
-        default = "admin";
-      };
-    };
-
-    imports = with inputs.self.modules.nixos; [ ssh ];
-    # NixOS Config
-    config = {
-      ssh.certificates.enable = true;
-      sops.secrets."janus/admin_jwk" = {
-        owner = "root";
-        group = "root";
-        mode = "0400";
-      };
-      networking.nameservers = [ "192.168.1.150" ];
-      networking.dhcpcd.extraConfig = "nohook resolv.conf";
-
-      environment.etc."step/certs/root_ca.crt".source = cfg.rootCertFile;
-      environment.systemPackages = with pkgs; [
-        step-cli
-        (writeShellScriptBin "ssh-host-cert-renew" ''
-          ${lib.getExe pkgs.step-cli} ssh certificate \
-          --host --sign \
-          --root "${rootCertPath}" \
-          --ca-url ${cfg.caURL} \
-          --provisioner "${cfg.sshHostProvisioner}" \
-          --provisioner-password-file "${provisionerPasswordPath}" \
-          --principal "${cfg.hostname}" \
-          --principal "${cfg.hostname}.john-stream.com" \
-          "${cfg.hostname}" "${sshKeyPath}.pub"
-        '')
-        (writeShellScriptBin "ssh-host-cert-check" "${lib.getExe' pkgs.openssh "ssh-keygen"} -Lf ${sshCertPath}")
-      ];
-
-      systemd.services.step-ssh-host-renew = {
-        description = "Renew Step SSH host certificate if needed";
-        wantedBy = [ ];
-        after = [ "network-online.target" ];
-        wants = [ "network-online.target" ];
-        path = [ pkgs.step-cli pkgs.openssh pkgs.coreutils pkgs.systemd ];
-        serviceConfig = {
-          Type = "oneshot";
-          User = "root";
-          Group = "root";
-        };
-        script = ''
-          set -euo pipefail
-          if ${stepBin} ssh needs-renewal "${sshCertPath}" --expires-in "4h"; then
-            echo "Renewing SSH host certificate"
-          else
-            rc=$?
-            if [ "$rc" -eq 1 ]; then
-              echo "SSH host cert does not need renewal"
-              exit 0
-            fi
-
-            if [ "$rc" -eq 2 ]; then
-              echo "SSH host cert missing: ${sshCertPath}" >&2
-              exit 1
-            fi
-
-            echo "step ssh needs-renewal failed with rc=$rc" >&2
-            exit "$rc"
-          fi
-        '';
-      };
-
-      systemd.timers.step-ssh-host-renew = {
-        description = "Periodic Step SSH host certificate renewal";
-        wantedBy = [ "timers.target" ];
-
-        timerConfig = {
-          OnBootSec = "5m";
-          OnUnitActiveSec = "4h";
-          RandomizedDelaySec = "15m";
-          Persistent = true;
-          Unit = "step-ssh-host-renew.service";
-        };
-      };
-    };
-  };
-
   #
   # Home Manager Module
   #
@@ -139,7 +29,7 @@ in
         path = lib.mkOption {
           type = lib.types.str;
           description = "String path to where the root_ca.crt file will be stored for the user";
-          default = "${config.home.homeDirectory}/.step/certs/root_ca.crt";
+          default = ".step/certs/root_ca.crt";
         };
         source = lib.mkOption {
           type = lib.types.path;
@@ -157,11 +47,11 @@ in
       };
     };
     config = lib.mkIf cfg.enable {
-      home.file.".step/certs/root_ca.crt".source = cfg.rootCertFile.source;
+      home.file."${cfg.rootCertFile.path}".source = cfg.rootCertFile.source;
