openssh: certificate authority

28 files changed, 44 insertions, 76 deletions

diff --git a/system-profiles/openssh/known-hosts/.gitignore b/system-profiles/openssh/known-hosts/.gitignore
new file mode 100644
index 00000000..5528ec64
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/.gitignore
@@ -0,0 +1 @@
+expiration
\ No newline at end of file
diff --git a/system-profiles/openssh/known-hosts/Gupfile b/system-profiles/openssh/known-hosts/Gupfile
new file mode 100644
index 00000000..9217f43f
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/Gupfile
@@ -0,0 +1,2 @@
+ca-sign.gup:
+  **/*-cert.pub
\ No newline at end of file
diff --git a/system-profiles/openssh/known-hosts/ca-sign.gup b/system-profiles/openssh/known-hosts/ca-sign.gup
new file mode 100644
index 00000000..512f0e84
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/ca-sign.gup
@@ -0,0 +1,9 @@
+#!/usr/bin/env zsh
+set -eu
+
+keyFile=${2%"-cert.pub"}.pub
+principalsFile=${keyFile:h}/host-principals
+gup -u ${keyFile} ${principalsFile}
+gup -u expiration
+
+ssh-keygen -h -Us ../ca/ca.pub -I $(uuidgen) -z $(tai64dec) -V "-1d:$(cat expiration)" -n $(cat ${principalsFile}) -f $1 ${keyFile}
\ No newline at end of file
diff --git a/system-profiles/openssh/known-hosts/expiration.gup b/system-profiles/openssh/known-hosts/expiration.gup
new file mode 100644
index 00000000..c8169262
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/expiration.gup
@@ -0,0 +1,12 @@
+#!/usr/bin/env zsh
+set -eu
+
+year=$(date +'%Y')
+while [[ $((($(date -d "${year}0101" +'%s') - $(date +'%s')) / 86400)) -lt 150 ]]; do
+  year=$((year + 1))
+done
+
+echo "${year}0101" > $1
+
+gup --always
+gup --contents $1
\ No newline at end of file
diff --git a/system-profiles/openssh/known-hosts/sif.nix b/system-profiles/openssh/known-hosts/sif.nix
deleted file mode 100644
index 8326d389..00000000
--- a/system-profiles/openssh/known-hosts/sif.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-let
-  hostNames = ["sif.asgard.yggdrasil" "sif.faraday.asgard.yggdrasil" "sif.midgard.yggdrasil"];
-in {
-  rsa = {
-    inherit hostNames;
-    publicKey = ''
-      ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCeFqJep1CuWakcoiAkz4bSaHbAIwM89Er46o3KUpjCWGTmDmhJyBiG38pupcctH0awwElkX09GsNx230mTtjT6qcxN+vGsGMJIqFD+/7ZobSLJDHYCo6Jx23jZUjg1SqxYjwB5ooWGI61Vh6SaOy8WRrUn0q8rJyd9SEC+3tJlKO5QqRi/Vnwzj47m+YjGz2UlqJ9a4GeRh1O5SiGx5jd4a/VoeK1XJcW94XeWpPQdUGnVYUXZn9cwYVrogmXdr18ImnPxghsQg4xwS2A6KMjUw9m56XkqIq7vTslmL9JaYcjlSCHbsSVq9+Wu1oKxoyndN7Sim7SkAZwHFUEMBNlontBitgYl6z10VdKX739os6h07uXjGEs+mPk4/CkGZhvhnErV2T9FO+65jnU3mZkeX5tfJHqJ8PnDch2JD6O7+Mjpce4zs/x3mwH36peER6iiIBYGlSF0AlUDShdqj+fPWFu6gZ9piOAZ2L3YXDA0ulM6pL69SbulrUNOwtTy6LkBfKDwpaQK1KO1VOYBaKa7s+krOJXW18k+tpfo4aKSeTuwvykMPndKMKvxcsxNymkGo2AzLw017Qgshzv9rRbLNMBFd85S3krakGyBVL0HAVrAdkjvsWqj5FnHAjgBc1AZnZPbJu3g9/wm7k8rPMV0jxKMpW+zxjVFYDhFUWYp9w==
