openssh: certificate authority

36 files changed, 88 insertions, 92 deletions

diff --git a/system-profiles/openssh/ca/.gitignore b/system-profiles/openssh/ca/.gitignore
new file mode 100644
index 00000000..d6fbf779
--- /dev/null
+++ b/system-profiles/openssh/ca/.gitignore
@@ -0,0 +1 @@
+krl.contents
\ No newline at end of file
diff --git a/system-profiles/openssh/ca/ca.pub b/system-profiles/openssh/ca/ca.pub
new file mode 100644
index 00000000..7ca56060
--- /dev/null
+++ b/system-profiles/openssh/ca/ca.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC1t7HamptQ49VXtSZyRsaOuja5In1N0U9Ybdiu6ztzi ca.yggdrasil
diff --git a/system-profiles/openssh/ca/krl.bin b/system-profiles/openssh/ca/krl.bin
new file mode 100644
index 00000000..3f04c994
--- /dev/null
+++ b/system-profiles/openssh/ca/krl.bin
diff --git a/system-profiles/openssh/ca/krl.bin.gup b/system-profiles/openssh/ca/krl.bin.gup
new file mode 100755
index 00000000..30f3b9ba
--- /dev/null
+++ b/system-profiles/openssh/ca/krl.bin.gup
@@ -0,0 +1,6 @@
+#!/usr/bin/env zsh
+set -eu
+
+gup -u krl.contents
+
+xargs -0 -- ssh-keygen -h -Us ca.pub -k -z $(tai64dec) -f $1 <krl.contents
\ No newline at end of file
diff --git a/system-profiles/openssh/ca/krl.contents.gup b/system-profiles/openssh/ca/krl.contents.gup
new file mode 100644
index 00000000..7cc0426f
--- /dev/null
+++ b/system-profiles/openssh/ca/krl.contents.gup
@@ -0,0 +1,7 @@
+#!/usr/bin/env zsh
+set -eu
+
+find krl -type f -print0 > $1
+
+gup --always
+xargs -0 -- b2sum <$1 | gup --contents
diff --git a/system-profiles/openssh/ca/krl/low-serial b/system-profiles/openssh/ca/krl/low-serial
new file mode 100644
index 00000000..17b4924e
--- /dev/null
+++ b/system-profiles/openssh/ca/krl/low-serial
@@ -0,0 +1 @@
+serial: 1-4611686020072056302
diff --git a/system-profiles/openssh/ca/krl/test-idents b/system-profiles/openssh/ca/krl/test-idents
new file mode 100644
index 00000000..cf847c77
--- /dev/null
+++ b/system-profiles/openssh/ca/krl/test-idents
@@ -0,0 +1 @@
+id: edf5ee6e-a240-4eae-beb2-d4a40215f461
\ No newline at end of file
diff --git a/system-profiles/openssh/default.nix b/system-profiles/openssh/default.nix
index d54ea6f3..048a948f 100644
--- a/system-profiles/openssh/default.nix
+++ b/system-profiles/openssh/default.nix
@@ -1,33 +1,39 @@
 { customUtils, lib, config, hostName, pkgs, ... }:
 {
   config = {
-    programs.ssh.knownHosts = lib.zipAttrsWith (_name: values: builtins.head values) (lib.mapAttrsToList (name: lib.mapAttrs' (type: value: lib.nameValuePair "${name}-${type}" value)) (customUtils.nixImport { dir = ./known-hosts; }));
-    programs.ssh.knownHostsFiles = [
-      ./known-hosts/borgbase.keys
-    ];
-
     systemd.user.services."ssh-agent".enable = lib.mkForce false; # ssh-agent should be done via home-manager
 
     services.openssh = lib.mkIf config.services.openssh.enable {
-      hostKeys = [
-        { path = "/etc/ssh/ssh_host_rsa_key";
-          type = "rsa";
-        }
-        { path = "/etc/ssh/ssh_host_ed25519_key";
-          type = "ed25519";
-        }
-      ];
+      hostKeys = lib.mkForce []; # done manually
       ciphers = [ "chacha20-poly1305@openssh.com" "aes256-gcm@openssh.com" "aes256-ctr" ];
       macs = [ "hmac-sha2-256-etm@openssh.com" "hmac-sha2-256" "hmac-sha2-512-etm@openssh.com" "hmac-sha2-512" ];
       kexAlgorithms = [ "curve25519-sha256@libssh.org" "diffie-hellman-group-exchange-sha256" ];
       moduliFile = config.sops.secrets.ssh_moduli.path;
       extraConfig = ''
         HostKeyAlgorithms sk-ssh-ed25519-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-256,rsa-sha2-512
+        CASignatureAlgorithms sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-256,rsa-sha2-512
+
+        HostKey /etc/ssh/ssh_host_ed25519_key
+        HostCertificate /etc/ssh/ssh_host_ed25519_key-cert.pub
+        HostKey /etc/ssh/ssh_host_rsa_key
+        HostCertificate /etc/ssh/ssh_host_rsa_key-cert.pub
+        RevokedKeys /etc/ssh/krl.bin
       '';
       logLevel = "VERBOSE";
     };
 