       home.file.".step/config/defaults.json".text = builtins.toJSON {
         "ca-url" = cfg.caURL;
         fingerprint = cfg.fingerprint;
-        root = "${cfg.rootCertFile.path}";
+        root = "${config.home.homeDirectory}/${cfg.rootCertFile.path}";
       };
       sops.secrets."janus/admin_jwk".mode = "0400";
       home.packages = with pkgs; [

modules/services/restic/base-profile.yaml

@@ -1,43 +0,0 @@
-base:
-  repository: local:/mnt/backup
-  password-file: '{{ .ConfigDir }}/password.txt'
-  status-file: '{{ .ConfigDir }}/backup-status.json'
-  retention:
-    after-backup: true
-    keep-last: '10'
-    keep-hourly: '8'
-    keep-daily: '14'
-    keep-weekly: '8'
-    keep-monthyl: '6'
-  backup:
-    verbose: true
-    exclude:
-      - .cache
-      - .devenv
-      - .rustup
-      - .cargo
-      - .venv
-      - .pyenv
-      - .vscode*
-      - data/postgres
-      - build
-      - __pycache__
-      - '*.log'
-      - '*.egg-info'
-      - '*.csv'
-      - '*.m4a'
-      - .local/share/Steam
-      - .local/share/Trash
-      - build
-      - dist
-      - /home/*/Pictures
-      - /home/*/Videos
-      - /home/*/go
-      - /home/*/snap
-      - /home/john/john-nas
-    schedule-permission: user
-    schedule-priority: background
-    check-after: true
-  prune:
-    schedule-permission: user
-    schedule-lock-wait: 1h

modules/services/restic/restic.nix

@@ -0,0 +1,100 @@
+{ inputs, ... }: {
+  flake.modules.nixos.restic-server = { config, pkgs, lib, ... }: {
+    services.restic.server = {
+      enable = true;
+      dataDir = "/mnt/restic";
+      listenAddress = "0.0.0.0:8080";
+      extraFlags = [ "--no-auth" ];
+    };
+  };
+
+  flake.modules.homeManager.restic = { config, pkgs, lib, ... }:
+    let
+      cfg = config.restic;
+    in
+    {
+      options.restic = {
+        repoName = lib.mkOption {
+          description = "Name of the restic repo to use";
+          type = lib.types.str;
+          default = "john-ubuntu";
+        };
+        passwordFile = lib.mkOption {
+          description = "String path to the restic password file";
+          type = lib.types.str;
+        };
+        paths = lib.mkOption {
+          description = "List of string paths to include in the backup";
+          type = lib.types.listOf lib.types.str;
+          default = [ ];
+        };
+        exclude = lib.mkOption {
+          description = "List of string paths to include in the backup. There are already some common ones included by default.";
+          type = lib.types.listOf lib.types.str;
+          default = [ ];
+        };
+      };
+
+      config = let
+        resticRepository = "rest:https://soteria.john-stream.com/${cfg.repoName}";
+        caCert = "${config.mtls.certDir}/root_ca.crt";
+        mtlsClientCert = "${config.mtls.certDir}/${config.mtls.bundleFilename}";
+      in
+      {
+        home.sessionVariables = {
+          RESTIC_REPOSITORY = resticRepository;
+          RESTIC_PASSWORD_FILE = cfg.passwordFile;
+          RESTIC_CACERT = caCert;
+          RESTIC_TLS_CLIENT_CERT = mtlsClientCert;
+        };
+        
+        # This is necessary because the restic service in home manager doesn't otherwise expose these options.