-    '';
-  };
-  ed25519 = {
-    inherit hostNames;
-    publicKey = ''
-      ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfiwlzGcNQjamtIwv7fmXnddjajraeovaM6gRNui1+v
-    '';
-  };
-}
diff --git a/system-profiles/openssh/known-hosts/sif/ed25519-cert.pub b/system-profiles/openssh/known-hosts/sif/ed25519-cert.pub
new file mode 100644
index 00000000..b27502d2
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/sif/ed25519-cert.pub
@@ -0,0 +1 @@
+ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIBCnP3j54kFxIKoWec6/srEmZkeGz2mTuJixCTT4y+ttAAAAIOfiwlzGcNQjamtIwv7fmXnddjajraeovaM6gRNui1+vQAAAAGIHpe8AAAACAAAAJGE4NTNmM2ExLTA0MzUtNDBiMy04NzgxLWYxZDkxZjU1ZmU3YQAAABEAAAANc2lmLnlnZ2RyYXNpbAAAAABiBlRlAAAAAGOwvvAAAAAAAAAAAAAAAAAAAAAzAAAAC3NzaC1lZDI1NTE5AAAAIC1t7HamptQ49VXtSZyRsaOuja5In1N0U9Ybdiu6ztziAAAAUwAAAAtzc2gtZWQyNTUxOQAAAEALCpwkVj4ZfDshL+b+lxRskj5lA7bffZOZQ8ZxyNnaAN8cZvuUzzuypLAkcHEZhOJVJkiTZYQSnjk8I3iuDg4I sif/ed25519.pub
diff --git a/system-profiles/openssh/known-hosts/sif/ed25519.pub b/system-profiles/openssh/known-hosts/sif/ed25519.pub
new file mode 100644
index 00000000..532f6694
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/sif/ed25519.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfiwlzGcNQjamtIwv7fmXnddjajraeovaM6gRNui1+v
diff --git a/system-profiles/openssh/known-hosts/sif/host-principals b/system-profiles/openssh/known-hosts/sif/host-principals
new file mode 100644
index 00000000..7f9156b4
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/sif/host-principals
@@ -0,0 +1 @@
+sif.yggdrasil
\ No newline at end of file
diff --git a/system-profiles/openssh/known-hosts/sif/rsa-cert.pub b/system-profiles/openssh/known-hosts/sif/rsa-cert.pub
new file mode 100644
index 00000000..201a4f86
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/sif/rsa-cert.pub
@@ -0,0 +1 @@
+ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1yc2EtY2VydC12MDFAb3BlbnNzaC5jb20AAAAg4XTmWbkyH6+3nLB86m96iWfJI7GqCjWQPP2BgTy74dYAAAADAQABAAACAQCeFqJep1CuWakcoiAkz4bSaHbAIwM89Er46o3KUpjCWGTmDmhJyBiG38pupcctH0awwElkX09GsNx230mTtjT6qcxN+vGsGMJIqFD+/7ZobSLJDHYCo6Jx23jZUjg1SqxYjwB5ooWGI61Vh6SaOy8WRrUn0q8rJyd9SEC+3tJlKO5QqRi/Vnwzj47m+YjGz2UlqJ9a4GeRh1O5SiGx5jd4a/VoeK1XJcW94XeWpPQdUGnVYUXZn9cwYVrogmXdr18ImnPxghsQg4xwS2A6KMjUw9m56XkqIq7vTslmL9JaYcjlSCHbsSVq9+Wu1oKxoyndN7Sim7SkAZwHFUEMBNlontBitgYl6z10VdKX739os6h07uXjGEs+mPk4/CkGZhvhnErV2T9FO+65jnU3mZkeX5tfJHqJ8PnDch2JD6O7+Mjpce4zs/x3mwH36peER6iiIBYGlSF0AlUDShdqj+fPWFu6gZ9piOAZ2L3YXDA0ulM6pL69SbulrUNOwtTy6LkBfKDwpaQK1KO1VOYBaKa7s+krOJXW18k+tpfo4aKSeTuwvykMPndKMKvxcsxNymkGo2AzLw017Qgshzv9rRbLNMBFd85S3krakGyBVL0HAVrAdkjvsWqj5FnHAjgBc1AZnZPbJu3g9/wm7k8rPMV0jxKMpW+zxjVFYDhFUWYp90AAAABiB6Y+AAAAAgAAACQ2ZGYzMjE0Yi04Y2M0LTRiOGEtYTFmMS1mZjFmNTI1MmRlNzYAAAARAAAADXNpZi55Z2dkcmFzaWwAAAAAYgZUtAAAAABjsL7wAAAAAAAAAAAAAAAAAAAAMwAAAAtzc2gtZWQyNTUxOQAAACAtbex2pqbUOPVV7UmckbGjro2uSJ9TdFPWG3Yrus7c4gAAAFMAAAALc3NoLWVkMjU1MTkAAABAVIm1QsbC4QMXKdgC115z6CYi+7hoZjpbCadc0xxN7w/hqJs84cmBEbc62FGN2EBEpT8lKcWW4beYD96Dd3ZLCg== sif/rsa.pub
