nixos-servers/modules/custom/ssh-certificates.nix

{ lib, config, ... }:
let
  cfg = config.custom.ssh;
  hostCert = builtins.toFile "host_ed25519-cert.pub" cfg.hostCert;
  userCert = builtins.toFile "user_ed25519-cert.pub" cfg.userCert;
in {
  options = {
    custom = {
      ssh = {
        useCertificates = lib.mkOption {
          type = lib.types.bool;
          default = false;
          description = ''
            Whether to use certificates at all.
          '';
        };

        hostCert = lib.mkOption {
          type = lib.types.str;
          description = ''
            SSH host certificate
          '';
        };

        userCert = lib.mkOption {
          type = lib.types.str;
          description = ''
            SSH user certificate
          '';
        };

        hostKey = lib.mkOption {
          default =
            ../../secrets/${config.networking.hostName}_host_ed25519.age;
          type = lib.types.path;
          description = ''
            SSH host key
          '';
        };

        userKey = lib.mkOption {
          default =
            ../../secrets/${config.networking.hostName}_user_ed25519.age;
          type = lib.types.path;
          description = ''
            SSH user key
          '';
        };
      };
    };
  };

  config = lib.mkIf cfg.useCertificates {
    services.openssh = {
      extraConfig = ''
        HostCertificate ${hostCert}
        HostKey ${config.age.secrets.host_ed25519.path}
      '';
    };

    programs.ssh = {
      extraConfig = ''
        CertificateFile ${userCert}
        IdentityFile ${config.age.secrets.user_ed25519.path}
      '';
    };

    age.secrets = {
      "host_ed25519".file = cfg.hostKey;
      "user_ed25519".file = cfg.userKey;
    };
  };
}