nixos-servers/nix/modules/ssh-certificates.nix

{ lib, config, ... }:
let
  cfg = config.lab.ssh;
  hostCert = builtins.toFile "host_ed25519-cert.pub" cfg.hostCert;
  userCert = builtins.toFile "user_ed25519-cert.pub" cfg.userCert;
in
{
  options.lab.ssh = {
    useCertificates = lib.mkOption {
      type = lib.types.bool;
      default = false;
      description = ''
        Whether to use certificates at all.
      '';
    };

    hostCert = lib.mkOption {
      type = lib.types.str;
      description = ''
        SSH host certificate
      '';
    };

    userCert = lib.mkOption {
      type = lib.types.str;
      description = ''
        SSH user certificate
      '';
    };

    hostKey = lib.mkOption {
      default =
        ../secrets/${config.networking.hostName}_host_ed25519.age;
      type = lib.types.path;
      description = ''
        SSH host key
      '';
    };

    userKey = lib.mkOption {
      default =
        ../secrets/${config.networking.hostName}_user_ed25519.age;
      type = lib.types.path;
      description = ''
        SSH user key
      '';
    };
  };

  config = lib.mkIf cfg.useCertificates {
    services.openssh = {
      extraConfig = ''
        HostCertificate ${hostCert}
        HostKey ${config.age.secrets.host_ed25519.path}
      '';
    };

    programs.ssh = {
      extraConfig = ''
        CertificateFile ${userCert}
        IdentityFile ${config.age.secrets.user_ed25519.path}
      '';
    };

    age.secrets = {
      "host_ed25519".file = cfg.hostKey;
      "user_ed25519".file = cfg.userKey;
    };
  };
}