diff --git a/system-profiles/openssh/known-hosts/sif/rsa.pub b/system-profiles/openssh/known-hosts/sif/rsa.pub
new file mode 100644
index 00000000..95556ed5
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/sif/rsa.pub
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCeFqJep1CuWakcoiAkz4bSaHbAIwM89Er46o3KUpjCWGTmDmhJyBiG38pupcctH0awwElkX09GsNx230mTtjT6qcxN+vGsGMJIqFD+/7ZobSLJDHYCo6Jx23jZUjg1SqxYjwB5ooWGI61Vh6SaOy8WRrUn0q8rJyd9SEC+3tJlKO5QqRi/Vnwzj47m+YjGz2UlqJ9a4GeRh1O5SiGx5jd4a/VoeK1XJcW94XeWpPQdUGnVYUXZn9cwYVrogmXdr18ImnPxghsQg4xwS2A6KMjUw9m56XkqIq7vTslmL9JaYcjlSCHbsSVq9+Wu1oKxoyndN7Sim7SkAZwHFUEMBNlontBitgYl6z10VdKX739os6h07uXjGEs+mPk4/CkGZhvhnErV2T9FO+65jnU3mZkeX5tfJHqJ8PnDch2JD6O7+Mjpce4zs/x3mwH36peER6iiIBYGlSF0AlUDShdqj+fPWFu6gZ9piOAZ2L3YXDA0ulM6pL69SbulrUNOwtTy6LkBfKDwpaQK1KO1VOYBaKa7s+krOJXW18k+tpfo4aKSeTuwvykMPndKMKvxcsxNymkGo2AzLw017Qgshzv9rRbLNMBFd85S3krakGyBVL0HAVrAdkjvsWqj5FnHAjgBc1AZnZPbJu3g9/wm7k8rPMV0jxKMpW+zxjVFYDhFUWYp9w==
diff --git a/system-profiles/openssh/known-hosts/surtr.nix b/system-profiles/openssh/known-hosts/surtr.nix
deleted file mode 100644
index 5f08474d..00000000
--- a/system-profiles/openssh/known-hosts/surtr.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-let
-  hostNames = ["surtr.yggdrasil" "surtr.yggdrasil.li"];
-in {
-  dsa = {
-    inherit hostNames;
-    publicKey = ''
-      ssh-dss AAAAB3NzaC1kc3MAAACBAIgY3WWK/yD1QzQMako4FDkD22YODiCA/d7Ga14xpx7ujSPQJ0PqFd1aTPhrEZdy6pMnL82chGJD/oeurAacBxeuUouKvr10vtpaDJpcvqr/9m4zsx0OSeHl9M5PuSumjEXL/bsF/QSeo9Vp8uznLgHP/oglP8OI4Qsdh/0wisK1AAAAFQD04cH0JaWgJEUePcuYd02KW7t4aQAAAIBkFCGDPkJedRdJRy+l2OW6H7XdCQnA814cWOGaUItw5IVWz6KlVGPlETrBtRJhrgiwApy1Sk2rHxmuHCirAFS6FCZ5ct5wHKV2L/1CDphJzsYql9hUBTgevEpuAg9Kn1WjtcV+t+3LO9URD64BKHzpvtM2I5hAU4Zu6G2OV150MQAAAIB7B3lRZBxkDfb5x4cjitzFXN3FUzBcl0SD6/TJ+TH2lbTONMIXdT9zHw5BfEz3ObcScxCT2g99bvkxDwPNFRAorLAlEhCYB2zUV5QnJd8ZpIB3AFbokUxq+Q8fs5tU16Wv9TQ4oYmY3m9UAEqVz6ph562Ss+axO9qfSlNZX8feGA==
-    '';
-  };
-  ecdsa = {
-    inherit hostNames;
-    publicKey = ''
-      ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKLjbW8GWc7dF8HD8QrFZpZJop2xvFgvZnYfIl/slFASvphD6MBOHq3jx0+Tuk51xd4mvByTwoh8eokLZJidkZQ=
-    '';
-  };
-  ed25519 = {
-    inherit hostNames;
-    publicKey = ''
-      ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO2LOAbV3XuAqJpXVY+YUnLIbhRsmAUmVQT3MioXGGgj
-    '';
-  };
-  rsa = {
-    inherit hostNames;
-    publicKey = ''