+        systemd.user.services."restic-backups-${cfg.repoName}".Service.Environment = [
+          "RESTIC_CACERT=${caCert}"
+          "RESTIC_TLS_CLIENT_CERT=${mtlsClientCert}"
+        ];
+
+        services.restic = {
+          enable = true;
+          backups.${cfg.repoName} = {
+            repository = resticRepository;
+            passwordFile = cfg.passwordFile;
+            paths = cfg.paths;
+            timerConfig = {
+              OnCalendar = "00:05";
+              Persistent = true;
+              RandomizedDelaySec = "5h";
+            };
+            runCheck = true;
+            pruneOpts = [
+              "--keep-last 10"
+              "--keep-hourly 8"
+              "--keep-daily 14"
+              "--keep-weekly 8"
+              "--keep-monthly 12"
+            ];
+            exclude = cfg.exclude ++ [
+              ".cache"
+              ".devenv"
+              ".rustup"
+              ".cargo"
+              ".venv"
+              ".pyenv"
+              ".vscode*"
+              "data/postgres"
+              "build"
+              "dist"
+              "__pycache__"
+              "*.log"
+              "*.egg-info"
+              "*.csv"
+              "*.m4a"
+              ".local/share/Steam"
+              ".local/share/Trash"
+            ];
+          };
+        };
+
+      };
+    };
+}

modules/services/restic/resticprofile.nix

@@ -1,99 +0,0 @@
-{ inputs, ... }:
-{
-  perSystem = { pkgs, ... }:
-    let
-      resticprofilePkg = pkgs.buildGoModule rec {
-        pname = "resticprofile";
-        version = "0.32.0";
-        src = pkgs.fetchFromGitHub {
-          owner = "creativeprojects";
-          repo   = "resticprofile";
-          rev    = "v${version}";
-          sha256 = "sha256-fmYsoGYppNgbtoX18aF5UHBG9ieYorBJ9JZkwrR+UBI=";
-        };
-        vendorHash = "sha256-/GVWjOvkYe7xMRjANKIKV6FSU0F5VY1ZP/ppgAJyhvw=";
-        goPackagePath = "github.com/creativeprojects/resticprofile";
-        doCheck = false;
-        meta = with pkgs.lib; {
-          description = "Configuration profiles manager and scheduler for restic backup";
-          homepage    = "https://creativeprojects.github.io/resticprofile/";
-          license     = licenses.gpl3Only;
-          maintainers = [ ];
-          mainProgram = "resticprofile";
-        };
-      };
-    in {
-      packages = {
-        resticprofile = resticprofilePkg;
-        default = resticprofilePkg;
-      };
-    };
-
-  flake.lib.fromYAML = pkgs: path:
-    builtins.fromJSON (
-      builtins.readFile (
-        pkgs.runCommand "${builtins.baseNameOf path}.json"
-          {
-            nativeBuildInputs = [ pkgs.remarshal ];
-          }
-          ''
-            remarshal -if yaml -of json ${path} > "$out"
-          ''
-      )
-    );
-
-  flake.modules.homeManager.resticprofile = { config, lib, pkgs, ... }:
-    let
-      cfg = config.programs.resticprofile;
-      yamlFormat = pkgs.formats.yaml { };
-      # baseProfile = import ../../../resticprofile/base.nix;
-      baseProfile = inputs.self.lib.fromYAML pkgs ./base-profile.yaml;
-      profiles = lib.recursiveUpdate baseProfile cfg.profiles;
-    in {
-      options.programs.resticprofile = {
-        enable = lib.mkEnableOption "Enable resticprofile (Restic backup profile manager)";
-        package = lib.mkPackageOption pkgs "resticprofile" { };
-        profiles = lib.mkOption {
-          type = lib.types.attrsOf yamlFormat.type;
-          default = { };
-          description = ''
-            Additional resticprofile configuration merged on top of the base profile.
-            Each attribute becomes a profile entry in
-            `$XDG_CONFIG_HOME/resticprofile/profiles.yaml`.
