root version of jsl-zsh

modules/hosts/janus/default.nix

@@ -5,7 +5,7 @@ let
 in
 {
   flake.modules.nixos.janus-ca =
-    { config, lib, ... }:
+    { config, pkgs, lib, ... }:
     let
       cfg = config.janus-ca;
       johnHome = lib.attrByPath [ "users" "users" username "home" ] "/home/${username}" config;
@@ -58,11 +58,15 @@ in
       nixos.docker
       nixos.login-text
       nixos.mtls
-      {
+      ({ lib, pkgs, ... }: {
         networking.hostName = hostname;
         sops.defaultSopsFile = ../../../keys/secrets.yaml;
         step-ssh-host = {
           hostname = hostname;
+          extraPrincipals = [
+            "192.168.1.244"
+            "fded:fb16:653e:25da:be24:11ff:fea0:753f"
+          ];
         };
         mtls = {
           enable = true;
@@ -73,13 +77,23 @@ in
           ];
         };
 
+        users.users."${username}" = {
+          shell = lib.mkForce (
+            lib.getExe inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.jsl-zsh
+          );
+        };
+
+        # users.users."${username}".openssh.authorizedKeys.keys = [
+        #   "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMOkGLo4N/L3RYvaIZ1FmePlxa1HK0fMciZxKtRhN58F root@janus"
+        # ];
+
         home-manager.users."${username}" = {
           imports = with inputs.self.modules.homeManager; [
             mysops
           ];
           docker.enable = true;
         };
-      }
+      })
     ];
   };
 }

modules/nixos/lxc.nix

@@ -1,13 +1,27 @@
 { inputs, ... }:
 {
-  flake.modules.nixos.lxc = { pkgs, lib, ...}: {
+  flake.modules.nixos.lxc = { pkgs, lib, ...}:
+    let
+      selfPackages = inputs.self.packages.${pkgs.stdenv.hostPlatform.system};
+      rootShellPath = lib.getExe' selfPackages.jsl-zsh-tty "jsl-zsh-tty";
+    in
+    {
       imports = with inputs.self.modules.nixos; [
         ({ modulesPath, ... }: { imports = [ "${modulesPath}/virtualisation/proxmox-lxc.nix" ]; })
       ];
       nixpkgs.hostPlatform = lib.mkForce "x86_64-linux";
       system.stateVersion = "25.11";
+      time.timeZone = "US/Central";
       nix.settings.experimental-features = [ "nix-command" "flakes" ];
-    environment.systemPackages = with pkgs; [ git zsh ];
+      environment.systemPackages = with pkgs; [
+        git
+        zsh
+        selfPackages.jsl-zsh-tty
+      ];
+      environment.shells = lib.mkAfter [
+        rootShellPath
+      ];
+      users.users.root.shell = lib.mkForce rootShellPath;
 
       # security.sudo-rs.enable = true;
       programs.nix-ld.enable = true;

modules/programs/ghostty.nix

@@ -39,7 +39,7 @@
       enableZshIntegration = true;
       package = ghosttyX11;
       settings = {
-        command = "TERM=xterm-256color ${lib.getExe pkgs.zsh}";
+        command = "TERM=xterm-256color ${lib.getExe inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.jsl-zsh}";
         font-size = 12;
         font-family = "Source Code Pro";
         theme = "Catppuccin Mocha";

modules/programs/starship.nix

@@ -50,5 +50,65 @@
           '';
         };
     }).wrapper;
+
+    packages.starship-ascii = (inputs.wrappers.wrapperModules.starship.apply {
+      inherit pkgs;
+      settings = {
+        add_newline = false;
+
+        format = "$username$hostname$directory$git_branch$git_status$cmd_duration$line_break$character";
+
+        username = {
+          show_always = true;
+          format = "[$user]($style)";
+          style_user = "bold blue";
+          style_root = "bold red";
+        };
+
+        hostname = {
+          disabled = false;
+          ssh_only = false;
+          format = "[@$hostname]($style) ";
+          style = "bold blue";
+        };
+
+        directory = {
+          truncation_length = 3;
+          truncate_to_repo = true;
+          format = "[ in $path]($style) ";
+          style = "bold cyan";
+        };
+
+        git_branch = {
+          symbol = "on ";
+          format = "[$symbol$branch]($style) ";
+          style = "bold yellow";
+        };
+
+        git_status = {
+          format = "([$all_status$ahead_behind]($style) )";
+          style = "bold red";
+          ahead = "ahead:$count ";
+          behind = "behind:$count ";
+          diverged = "diverged:$ahead_count/$behind_count ";
+          up_to_date = "";
+        };
+
+        cmd_duration = {
+          min_time = 2000;
+          show_notifications = false;
+          format = "took [$duration]($style) ";
+          style = "bold green";
+        };
+
+        line_break.disabled = false;
+
+        character = {
+          success_symbol = "[\\$](bold green) ";
+          error_symbol = "[\\$](bold red) ";
+          vicmd_symbol = "[\\$](bold yellow) ";
+        };
+      };
+    }).wrapper;
   };
 }