-      ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQClFn6IDsDjuLXpThBtrRj+HLkNAwuBc4BgNqqIXkSRXy1FhDVgdI2iXKnJJLT/MWBMz73+QEYI+nDV6cxMCu292sZal+EAkyXJG6gQ9/rboucTuMWosrifAYabY4jUY79vYOiQGHG3XMIVjTQE8dRoXASzPKcok7PHftuW2qUu6ti7s3tqxY89Ez0cUz7jIECR7zHpIHZQbPd7z9luWOwZZc/eUGGWSxxz6idSPi/Adjk4FS56kIBk/uq9bZ8ylE/nwuJFUV90GzIr2nIQAcg6UVjYkw22+tA8BKzkS5Kx9ur7jVAhgs1qavKGnkYBuE4MvfjDzrkxRtlIPOjUQ3uuqYXkkkdMCooDl6+oKvN8dug6+cMdXn3/Q63cA0ols5rJz8iAtBoPRI8b835BWZcYHCk2aF2xT5hmB+GVhnFRZP8p9cRlr0jhYRjJKp80gTT7BPlMAQ0Sfmz5jLPd7X9yInKXCXdzxLTWvGqDq4GpunWVR6rgDMq5AswIcNhcwCc=
-    '';
-  };
-}
diff --git a/system-profiles/openssh/known-hosts/surtr/ed25519-cert.pub b/system-profiles/openssh/known-hosts/surtr/ed25519-cert.pub
new file mode 100644
index 00000000..23bb41e8
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/surtr/ed25519-cert.pub
@@ -0,0 +1 @@
+ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIAQK6fyRzCbFzDxDdQ0SLL4VD0XlvZI1hNIwA3/sjWrfAAAAIO2LOAbV3XuAqJpXVY+YUnLIbhRsmAUmVQT3MioXGGgjQAAAAGIHpj8AAAACAAAAJGIyZDIzNDQzLWMwNjEtNGUxZC04OTc5LWM5ZjUwNWNjOTBiMAAAACkAAAAPc3VydHIueWdnZHJhc2lsAAAAEnN1cnRyLnlnZ2RyYXNpbC5saQAAAABiBlS1AAAAAGOwvvAAAAAAAAAAAAAAAAAAAAAzAAAAC3NzaC1lZDI1NTE5AAAAIC1t7HamptQ49VXtSZyRsaOuja5In1N0U9Ybdiu6ztziAAAAUwAAAAtzc2gtZWQyNTUxOQAAAECmpaSkdzjwOQpQ8TS57TLUE3pERmmnC3ADkWur5sKtAJOADtrAlj1Lz4Ju39ew1LKalkLlpwd2ZUfl0+/U0qwA surtr/ed25519.pub
diff --git a/system-profiles/openssh/known-hosts/surtr/ed25519.pub b/system-profiles/openssh/known-hosts/surtr/ed25519.pub
new file mode 100644
index 00000000..d972c5b9
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/surtr/ed25519.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO2LOAbV3XuAqJpXVY+YUnLIbhRsmAUmVQT3MioXGGgj
diff --git a/system-profiles/openssh/known-hosts/surtr/host-principals b/system-profiles/openssh/known-hosts/surtr/host-principals
new file mode 100644
index 00000000..ac8e9c53
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/surtr/host-principals
@@ -0,0 +1 @@
+surtr.yggdrasil,surtr.yggdrasil.li
\ No newline at end of file
diff --git a/system-profiles/openssh/known-hosts/surtr/rsa-cert.pub b/system-profiles/openssh/known-hosts/surtr/rsa-cert.pub
new file mode 100644
index 00000000..d0761088
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/surtr/rsa-cert.pub
@@ -0,0 +1 @@
+ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1yc2EtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgHiB84BX5OqjCKkD5V6ZvuWFEJo67U12OFAv7Qobp55QAAAADAQABAAABgQClFn6IDsDjuLXpThBtrRj+HLkNAwuBc4BgNqqIXkSRXy1FhDVgdI2iXKnJJLT/MWBMz73+QEYI+nDV6cxMCu292sZal+EAkyXJG6gQ9/rboucTuMWosrifAYabY4jUY79vYOiQGHG3XMIVjTQE8dRoXASzPKcok7PHftuW2qUu6ti7s3tqxY89Ez0cUz7jIECR7zHpIHZQbPd7z9luWOwZZc/eUGGWSxxz6idSPi/Adjk4FS56kIBk/uq9bZ8ylE/nwuJFUV90GzIr2nIQAcg6UVjYkw22+tA8BKzkS5Kx9ur7jVAhgs1qavKGnkYBuE4MvfjDzrkxRtlIPOjUQ3uuqYXkkkdMCooDl6+oKvN8dug6+cMdXn3/Q63cA0ols5rJz8iAtBoPRI8b835