-          '';
-        };
-      };
-
-      config = lib.mkIf cfg.enable (
-        let
-          resticprofilePackage = lib.mkDefault
-            inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.resticprofile;
-          resticprofileBin = lib.getExe cfg.package;
-          rpScript = pkgs.writeShellScriptBin "rp" ''
-            set -e
-            sudo ${resticprofileBin} --config "${config.xdg.configHome}/resticprofile/profiles.yaml" $@
-          '';
-          rpbackupScript = pkgs.writeShellScriptBin "rp-backup" ''
-            ${lib.getExe rpScript} run-schedule backup@default "$@"
-          '';
-        in {
-          programs.resticprofile.package = resticprofilePackage;
-          home.packages = [
-            cfg.package
-            rpScript
-            rpbackupScript
-            (pkgs.writeShellScriptBin "rps" ''
-              set -e
-              ${lib.getExe rpScript} unschedule --all
-              ${lib.getExe rpScript} schedule --all
-            '')
-            (pkgs.writeShellScriptBin "rp-test" "${lib.getExe rpbackupScript} --dry-run")
-          ];
-          xdg.configFile."resticprofile/profiles.yaml".source = yamlFormat.generate "profiles" {
-            version = "2";
-            profiles = profiles;
-          };
-        }
-      );
-    };
-}

modules/services/step-ca/mtls.nix

@@ -0,0 +1,306 @@
+{ inputs, lib, ... }:
+let
+  # Options that will be in common between
+  opts = {
+    enable = lib.mkEnableOption "Enable mTLS";
+    caURL = lib.mkOption {
+      description = "URL to the certificate authority";
+      type = lib.types.str;
+    };
+    subject = lib.mkOption {
+      description = "The Common Name, DNS Name, or IP address that will be set as the Subject Common Name for the certificate. If no Subject Alternative Names (SANs) are configured (via the --san flag) then the subject will be set as the only SAN.";
+      type = lib.types.str;
+    };
+    keyFilename = lib.mkOption {
+      description = "String filename for the private key";
+      type = lib.types.str;
+      default = "key.pem";
+    };
+    certFilename = lib.mkOption {
+      description = "String filename for the public certificate";
+      type = lib.types.str;
+      default = "cert.pem";
+    };
+    bundleFilename = lib.mkOption {
+      description = "String filename for the mTLS key bundle";
+      type = lib.types.str;
+      default = "mtls.pem";
+    };
+    san = lib.mkOption {
+      description = "List of SAN to give the mTLS cert";
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+    };
+    provisioner = lib.mkOption {
+      type = lib.types.str;
+      default = "admin";
+    };
+    lifetime = lib.mkOption {
+      type = lib.types.str;
+      default = "6h";
+    };
+    renew = {
+      enable = lib.mkOption {
+        description = "Enable automatic mTLS certificate renewal using a systemd timer.";
+        type = lib.types.bool;
+        default = true;
+      };
+      onCalendar = lib.mkOption {
+        description = "systemd OnCalendar schedule for mTLS certificate renewal checks.";
+        type = lib.types.str;
+        default = "*:1/15";
+      };
+      randomizedDelaySec = lib.mkOption {
+        description = "Randomized delay added to renewal timer runs to avoid synchronized renewals.";
+        type = lib.types.str;
+        default = "5m";
+      };
+      user = lib.mkOption {
+        description = "User account to run the mTLS renewal service as.";
+        type = lib.types.str;
+        default = "root";
+      };
+      group = lib.mkOption {
+        description = "Group to run the mTLS renewal service as. Defaults to the configured renewal user when null.";
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+      };
+      reloadUnits = lib.mkOption {
+        description = "systemd units to try-reload-or-restart after a successful certificate renewal.";
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+      };
+      postCommands = lib.mkOption {
+        description = "Shell commands to run after a successful certificate renewal.";
+        type = lib.types.listOf lib.types.lines;
+        default = [ ];
+      };
+    };
+  };
+
+  mkMtlsRenewScript = {
+    pkgs,
+    tlsCert,
+    tlsKey,
+    mtlsBundle,
+    reloadUnits ? [ ],
+    postCommands ? [ ],
+    systemctlArgs ? [ ],
+  }:
+  let
+    renewReloadScript = lib.concatMapStringsSep "\n" (unit: ''
+      if ${lib.getExe' pkgs.systemd "systemctl"} ${lib.escapeShellArgs systemctlArgs} --quiet is-active "${unit}"; then
+        ${lib.getExe' pkgs.systemd "systemctl"} ${lib.escapeShellArgs systemctlArgs} try-reload-or-restart "${unit}"
+      fi
+    '') reloadUnits;
+    renewPostCommands = lib.concatStringsSep "\n" postCommands;
+  in
+    pkgs.writeShellScriptBin "mtls-renew" ''
+      set -euo pipefail
+
+      if ${lib.getExe pkgs.step-cli} certificate needs-renewal "${tlsCert}"; then
+        echo "Renewing mTLS certificate"
+      else
+        echo "Skipping renew"
+        exit "$?"
