{ inputs, ... }:
{
  flake.modules.nixos.step-ca = { config, pkgs, ... }:
  let
    # Keep host-specific trust anchor in repo; secret/private keys come from sops.
    rootCertPath = ../../hosts/janus/root_ca.crt;
    caPasswordPath = config.sops.secrets."janus/ca_password".path;
    intermediateCrtPath = config.sops.secrets."janus/intermediate_ca_crt".path;
    intermediateKeyPath = config.sops.secrets."janus/intermediate_ca_key".path;
    sshHostCaKeyPath = config.sops.secrets."janus/ssh_host_ca_key".path;
    sshUserCaKeyPath = config.sops.secrets."janus/ssh_user_ca_key".path;
  in
  {
    # Placeholders are expected initially until real material is inserted into sops.
    sops.secrets."janus/ca_password" = {
      sopsFile = ../../hosts/janus/secrets.yaml;
      owner = "step-ca";
      group = "step-ca";
      mode = "0400";
    };
    sops.secrets."janus/intermediate_ca_crt" = {
      sopsFile = ../../hosts/janus/secrets.yaml;
      owner = "step-ca";
      group = "step-ca";
      mode = "0400";
    };
    sops.secrets."janus/intermediate_ca_key" = {
      sopsFile = ../../hosts/janus/secrets.yaml;
      owner = "step-ca";
      group = "step-ca";
      mode = "0400";
    };
    sops.secrets."janus/ssh_host_ca_key" = {
      sopsFile = ../../hosts/janus/secrets.yaml;
      owner = "step-ca";
      group = "step-ca";
      mode = "0400";
    };
    sops.secrets."janus/ssh_user_ca_key" = {
      sopsFile = ../../hosts/janus/secrets.yaml;
      owner = "step-ca";
      group = "step-ca";
      mode = "0400";
    };

    # https://github.com/NixOS/nixpkgs/blob/nixos-23.05/nixos/modules/services/security/step-ca.nix
    services.step-ca = {
      enable = true;
      openFirewall = true;
      address = "0.0.0.0";
      port = 443;
      intermediatePasswordFile = caPasswordPath;

      # https://smallstep.com/docs/step-ca/configuration/#configuration-options
      settings = {
        root = rootCertPath;
        crt = intermediateCrtPath;
        key = intermediateKeyPath;
        dnsNames = [
          "janus.john-stream.com"
          "192.168.1.244"
        ];

        ssh = {
          hostKey = sshHostCaKeyPath;
          userKey = sshUserCaKeyPath;
        };

        db = {
          type = "badgerv2";
          dataSource = "/var/lib/step-ca/db";
        };

        authority = {
          backdate = "1m0s";
          provisioners = [
            {
              type = "ACME";
              name = "acme";
            }
            {
              type = "SSHPOP";
              name = "sshpop";
              claims.enableSSHCA = true;
            }
            {
              type = "JWK";
              name = "admin";
              key = {
                use = "sig";
                kty = "EC";
                kid = "xoxgOJFbveSLIL2gm1Yu5ZiRb9v8Jxe44F56i3v-Nf8";
                crv = "P-256";
                alg = "ES256";
                x = "zFO8hPx_eH0Iyz7UJI-w8ODMusEKCZ28M76sGWmWYxA";
                y = "XIWLLyKDzqxV9UH-2KeAkKPDrgLoPrxxW9-PzkXggME";
              };
              encryptedKey = "eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJjdHkiOiJqd2sranNvbiIsImVuYyI6IkEyNTZHQ00iLCJwMmMiOjYwMDAwMCwicDJzIjoiUVJnTnJVTF9KcmxJYkJMVTlGNVRPZyJ9.DMu7xBNCq5pr-_--YTxNr5Hrcqy6ZmSVHsWurfVXL7Hk0Q3vyYRxiw.h-CnFiYc-DhxThI3.plx3_Qa_0kU-2TwnqFNfAfGnCpfQ2e0iiCMLruNHbLMnHeXQ1BysHBqps45_02zZXIRdHoDgYGtXRSfcdUYYoS0pLoPzC6m301ZFNSAFdRVlSZ3Q6VmWdixPXXnEB4EgSKTT_wxR33L8t9OpFzD85KfY-b_Un1l99ufjCnfg-EYkcICTn_G4-8bcW3eFIvJ6setzu-l0jHMhLQdIweqncn9on9xBXBD-ANhZfP95P2BJt-APqCi8eqiAvn_vClovdg0PxzRwOVDvWREz66FDw-HTU7xDtGO9hACopT5tfZOXDoykgZw1mJsq9NEq9ZzvKG2hvyk1UXtExxrNtFo.5q1OfGU4Amo4Si-vpeI42g";
              claims = {
                enableSSHCA = true;
                disableRenewal = false;
                allowRenewalAfterExpiry = false;
                disableSmallstepExtensions = false;
              };
              options = {
                x509 = { };
                ssh = { };
              };
            }
          ];
        };

        tls = {
          cipherSuites = [
            "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
            "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
          ];
          minVersion = 1.2;
          maxVersion = 1.3;
          renegotiation = false;
        };
      };
    };

    environment.systemPackages = with pkgs; [
      step-ca
      step-cli
    ];
  };
}