BWZcYHCk2aF2xT5hmB+GVhnFRZP8p9cRlr0jhYRjJKp80gTT7BPlMAQ0Sfmz5jLPd7X9yInKXCXdzxLTWvGqDq4GpunWVR6rgDMq5AswIcNhcwCdAAAAAYgemQQAAAAIAAAAkMDViYWI5Y2MtZTY2MS00YzE4LWFkMDktMzZiOTYwYmQ4ZTE5AAAAKQAAAA9zdXJ0ci55Z2dkcmFzaWwAAAASc3VydHIueWdnZHJhc2lsLmxpAAAAAGIGVLcAAAAAY7C+8AAAAAAAAAAAAAAAAAAAADMAAAALc3NoLWVkMjU1MTkAAAAgLW3sdqam1Dj1Ve1JnJGxo66NrkifU3RT1ht2K7rO3OIAAABTAAAAC3NzaC1lZDI1NTE5AAAAQAPniQamYBJmBZvObcINQUC7YGZW85w1tlMkfep3gJ8D0sWQKx2RFhdLsTkTpEfoHGHWk+9sabeClBgCANsWmAg= surtr/rsa.pub
diff --git a/system-profiles/openssh/known-hosts/surtr/rsa.pub b/system-profiles/openssh/known-hosts/surtr/rsa.pub
new file mode 100644
index 00000000..078c0b50
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/surtr/rsa.pub
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQClFn6IDsDjuLXpThBtrRj+HLkNAwuBc4BgNqqIXkSRXy1FhDVgdI2iXKnJJLT/MWBMz73+QEYI+nDV6cxMCu292sZal+EAkyXJG6gQ9/rboucTuMWosrifAYabY4jUY79vYOiQGHG3XMIVjTQE8dRoXASzPKcok7PHftuW2qUu6ti7s3tqxY89Ez0cUz7jIECR7zHpIHZQbPd7z9luWOwZZc/eUGGWSxxz6idSPi/Adjk4FS56kIBk/uq9bZ8ylE/nwuJFUV90GzIr2nIQAcg6UVjYkw22+tA8BKzkS5Kx9ur7jVAhgs1qavKGnkYBuE4MvfjDzrkxRtlIPOjUQ3uuqYXkkkdMCooDl6+oKvN8dug6+cMdXn3/Q63cA0ols5rJz8iAtBoPRI8b835BWZcYHCk2aF2xT5hmB+GVhnFRZP8p9cRlr0jhYRjJKp80gTT7BPlMAQ0Sfmz5jLPd7X9yInKXCXdzxLTWvGqDq4GpunWVR6rgDMq5AswIcNhcwCc=
diff --git a/system-profiles/openssh/known-hosts/vidhar.nix b/system-profiles/openssh/known-hosts/vidhar.nix
deleted file mode 100644
index 0e4b784e..00000000
--- a/system-profiles/openssh/known-hosts/vidhar.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-let
-  hostNames = ["192.168.2.168" "vidhar.yggdrasil" "vidhar.yggdrasil.li"];
-in {
-  rsa = {
-    inherit hostNames;
-    publicKey = ''
-      ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCopJQaFGSf5/FioXnjppVvzqAxW8/Hcr9xpCpj1WDn5hZoKCzyPmZet43ATG7IxHtEXK1O+FfIN7HUDlPrfOEiw/1W8j/fzFCsjXC/c5031wBaPmBpf0uXOGjuJ2INps7qPfOUqfWKYIKgmdk4Sr2vjRxpSoO08mPgECVwWYDBfRrZD3RYVls9NSW3GZFsCOHNUVxV1O112EFbwzyJUDVpTWqF5uSmW5HD7zAhHRs96q1AiOo7rQ9LfYD51Hc/0XkbUQ+wi9jxZwhwsBmEMMGFVRPGBOXqN5x4DItY8hpzq3h4WJEHvGdtRg89TxBeRIV96six0ThA9aS5JrND6DWOgEueoOv0WnLPswUh/+jg6hnECYW0mg7SbxInU/qESFxYp9jRjErQxThwM4u0fuE2+8LR3cB7Ui2GkjuQvvgI/LTHXucy7nTK9Fm87NDSx7oMyCBu8+I/8wntHD4s2SMvGi+BBI5i2dH+VBEoZEbi58DLZa+bwzfuAj+h46DNdR8=
-    '';
-  };
-  ed25519 = {
-    inherit hostNames;
-    publicKey = ''
-      ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKHGEME8AQDpXnDuI2G4aruVnz3of37+ZgXJh85h8Frq
-    '';
-  };
-}
diff --git a/system-profiles/openssh/known-hosts/vidhar/ed25519-cert.pub b/system-profiles/openssh/known-hosts/vidhar/ed25519-cert.pub
new file mode 100644
index 00000000..adb2db7a
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/vidhar/ed25519-cert.pub
@@ -0,0 +1 @@
+ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIJw+mpMw6Oi54ijwamx0+bIcDvIQAfzdztCsk7WCh0K7AAAAIKHGEME8AQDpXnDuI2G4aruVnz3of37+ZgXJh85h8FrqQAAAAGIHpkMAAAACAAAAJDRlOTBjMWQ4LTk2ZmItNDlmNC04OTA1LTk4MmExZDBmNzU3NgAAACsAAAATdmlkaGFyLnlnZ2RyYXNpbC5saQAAABB2aWRoYXIueWdnZHJhc2lsAAAAAGIGVLkAAAAAY7C+8AAAAAAAAAAAAAAAAAAAADMAAAALc3NoLWVkMjU1MTkAAAAgLW3sdqam1Dj1Ve1JnJGxo66NrkifU3RT1ht2K7rO3OIAAABTAAAAC3NzaC1lZDI1NTE5AAAAQDNXe2wt0RFSnn2fkLh1QEBGJub0xKii1DbtbZvk4Pu9NVbPh9DAZ6LNgcSlb1Leo4uLfP8+11G5TAMNCLQu4gc= vidhar/ed25519.pub
diff --git a/system-profiles/openssh/known-hosts/vidhar/ed25519.pub b/system-profiles/openssh/known-hosts/vidhar/ed25519.pub
new file mode 100644
index 00000000..63146e47
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/vidhar/ed25519.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKHGEME8AQDpXnDuI2G4aruVnz3of37+ZgXJh85h8Frq
diff --git a/system-profiles/openssh/known-hosts/vidhar/host-principals b/system-profiles/openssh/known-hosts/vidhar/host-principals
new file mode 100644
index 00000000..2c778e1a
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/vidhar/host-principals
@@ -0,0 +1 @@
+vidhar.yggdrasil.li,vidhar.yggdrasil
\ No newline at end of file
diff --git a/system-profiles/openssh/known-hosts/vidhar/rsa-cert.pub b/system-profiles/openssh/known-hosts/vidhar/rsa-cert.pub
new file mode 100644
index 00000000..7ff7c9cc
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/vidhar/rsa-cert.pub
@@ -0,0 +1 @@
+ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1yc2EtY2VydC12MDFAb3BlbnNzaC5jb20AAAAg3crwfqBj13EfGAezc4gwGf6DALho+jkFSVoZ5PrKN0IAAAADAQABAAABgQCopJQaFGSf5/FioXnjppVvzqAxW8/Hcr9xpCpj1WDn5hZoKCzyPmZet43ATG7IxHtEXK1O+FfIN7HUDlPrfOEiw/1W8j/fzFCsjXC/c5031wBaPmBpf0uXOGjuJ2INps7qPfOUqfWKYIKgmdk4Sr2vjRxpSoO08mPgECVwWYDBfRrZD3RYVls9NSW3GZFsCOHNUVxV1O112EFbwzyJUDVpTWqF5uSmW5HD7zAhHRs96q1AiOo7rQ9LfYD51Hc/0XkbUQ+wi9jxZwhwsBmEMMGFVRPGBOXqN5x4DItY8hpzq3h4WJEHvGdtRg89TxBeRIV96six0ThA9aS5JrND6DWOgEueoOv0WnLPswUh/+jg6hnECYW0mg7SbxInU/qESFxYp9jRjErQxThwM4u0fuE2+8LR3cB7Ui2GkjuQvvgI/LTHXucy7nTK9Fm87NDSx7oMyCBu8+I/8wntHD4s2SMvGi+BBI5i2dH+VBEoZEbi58DLZa+bwzfuAj+h46DNdR9AAAAAYgemRAAAAAIAAAAkODQwMjY2N2ItY2YyYy00MDM2LWI3YmEtM2E0MTBkOTYxN2Q4AAAAKwAAABN2aWRoYXIueWdnZHJhc2lsLmxpAAAAEHZpZGhhci55Z2dkcmFzaWwAAAAAYgZUugAAAABjsL7wAAAAAAAAAAAAAAAAAAAAMwAAAAtzc2gtZWQyNTUxOQAAACAtbex2pqbUOPVV7UmckbGjro2uSJ9TdFPWG3Yrus7c4gAAAFMAAAALc3NoLWVkMjU1MTkAAABAUfd4GP/toabf6XHInr9cRdszVZCfLolsB2NnuCVD/hZ3k6hvCrTtqhGzBpWj1CeJ65bTWo5ZQkbOrm4r9S9lBA== vidhar/rsa.pub
diff --git a/system-profiles/openssh/known-hosts/vidhar/rsa.pub b/system-profiles/openssh/known-hosts/vidhar/rsa.pub
new file mode 100644
index 00000000..c4974543
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/vidhar/rsa.pub