+      fi
+
+      ${lib.getExe pkgs.step-cli} ca renew --force "${tlsCert}" "${tlsKey}"
+
+      umask 077
+      ${lib.getExe' pkgs.coreutils "cat"} "${tlsCert}" "${tlsKey}" > "${mtlsBundle}"
+
+      ${renewReloadScript}
+      ${renewPostCommands}
+    '';
+
+  mkNixosMtlsRenewService = {
+    pkgs,
+    tlsCert,
+    tlsKey,
+    mtlsBundle,
+    reloadUnits ? [ ],
+    postCommands ? [ ],
+    user ? "root",
+    group ? null,
+  }:
+  let
+    serviceGroup = if group == null then user else group;
+    renewScript = mkMtlsRenewScript {
+      inherit pkgs tlsCert tlsKey mtlsBundle reloadUnits postCommands;
+    };
+  in
+  {
+    description = "Renew the mTLS certificate when Smallstep marks it ready";
+    wantedBy = [ ];
+    after = [ "network-online.target" ];
+    wants = [ "network-online.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      User = user;
+      Group = serviceGroup;
+      ExecStart = lib.getExe renewScript;
+    };
+  };
+
+  mkNixosMtlsRenewTimer = {
+    onCalendar,
+    randomizedDelaySec,
+    unit ? "mtls-renew.service",
+  }: {
+    description = "Periodic Smallstep renewal for the mTLS certificate";
+    wantedBy = [ "timers.target" ];
+    timerConfig = {
+      Persistent = true;
+      OnCalendar = onCalendar;
+      AccuracySec = "1us";
+      RandomizedDelaySec = randomizedDelaySec;
+      Unit = unit;
+    };
+  };
+
+  mkHomeManagerMtlsRenewService = {
+    pkgs,
+    tlsCert,
+    tlsKey,
+    mtlsBundle,
+    reloadUnits ? [ ],
+    postCommands ? [ ],
+  }:
+  let
+    renewScript = mkMtlsRenewScript {
+      inherit pkgs tlsCert tlsKey mtlsBundle reloadUnits postCommands;
+      systemctlArgs = [ "--user" ];
+    };
+  in
+  {
+    Unit = {
+      Description = "Renew the mTLS certificate when Smallstep marks it ready";
+      After = [ "network-online.target" ];
+      Wants = [ "network-online.target" ];
+    };
+    Service = {
+      Type = "oneshot";
+      ExecStart = lib.getExe renewScript;
+    };
+  };
+
+  mkHomeManagerMtlsRenewTimer = {
+    onCalendar,
+    randomizedDelaySec,
+    unit ? "mtls-renew.service",
+  }: {
+    Unit = {
+      Description = "Periodic Smallstep renewal for the mTLS certificate";
+    };
+    Timer = {
+      Persistent = true;
+      OnCalendar = onCalendar;
+      AccuracySec = "1us";
+      RandomizedDelaySec = randomizedDelaySec;
+      Unit = unit;
+    };
+    Install = {
+      WantedBy = [ "timers.target" ];
+    };
+  };
+
+in
+{
+  flake.modules.nixos.mtls = { config, lib, pkgs, ... }:
+    let
+      cfg = config.mtls;
+      certDir = "/etc/step/certs";
+      tlsKey = "${certDir}/${cfg.keyFilename}";
+      tlsCert = "${certDir}/${cfg.certFilename}";
+      mtlsBundle = "${certDir}/${cfg.bundleFilename}";
+      rootCA = "${certDir}/root_ca.crt";
+      sanArgs = lib.concatMapStringsSep " " (san: "--san \"${san}\"") cfg.san;
+    in
+    {
+      options.mtls = opts;
+      config = lib.mkIf cfg.enable {
+        environment.systemPackages = with pkgs; lib.optionals cfg.enable [
+          (writeShellScriptBin "mtls-generate" ''
+            set -euo pipefail
+            ${lib.getExe pkgs.step-cli} ca certificate \
+              ${cfg.subject} ${tlsCert} ${tlsKey} \
+              --ca-url ${cfg.caURL} \
+              --root ${rootCA} \
+              --provisioner ${cfg.provisioner} \
+              --not-before=-5m --not-after=${cfg.lifetime} \
