{ inputs, ... }:
let
  username = "john";
  hostname = "janus";
  ipv4 = "192.168.1.32";
  ipv6 = "fded:fb16:653e:25da:be24:11ff:fe6b:4d57";
  names = [ "${hostname}.john-stream.com" ipv4 ipv6 ];
in
{
  flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
    modules = with inputs.self.modules; [
      nixos.lxc
      nixos.login-text
      inputs.home-manager.nixosModules.home-manager
      nixos."${username}"
      nixos.ssh-new
      nixos.mysops
      nixos.step-ca       # Runs the step-ca server
      nixos.step-client   # Uses the step-ca server as a client
      nixos.mtls
      ({ config, lib, pkgs, ... }: {
        networking.hostName = hostname;
        loginText.extraServiceStatus = {
          "Step-CA" = "step-ca";
        };
        sops.defaultSopsFile = ./secrets.yaml;
        ssh-new.certificates = {
          provisioner = "admin";
          host = {
            enable = true;
            extraPrincipals = names;
            autoRenew = true;
          };
          user.enable = true;
        };
        step-ca = {
          rootCertPath = ./public/root_ca.crt;
          intermediateCertPath = ./public/intermediate_ca.crt;
          dnsNames = names;
          secrets = {
            sopsFile = ./secrets.yaml;
            caPassword = "janus/ca_password";
            intermediateKey = "janus/intermediate_ca_key";
            sshHostCaKey = "janus/ssh_host_ca_key";
            sshUserCaKey = "janus/ssh_user_ca_key";
            adminProvisionerEncryptedKey = "janus/admin_provisioner_encrypted_key";
          };
        };
        step-client.caUrl = "https://${ipv4}/";
        mtls = {
          enable = true;
          subject = hostname;
          san = names;
          bootstrap = {
            enable = true;
            after = [ "sops-nix.service" "step-ca.service" ];
            wants = [ "step-ca.service" ];
            provisionerPasswordFile = config.sops.secrets."janus/admin_jwk".path;
          };
        };
      })
    ];
  };
}