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCopJQaFGSf5/FioXnjppVvzqAxW8/Hcr9xpCpj1WDn5hZoKCzyPmZet43ATG7IxHtEXK1O+FfIN7HUDlPrfOEiw/1W8j/fzFCsjXC/c5031wBaPmBpf0uXOGjuJ2INps7qPfOUqfWKYIKgmdk4Sr2vjRxpSoO08mPgECVwWYDBfRrZD3RYVls9NSW3GZFsCOHNUVxV1O112EFbwzyJUDVpTWqF5uSmW5HD7zAhHRs96q1AiOo7rQ9LfYD51Hc/0XkbUQ+wi9jxZwhwsBmEMMGFVRPGBOXqN5x4DItY8hpzq3h4WJEHvGdtRg89TxBeRIV96six0ThA9aS5JrND6DWOgEueoOv0WnLPswUh/+jg6hnECYW0mg7SbxInU/qESFxYp9jRjErQxThwM4u0fuE2+8LR3cB7Ui2GkjuQvvgI/LTHXucy7nTK9Fm87NDSx7oMyCBu8+I/8wntHD4s2SMvGi+BBI5i2dH+VBEoZEbi58DLZa+bwzfuAj+h46DNdR8=
diff --git a/system-profiles/openssh/known-hosts/ymir.nix b/system-profiles/openssh/known-hosts/ymir.nix
deleted file mode 100644
index f29baf1d..00000000
--- a/system-profiles/openssh/known-hosts/ymir.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-let
-  hostNames = ["ymir.yggdrasil.li" "ymir.niflheim.yggdrasil"];
-in {
-  rsa = {
-    inherit hostNames;
-    publicKey = ''
-      ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDNr7oFNneR3sVuAhdbnU83PuG6gTU6rDmiz+qykkRUr5Qdtm0NIr9lI7nhoO/MaALWmkMXsBGjvJ2UxvY959g0wQRHJZnuJDwOMo3YJjfuDGMTtp8ikzd646uMHQB+y/xb4dou6f0INr94eRsZcji7AQgZQnyWVV3DZuSADBfNK0Tx6sT6IdbJXaCwYoexnfSfzDdu3i5zMuReF4zdkFUEfAdcbOM8Cr0Abnn4+iLVrof/QaOEuZDC+Pf5QUhkAArETdavSCUIbV6+1md0jz/T8yalgrTCsYOoEUbSPwM/8vmiYDWSo/tvAf3KnVIPjjK2UFz7Qu0HyK0y1dBEXoYLGZ1ep4x67aE4zy7GlR2GZdAYilHknugZB+/kvYGDEixHFfcUh/uvF5PY8sm63C6HUBT1s/aQHXGHgE4uUru6YvbU3UW3fRdslABY/atZ9gc3MuKu9Zk27b1SYfAAoK1R8rKsOKWqUWvvMVCfKBNKqqb7+30q75iGeneB8Tb1C9lToyDG2Yl5p+Gpfnj8YmaU/xFm0HFEC42crRbaQyz01LmupHWf8VwH/O2LsjztAF9b4Oe2q/NwqQAF+h5hIm2tfM2fzxHGCmw1sFYf6dEdkyV5pge/IJrnuQn27iO06tRC6tvrt/ocbpwEEOk/3WWpAWW4oT8L5ceh7iAXrCRWpw==
-    '';
-  };
-  ed25519 = {
-    inherit hostNames;
-    publicKey = ''
-      ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDeBBux2bIXnS/RUv+Y/NCpzI/SCW0KOJSzf48KDiEZD
-    '';
-  };
-}
diff --git a/system-profiles/openssh/known-hosts/ymir/ed25519-cert.pub b/system-profiles/openssh/known-hosts/ymir/ed25519-cert.pub
new file mode 100644
index 00000000..83ec913e
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/ymir/ed25519-cert.pub
@@ -0,0 +1 @@
+ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAICUd5T+t6Giaq52opNtwkdA/h6DDVMV5mSAwmUY2U9cTAAAAIDeBBux2bIXnS/RUv+Y/NCpzI/SCW0KOJSzf48KDiEZDQAAAAGIHpkUAAAACAAAAJGQ5NmYwYWY1LTBjYjUtNDM1Zi1hYTFlLTc5ZjFhMjVlOTcyMAAAABUAAAAReW1pci55Z2dkcmFzaWwubGkAAAAAYgZUuwAAAABjsL7wAAAAAAAAAAAAAAAAAAAAMwAAAAtzc2gtZWQyNTUxOQAAACAtbex2pqbUOPVV7UmckbGjro2uSJ9TdFPWG3Yrus7c4gAAAFMAAAALc3NoLWVkMjU1MTkAAABAorc2x49gJECkdwOjFrpSVKGpG/eapaFTFjNE0KIt+BUidQn821ort2lV+ycdZKO8XvWsFjzfCvdIMakpnDB9BA== ymir/ed25519.pub
diff --git a/system-profiles/openssh/known-hosts/ymir/ed25519.pub b/system-profiles/openssh/known-hosts/ymir/ed25519.pub
new file mode 100644
index 00000000..aaf4b012
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/ymir/ed25519.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDeBBux2bIXnS/RUv+Y/NCpzI/SCW0KOJSzf48KDiEZD