+              ${sanArgs} \
+              "$@"
+            cat ${tlsCert} ${tlsKey} > ${mtlsBundle}
+          '')
+          (writeShellScriptBin "mtls-check" ''
+            ${lib.getExe pkgs.openssl} x509 \
+            -noout -subject -issuer \
+            -ext subjectAltName,extendedKeyUsage \
+            -enddate -in ${mtlsBundle}
+          '')
+        ];
+
+        systemd.services.mtls-renew = lib.mkIf cfg.renew.enable (mkNixosMtlsRenewService {
+          inherit pkgs tlsCert tlsKey mtlsBundle;
+          inherit (cfg.renew) reloadUnits postCommands user group;
+        });
+
+        systemd.timers.mtls-renew = lib.mkIf cfg.renew.enable (mkNixosMtlsRenewTimer {
+          inherit (cfg.renew) onCalendar randomizedDelaySec;
+        });
+      };
+    };
+
+  flake.modules.homeManager.mtls = { config, lib, pkgs, ... }:
+    let
+      cfg = config.mtls;
+      certDir = cfg.certDir;
+      tlsKey = "${certDir}/${cfg.keyFilename}";
+      tlsCert = "${certDir}/${cfg.certFilename}";
+      mtlsBundle = "${certDir}/${cfg.bundleFilename}";
+      rootCA = "${certDir}/root_ca.crt";
+      sanArgs = lib.concatMapStringsSep " " (san: "--san \"${san}\"") cfg.san;
+    in
+    {
+      options.mtls = opts // {
+        certDir = lib.mkOption {
+          description = "String path to where the mtls certs will be stored.";
+          type = lib.types.str;
+          default ="${config.home.homeDirectory}/.step/certs";
+        };
+      };
+
+      config = {
+        home.packages = with pkgs; lib.optionals cfg.enable [
+          step-cli
+          (writeShellScriptBin "mtls-generate" ''
+            set -euo pipefail
+            ${lib.getExe pkgs.step-cli} ca certificate \
+              ${cfg.subject} ${tlsCert} ${tlsKey} \
+              --not-before=-5m --not-after=${cfg.lifetime} \
+              --provisioner ${cfg.provisioner} \
+              ${sanArgs} \
+              "$@"
+            cat ${tlsCert} ${tlsKey} > ${mtlsBundle}
+          '')
+          (writeShellScriptBin "mtls-check" ''
+            ${lib.getExe pkgs.openssl} x509 \
+            -noout -subject -issuer \
+            -ext subjectAltName,extendedKeyUsage \
+            -enddate -in ${mtlsBundle}
+          '')
+          (mkMtlsRenewScript { inherit pkgs tlsCert tlsKey mtlsBundle; })
+        ];
+
+        systemd.user.services.mtls-renew = lib.mkIf cfg.renew.enable (mkHomeManagerMtlsRenewService {
+          inherit pkgs tlsCert tlsKey mtlsBundle;
+          inherit (cfg.renew) reloadUnits postCommands;
+        });
+
+        systemd.user.timers.mtls-renew = lib.mkIf cfg.renew.enable (mkHomeManagerMtlsRenewTimer {
+          inherit (cfg.renew) onCalendar randomizedDelaySec;
+        });
+      };
+    };
+}

modules/services/step-ca/ssh-host.nix

@@ -0,0 +1,116 @@
+{ inputs, ... }: {
+  flake.modules.nixos.step-ssh-host = { config, pkgs, lib, ... }:
+  let
+    cfg = config.step-ssh-host;
+    rootCertPath = "/etc/step/certs/root_ca.crt";
+    provisionerPasswordPath = config.sops.secrets."janus/admin_jwk".path;
+    sshKeyPath = "/etc/ssh/ssh_host_ed25519_key";
+    sshCertPath = "${sshKeyPath}-cert.pub";
+  in
+  {
+    # NixOS Options
+    options.step-ssh-host = {
+      hostname = lib.mkOption {
+        description = "Networking host name";
+        type = lib.types.str;
+      };
+      caURL = lib.mkOption {
