{ inputs, ... }: {
  flake.modules.nixos.ssh-certs = { config, pkgs, lib, ... }:
  let
    cfg = config.ssh-certs;
    wrappers = inputs.self.wrappers;
    sshKeyPath = "/etc/ssh/ssh_host_ed25519_key";
    sshCertPath = "${sshKeyPath}-cert.pub";

    sshHostCertSign = (wrappers.signHostWrapper.apply {
      inherit pkgs;
      inherit (cfg) provisioner extraPrincipals;
      provisionerPasswordFile = config.sops.secrets."janus/admin_jwk".path;
    }).wrapper;
    sshHostCertRenew = (wrappers.renewHostWrapper.apply {
      inherit pkgs;
      sshHostKeyFile = sshKeyPath;
      overwrite = true;
    }).wrapper;
    sshHostCertCheck = (wrappers.hostCheckWrapper.apply {
      inherit pkgs;
      certPath = sshCertPath;
    }).wrapper;
    sshHostRenewalCheck = (wrappers.renewalCheck.apply {
      inherit pkgs;
      certPath = sshCertPath;
      expires-in = "4h";
    }).wrapper;
  in
  {
    # NixOS Options
    options.ssh-certs = {
      provisioner = lib.mkOption {
        description = "Provisioner inside Step CA to use for the SSH certificates";
        type = lib.types.str;
        default = "admin";
      };
      extraPrincipals = lib.mkOption {
        description = "Additional SSH host certificate principals to include per host";
        type = with lib.types; listOf str;
        default = [ ];
      };
    };

    # imports = with inputs.self.modules.nixos; [ ssh ];

    # NixOS Config
    config = {
      # ssh.certificates.enable = true;
      sops.secrets."janus/admin_jwk" = {
        # Shared provisioner credential is intentionally centralized.
        sopsFile = ../../../keys/secrets.yaml;
        owner = "root";
        group = "root";
        mode = "0400";
      };
      networking.nameservers = [ "192.168.1.150" ];
      networking.dhcpcd.extraConfig = "nohook resolv.conf";
      environment.systemPackages = [
        sshHostCertSign
        sshHostCertRenew
        sshHostRenewalCheck
        sshHostCertCheck
      ];

      systemd.services.ssh-certs-renew = {
        description = "SSH host certificate renewal";
        wantedBy = [ "multi-user.target" ];
        after = [ "network-online.target" ];
        wants = [ "network-online.target" ];
        path = with pkgs; [ step-cli systemd ];
        serviceConfig = {
          Type = "oneshot";
          User = "root";
          Group = "root";
          ExecCondition = lib.getExe sshHostRenewalCheck;
          ExecStart = lib.getExe sshHostCertRenew;
        };
      };

      systemd.timers.ssh-certs-renew = {
        description = "Periodic Step SSH host certificate renewal";
        wantedBy = [ "timers.target" ];
        timerConfig = {
          OnBootSec = "5m";
          OnUnitActiveSec = "4h";
          RandomizedDelaySec = "15m";
          Persistent = true;
          Unit = "ssh-certs-renew.service";
        };
      };
    };
  };
}