central time zone on LXCs

modules/hosts/janus/default.nix

@@ -5,7 +5,7 @@ let
 in
 {
   flake.modules.nixos.janus-ca =
-    { config, lib, ... }:
+    { config, pkgs, lib, ... }:
     let
       cfg = config.janus-ca;
       johnHome = lib.attrByPath [ "users" "users" username "home" ] "/home/${username}" config;
@@ -58,11 +58,15 @@ in
       nixos.docker
       nixos.login-text
       nixos.mtls
-      {
+      ({ lib, pkgs, ... }: {
         networking.hostName = hostname;
         sops.defaultSopsFile = ../../../keys/secrets.yaml;
         step-ssh-host = {
           hostname = hostname;
+          extraPrincipals = [
+            "192.168.1.244"
+            "fded:fb16:653e:25da:be24:11ff:fea0:753f"
+          ];
         };
         mtls = {
           enable = true;
@@ -73,13 +77,23 @@ in
           ];
         };
 
+        users.users."${username}" = {
+          shell = lib.mkForce (
+            lib.getExe inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.jsl-zsh
+          );
+        };
+
+        # users.users."${username}".openssh.authorizedKeys.keys = [
+        #   "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMOkGLo4N/L3RYvaIZ1FmePlxa1HK0fMciZxKtRhN58F root@janus"
+        # ];
+
         home-manager.users."${username}" = {
           imports = with inputs.self.modules.homeManager; [
             mysops
           ];
           docker.enable = true;
         };
-      }
+      })
     ];
   };
 }

modules/nixos/lxc.nix

@@ -6,6 +6,7 @@
     ];
     nixpkgs.hostPlatform = lib.mkForce "x86_64-linux";
     system.stateVersion = "25.11";
+    time.timeZone = "US/Central";
     nix.settings.experimental-features = [ "nix-command" "flakes" ];
     environment.systemPackages = with pkgs; [ git zsh ];
 

modules/programs/zsh.nix

@@ -79,6 +79,19 @@ in
         ignorePatterns = [
           "ls" "eza" "history" "clear"
         ];
+        integrationPackages = with pkgs; [
+          fzf
+          zoxide
+          self'.packages.starship
+        ];
+        extraToolPackages = with pkgs; [
+          lazygit
+          lazydocker
+          devenv
+          self'.packages.shell-tools
+          self'.packages.neovim-min
+        ];
+        loginBootstrapPath = lib.makeBinPath (integrationPackages ++ extraToolPackages);
         aliasStr = lib.concatStringsSep "\n" (
           lib.mapAttrsToList (k: v: "alias -- ${lib.escapeShellArg k}=${lib.escapeShellArg v}") {
             ls = "eza";
@@ -116,18 +129,17 @@ in
             ignoreAllDups = true;
             ignoreSpace = true;
           };
-          integrations = {
-            fzf.enable = true;
-            starship = {
-              enable = true;
-              package = self'.packages.starship;
-            };
-            zoxide.enable = true;
-          };
         };
         extraRC = ''
           ${homeEndKeyBindings}
 
+          # Login shells may reset PATH before integrations run.
+          export PATH=${lib.escapeShellArg loginBootstrapPath}:$PATH
+
+          source <(fzf --zsh)
+          eval "$(zoxide init zsh)"
+          eval "$(starship init zsh)"
+
           HISTFILE=$HOME/.config/zsh/.zsh_history
           SAVEHIST=${toString historySize}
           HISTORY_IGNORE=${lib.escapeShellArg "(${lib.concatStringsSep "|" ignorePatterns})"}
@@ -137,13 +149,7 @@ in
 
           eval "$(devenv hook zsh)"
         '';
-        extraPackages = with pkgs; [
+        extraPackages = extraToolPackages;
-          lazygit
-          lazydocker
-          devenv
-          self'.packages.shell-tools
-          self'.packages.neovim-min
-        ];
       }).wrapper;
   };
 }

modules/services/step-ca/ssh-host.nix

@@ -5,6 +5,12 @@
     provisionerPasswordPath = config.sops.secrets."janus/admin_jwk".path;
     sshKeyPath = "/etc/ssh/ssh_host_ed25519_key";
     sshCertPath = "${sshKeyPath}-cert.pub";
+    mkPrincipalArgs = principals:
+      lib.concatMapStringsSep " " (principal: ''--principal "${principal}"'') principals;
+    principalArgs = mkPrincipalArgs ([
+      cfg.hostname
+      "${cfg.hostname}.john-stream.com"
+    ] ++ cfg.extraPrincipals);
   in
   {
     # NixOS Options
@@ -18,6 +24,11 @@
         type = lib.types.str;
         default = "admin";
       };
+      extraPrincipals = lib.mkOption {
+        description = "Additional SSH host certificate principals to include per host";
+        type = with lib.types; listOf str;
+        default = [ ];
+      };
     };
 
     imports = with inputs.self.modules.nixos; [ ssh ];
@@ -39,8 +50,7 @@
           --host --sign \
           --provisioner "${cfg.provisioner}" \
           --provisioner-password-file "${provisionerPasswordPath}" \
-          --principal "${cfg.hostname}" \
+          ${principalArgs} \
-          --principal "${cfg.hostname}.john-stream.com" \
           "${cfg.hostname}" "${sshKeyPath}.pub"
         '')
         (writeShellScriptBin "ssh-host-cert-check" "${lib.getExe' pkgs.openssh "ssh-keygen"} -Lf ${sshCertPath}")

modules/users/john.nix

@@ -1,4 +1,4 @@
-{ self, inputs, lib, ... }:
+{ self, inputs, ... }:
 let
   username = "john";
   baseUserModules = self.factory.user {
@@ -14,13 +14,13 @@ in
     key = "";
     keygrip = [ ];
     authorizedKeys = [
-      # "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIAUa4dcg1TWc4pW++uodyhX4eOqrX/QYIxFWtEP7HFJ john@john-pc-ubuntu"
+      # Shared keys for every host can go here.
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMOkGLo4N/L3RYvaIZ1FmePlxa1HK0fMciZxKtRhN58F root@janus"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIAUa4dcg1TWc4pW++uodyhX4eOqrX/QYIxFWtEP7HFJ john@john-pc-ubuntu"
     ];
   };
 
   flake.modules = {
-    nixos."${username}" = { ... }: {
+    nixos."${username}" = { config, pkgs, ... }: {
       imports = [
         baseUserModules.nixos."${username}"
       ];
@@ -38,9 +38,6 @@ in
           inputs.self.modules.homeManager.ssh
           inputs.self.modules.homeManager.git
         ];
-        # home.packages = [
-        #   inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.shell-tools
-        # ];
         xdg.enable = true;
         programs.git.settings.user.name = name;
         programs.git.settings.user.email = email;