+        description = "URL for the certificate authority";
+        type = lib.types.str;
+      };
+      rootCertFile = {
+        path = lib.mkOption {
+          description = "String path to where the root_ca.crt file will be stored for the user";
+          type = lib.types.str;
+          default = "step/certs/root_ca.crt";
+        };
+        source = lib.mkOption {
+          description = "Nix path to the root cert file within the repo";
+          type = lib.types.path;
+          default = ../../../keys/root_ca.crt;
+        };
+      };
+      provisioner = lib.mkOption {
+        description = "Provisioner inside Step CA to use for the SSH certificates";
+        type = lib.types.str;
+        default = "admin";
+      };
+    };
+
+    imports = with inputs.self.modules.nixos; [ ssh ];
+    # NixOS Config
+    config = {
+      ssh.certificates.enable = true;
+      sops.secrets."janus/admin_jwk" = {
+        owner = "root";
+        group = "root";
+        mode = "0400";
+      };
+      networking.nameservers = [ "192.168.1.150" ];
+      networking.dhcpcd.extraConfig = "nohook resolv.conf";
+
+      environment.etc."${cfg.rootCertFile.path}".source = cfg.rootCertFile.source;
+      environment.systemPackages = with pkgs; [
+        step-cli
+        (writeShellScriptBin "ssh-host-cert-renew" ''
+          ${lib.getExe pkgs.step-cli} ssh certificate \
+          --host --sign \
+          --root "${rootCertPath}" \
+          --ca-url ${cfg.caURL} \
+          --provisioner "${cfg.provisioner}" \
+          --provisioner-password-file "${provisionerPasswordPath}" \
+          --principal "${cfg.hostname}" \
+          --principal "${cfg.hostname}.john-stream.com" \
+          "${cfg.hostname}" "${sshKeyPath}.pub"
+        '')
+        (writeShellScriptBin "ssh-host-cert-check" "${lib.getExe' pkgs.openssh "ssh-keygen"} -Lf ${sshCertPath}")
+      ];
+
+      systemd.services.step-ssh-host-renew = {
+        description = "Renew Step SSH host certificate if needed";
+        wantedBy = [ ];
+        after = [ "network-online.target" ];
+        wants = [ "network-online.target" ];
+        path = [ pkgs.step-cli pkgs.openssh pkgs.coreutils pkgs.systemd ];
+        serviceConfig = {
+          Type = "oneshot";
+          User = "root";
+          Group = "root";
+        };
+        script = ''
+          set -euo pipefail
+          if ${lib.getExe pkgs.step-cli} ssh needs-renewal "${sshCertPath}" --expires-in "4h"; then
+            echo "Renewing SSH host certificate"
+          else
+            rc=$?
+            if [ "$rc" -eq 1 ]; then
+              echo "SSH host cert does not need renewal"
+              exit 0
+            fi
+
+            if [ "$rc" -eq 2 ]; then
+              echo "SSH host cert missing: ${sshCertPath}" >&2
+              exit 1
+            fi
+
+            echo "step ssh needs-renewal failed with rc=$rc" >&2
+            exit "$rc"
+          fi
+        '';
+      };
+
+      systemd.timers.step-ssh-host-renew = {
+        description = "Periodic Step SSH host certificate renewal";
+        wantedBy = [ "timers.target" ];
+
+        timerConfig = {
+          OnBootSec = "5m";
+          OnUnitActiveSec = "4h";
+          RandomizedDelaySec = "15m";
+          Persistent = true;
+          Unit = "step-ssh-host-renew.service";
+        };
+      };
+    };
+  };
+}