modules/programs/zsh.nix

@@ -23,62 +23,44 @@ let
 in
 {
   flake.modules = {
-    nixos.zsh = { pkgs, ... }: {
+    nixos.zsh = { pkgs, ... }:
-      users.users."${username}".shell = pkgs.zsh;
+      let
+        selfPackages = inputs.self.packages.${pkgs.stdenv.hostPlatform.system};
+      in
+      {
+        users.users."${username}".shell = selfPackages.jsl-zsh;
         programs.zsh.enable = true;
-      # Already being imported by the john.nix module
-      # home-manager.sharedModules = [
-      #   inputs.self.modules.homeManager.zsh
-      # ];
       };
 
-    homeManager.zsh = { pkgs, config, ... }: {
+    homeManager.zsh = { pkgs, config, ... }:
+      let
+        selfPackages = inputs.self.packages.${pkgs.stdenv.hostPlatform.system};
+      in
+      {
         programs.zsh = {
           enable = true;
-        package = inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.jsl-zsh;
+          package = selfPackages.jsl-zsh;
-        enableCompletion = true;
-        autosuggestion.enable = true;
-        # syntaxHighlighting.enable = true;
-        initContent = ''
-          HOST=$(hostname -s)
-          ${homeEndKeyBindings}
-        '';
           dotDir = "${config.xdg.configHome}/zsh";
-        history = {
-          append = true;
-          ignoreAllDups = true;
-          ignorePatterns = [
-            "history"
-            "ls"
-            "eza"
-            "clear"
-          ];
-          save = historySize;
-          size = historySize;
-          share = true;
-        };
-        oh-my-zsh = {
-          enable = true;
-          # theme = "risto";
-          theme = "agnoster";
-          plugins = [
-            "sudo"
-            "dotenv"
-            "git"
-            "ssh"
-            "ssh-agent"
-          ];
-        };
         };
       };
   };
 
-  perSystem = { config, self', pkgs, lib, ... }: {
+  perSystem = { config, self', pkgs, lib, ... }:
-    packages.jsl-zsh =
     let
       ignorePatterns = [
         "ls" "eza" "history" "clear"
       ];
+      integrationPackages = with pkgs; [
+        fzf
+        zoxide
+      ];
+      extraToolPackages = with pkgs; [
+        lazygit
+        lazydocker
+        devenv
+        self'.packages.shell-tools
+        self'.packages.neovim-min
+      ];
       aliasStr = lib.concatStringsSep "\n" (
         lib.mapAttrsToList (k: v: "alias -- ${lib.escapeShellArg k}=${lib.escapeShellArg v}") {
           ls = "eza";
@@ -89,10 +71,13 @@ in
           ds = "gdu -i /snap /";
           ld = "lazydocker";
         });
+
+      mkJslZsh = { binName, starshipPackage }:
+        let
+          loginBootstrapPath = lib.makeBinPath (integrationPackages ++ [ starshipPackage ] ++ extraToolPackages);
         in
         (inputs.wrappers.wrapperModules.zsh.apply {
-        inherit pkgs;
+          inherit pkgs binName;
-        binName = "jsl-zsh";
           env = {
             LANG = "en_US.UTF-8";
             COLORTERM = "truecolor";
@@ -116,18 +101,17 @@ in
               ignoreAllDups = true;
               ignoreSpace = true;
             };
-          integrations = {
-            fzf.enable = true;
-            starship = {
-              enable = true;
-              package = self'.packages.starship;
-            };
-            zoxide.enable = true;
-          };
           };
           extraRC = ''
             ${homeEndKeyBindings}
 