diff --git a/system-profiles/openssh/known-hosts/ymir/host-principals b/system-profiles/openssh/known-hosts/ymir/host-principals
new file mode 100644
index 00000000..7c4e9d7c
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/ymir/host-principals
@@ -0,0 +1 @@
+ymir.yggdrasil.li
\ No newline at end of file
diff --git a/system-profiles/openssh/known-hosts/ymir/rsa-cert.pub b/system-profiles/openssh/known-hosts/ymir/rsa-cert.pub
new file mode 100644
index 00000000..f2d60979
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/ymir/rsa-cert.pub
@@ -0,0 +1 @@
+ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1yc2EtY2VydC12MDFAb3BlbnNzaC5jb20AAAAg9cWaz1e9vLZV008c3egsA3xB56YLxvExYAzLBKN/nSoAAAADAQABAAACAQDNr7oFNneR3sVuAhdbnU83PuG6gTU6rDmiz+qykkRUr5Qdtm0NIr9lI7nhoO/MaALWmkMXsBGjvJ2UxvY959g0wQRHJZnuJDwOMo3YJjfuDGMTtp8ikzd646uMHQB+y/xb4dou6f0INr94eRsZcji7AQgZQnyWVV3DZuSADBfNK0Tx6sT6IdbJXaCwYoexnfSfzDdu3i5zMuReF4zdkFUEfAdcbOM8Cr0Abnn4+iLVrof/QaOEuZDC+Pf5QUhkAArETdavSCUIbV6+1md0jz/T8yalgrTCsYOoEUbSPwM/8vmiYDWSo/tvAf3KnVIPjjK2UFz7Qu0HyK0y1dBEXoYLGZ1ep4x67aE4zy7GlR2GZdAYilHknugZB+/kvYGDEixHFfcUh/uvF5PY8sm63C6HUBT1s/aQHXGHgE4uUru6YvbU3UW3fRdslABY/atZ9gc3MuKu9Zk27b1SYfAAoK1R8rKsOKWqUWvvMVCfKBNKqqb7+30q75iGeneB8Tb1C9lToyDG2Yl5p+Gpfnj8YmaU/xFm0HFEC42crRbaQyz01LmupHWf8VwH/O2LsjztAF9b4Oe2q/NwqQAF+h5hIm2tfM2fzxHGCmw1sFYf6dEdkyV5pge/IJrnuQn27iO06tRC6tvrt/ocbpwEEOk/3WWpAWW4oT8L5ceh7iAXrCRWp0AAAABiB6ZGAAAAAgAAACRiZTBlYjg0MS0xNmEyLTQwY2MtYjQwNy02Nzc3MzVmZTg1ODkAAAAVAAAAEXltaXIueWdnZHJhc2lsLmxpAAAAAGIGVLwAAAAAY7C+8AAAAAAAAAAAAAAAAAAAADMAAAALc3NoLWVkMjU1MTkAAAAgLW3sdqam1Dj1Ve1JnJGxo66NrkifU3RT1ht2K7rO3OIAAABTAAAAC3NzaC1lZDI1NTE5AAAAQMHTfT5Y+8BLsPFfhsQwGbyrd6ufCph8WGTTH8e8D/FhFApIjPCnCuZJVOXrmdRAzc7BXFnJBBOX34Z7o8Y30wA= ymir/rsa.pub
diff --git a/system-profiles/openssh/known-hosts/ymir/rsa.pub b/system-profiles/openssh/known-hosts/ymir/rsa.pub
new file mode 100644
index 00000000..7748d3a1
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/ymir/rsa.pub
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDNr7oFNneR3sVuAhdbnU83PuG6gTU6rDmiz+qykkRUr5Qdtm0NIr9lI7nhoO/MaALWmkMXsBGjvJ2UxvY959g0wQRHJZnuJDwOMo3YJjfuDGMTtp8ikzd646uMHQB+y/xb4dou6f0INr94eRsZcji7AQgZQnyWVV3DZuSADBfNK0Tx6sT6IdbJXaCwYoexnfSfzDdu3i5zMuReF4zdkFUEfAdcbOM8Cr0Abnn4+iLVrof/QaOEuZDC+Pf5QUhkAArETdavSCUIbV6+1md0jz/T8yalgrTCsYOoEUbSPwM/8vmiYDWSo/tvAf3KnVIPjjK2UFz7Qu0HyK0y1dBEXoYLGZ1ep4x67aE4zy7GlR2GZdAYilHknugZB+/kvYGDEixHFfcUh/uvF5PY8sm63C6HUBT1s/aQHXGHgE4uUru6YvbU3UW3fRdslABY/atZ9gc3MuKu9Zk27b1SYfAAoK1R8rKsOKWqUWvvMVCfKBNKqqb7+30q75iGeneB8Tb1C9lToyDG2Yl5p+Gpfnj8YmaU/xFm0HFEC42crRbaQyz01LmupHWf8VwH/O2LsjztAF9b4Oe2q/NwqQAF+h5hIm2tfM2fzxHGCmw1sFYf6dEdkyV5pge/IJrnuQn27iO06tRC6tvrt/ocbpwEEOk/3WWpAWW4oT8L5ceh7iAXrCRWpw==