+            # Login shells may reset PATH before integrations run.
+            export PATH=${lib.escapeShellArg loginBootstrapPath}:$PATH
+
+            source <(fzf --zsh)
+            eval "$(zoxide init zsh)"
+            eval "$(starship init zsh)"
+
             HISTFILE=$HOME/.config/zsh/.zsh_history
             SAVEHIST=${toString historySize}
             HISTORY_IGNORE=${lib.escapeShellArg "(${lib.concatStringsSep "|" ignorePatterns})"}
@@ -137,13 +121,18 @@ in
 
             eval "$(devenv hook zsh)"
           '';
-        extraPackages = with pkgs; [
+          extraPackages = extraToolPackages;
-          lazygit
-          lazydocker
-          devenv
-          self'.packages.shell-tools
-          self'.packages.neovim-min
-        ];
         }).wrapper;
+    in
+    {
+      packages.jsl-zsh = mkJslZsh {
+        binName = "jsl-zsh";
+        starshipPackage = self'.packages.starship;
+      };
+
+      packages.jsl-zsh-tty = mkJslZsh {
+        binName = "jsl-zsh-tty";
+        starshipPackage = self'.packages.starship-ascii;
+      };
     };
 }

modules/services/step-ca/ssh-host.nix

@@ -5,6 +5,12 @@
     provisionerPasswordPath = config.sops.secrets."janus/admin_jwk".path;
     sshKeyPath = "/etc/ssh/ssh_host_ed25519_key";
     sshCertPath = "${sshKeyPath}-cert.pub";
+    mkPrincipalArgs = principals:
+      lib.concatMapStringsSep " " (principal: ''--principal "${principal}"'') principals;
+    principalArgs = mkPrincipalArgs ([
+      cfg.hostname
+      "${cfg.hostname}.john-stream.com"
+    ] ++ cfg.extraPrincipals);
   in
   {
     # NixOS Options
@@ -18,6 +24,11 @@
         type = lib.types.str;
         default = "admin";
       };
+      extraPrincipals = lib.mkOption {
+        description = "Additional SSH host certificate principals to include per host";
+        type = with lib.types; listOf str;
+        default = [ ];
+      };
     };
 
     imports = with inputs.self.modules.nixos; [ ssh ];
@@ -39,8 +50,7 @@
           --host --sign \
           --provisioner "${cfg.provisioner}" \
           --provisioner-password-file "${provisionerPasswordPath}" \
-          --principal "${cfg.hostname}" \
+          ${principalArgs} \
-          --principal "${cfg.hostname}.john-stream.com" \
           "${cfg.hostname}" "${sshKeyPath}.pub"
         '')
         (writeShellScriptBin "ssh-host-cert-check" "${lib.getExe' pkgs.openssh "ssh-keygen"} -Lf ${sshCertPath}")

modules/users/john.nix

@@ -1,4 +1,4 @@
-{ self, inputs, lib, ... }:
+{ self, inputs, ... }:
 let
   username = "john";
   baseUserModules = self.factory.user {
@@ -14,13 +14,13 @@ in
     key = "";
     keygrip = [ ];
     authorizedKeys = [
-      # "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIAUa4dcg1TWc4pW++uodyhX4eOqrX/QYIxFWtEP7HFJ john@john-pc-ubuntu"
+      # Shared keys for every host can go here.
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMOkGLo4N/L3RYvaIZ1FmePlxa1HK0fMciZxKtRhN58F root@janus"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIAUa4dcg1TWc4pW++uodyhX4eOqrX/QYIxFWtEP7HFJ john@john-pc-ubuntu"
     ];
   };
 
   flake.modules = {
-    nixos."${username}" = { ... }: {
+    nixos."${username}" = { config, pkgs, ... }: {
       imports = [
         baseUserModules.nixos."${username}"
       ];
@@ -38,9 +38,6 @@ in
           inputs.self.modules.homeManager.ssh
           inputs.self.modules.homeManager.git
         ];
-        # home.packages = [
-        #   inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.shell-tools
-        # ];
         xdg.enable = true;
         programs.git.settings.user.name = name;
         programs.git.settings.user.email = email;