     programs.ssh = {
+      knownHosts = {
+        "*.yggdrasil.li" = {
+          extraHostNames = ["*.yggdrasil"];
+          certAuthority = true;
+          publicKeyFile = ./ca/ca.pub;
+        };
+      };
+      knownHostsFiles = [
+        ./known-hosts/borgbase.keys
+      ];
+
       ciphers = [ "chacha20-poly1305@openssh.com" "aes256-gcm@openssh.com" "aes256-ctr" ];
       hostKeyAlgorithms = [ "sk-ssh-ed25519-cert-v01@openssh.com" "ssh-ed25519-cert-v01@openssh.com" "rsa-sha2-256-cert-v01@openssh.com" "rsa-sha2-512-cert-v01@openssh.com" "sk-ssh-ed25519@openssh.com" "ssh-ed25519" "rsa-sha2-256" "rsa-sha2-512" ];
       kexAlgorithms = [ "curve25519-sha256@libssh.org" "diffie-hellman-group-exchange-sha256" ];
@@ -35,7 +41,7 @@
       pubkeyAcceptedKeyTypes = [ "ssh-ed25519" "ssh-rsa" ];
       extraConfig = ''
         Host *
-          UseRoaming no
+          CASignatureAlgorithms sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-256,rsa-sha2-512
       '';
     };
 
@@ -58,8 +64,13 @@
     };
 
     environment.etc = lib.mkIf config.services.openssh.enable {
-      "ssh/ssh_host_rsa_key.pub".text = config.services.openssh.knownHosts."${hostName}-rsa".publicKey;
-      "ssh/ssh_host_ed25519_key.pub".text = config.services.openssh.knownHosts."${hostName}-ed25519".publicKey;
+      "ssh/ssh_host_rsa_key.pub".source = ./known-hosts + "/${hostName}/rsa.pub";
+      "ssh/ssh_host_ed25519_key.pub".source = ./known-hosts + "/${hostName}/ed25519.pub";
+
+      "ssh/ssh_host_rsa_key-cert.pub".source = ./known-hosts + "/${hostName}/rsa-cert.pub";
+      "ssh/ssh_host_ed25519_key-cert.pub".source = ./known-hosts + "/${hostName}/ed25519-cert.pub";
+
+      "ssh/krl.bin".source = ./ca/krl.bin;
     };
 
     environment.systemPackages = lib.mkIf config.services.openssh.enable (with pkgs; [
diff --git a/system-profiles/openssh/known-hosts/.gitignore b/system-profiles/openssh/known-hosts/.gitignore
new file mode 100644
index 00000000..5528ec64
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/.gitignore
@@ -0,0 +1 @@
+expiration
\ No newline at end of file
diff --git a/system-profiles/openssh/known-hosts/Gupfile b/system-profiles/openssh/known-hosts/Gupfile
new file mode 100644
index 00000000..9217f43f
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/Gupfile
@@ -0,0 +1,2 @@
+ca-sign.gup:
+  **/*-cert.pub
\ No newline at end of file
diff --git a/system-profiles/openssh/known-hosts/ca-sign.gup b/system-profiles/openssh/known-hosts/ca-sign.gup
new file mode 100644
index 00000000..512f0e84
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/ca-sign.gup
@@ -0,0 +1,9 @@
+#!/usr/bin/env zsh
+set -eu
+
+keyFile=${2%"-cert.pub"}.pub
+principalsFile=${keyFile:h}/host-principals
+gup -u ${keyFile} ${principalsFile}
+gup -u expiration
+
+ssh-keygen -h -Us ../ca/ca.pub -I $(uuidgen) -z $(tai64dec) -V "-1d:$(cat expiration)" -n $(cat ${principalsFile}) -f $1 ${keyFile}
\ No newline at end of file
diff --git a/system-profiles/openssh/known-hosts/expiration.gup b/system-profiles/openssh/known-hosts/expiration.gup
new file mode 100644
index 00000000..c8169262
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/expiration.gup
@@ -0,0 +1,12 @@
+#!/usr/bin/env zsh
+set -eu
+
+year=$(date +'%Y')
+while [[ $((($(date -d "${year}0101" +'%s') - $(date +'%s')) / 86400)) -lt 150 ]]; do
+  year=$((year + 1))
+done
+
+echo "${year}0101" > $1
+
+gup --always
+gup --contents $1
\ No newline at end of file
diff --git a/system-profiles/openssh/known-hosts/sif.nix b/system-profiles/openssh/known-hosts/sif.nix
deleted file mode 100644
index 8326d389..00000000
--- a/system-profiles/openssh/known-hosts/sif.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-let
-  hostNames = ["sif.asgard.yggdrasil" "sif.faraday.asgard.yggdrasil" "sif.midgard.yggdrasil"];
-in {
-  rsa = {
-    inherit hostNames;
-    publicKey = ''
-      ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCeFqJep1CuWakcoiAkz4bSaHbAIwM89Er46o3KUpjCWGTmDmhJyBiG38pupcctH0awwElkX09GsNx230mTtjT6qcxN+vGsGMJIqFD+/7ZobSLJDHYCo6Jx23jZUjg1SqxYjwB5ooWGI61Vh6SaOy8WRrUn0q8rJyd9SEC+3tJlKO5QqRi/Vnwzj47m+YjGz2UlqJ9a4GeRh1O5SiGx5jd4a/VoeK1XJcW94XeWpPQdUGnVYUXZn9cwYVrogmXdr18ImnPxghsQg4xwS2A6KMjUw9m56XkqIq7vTslmL9JaYcjlSCHbsSVq9+Wu1oKxoyndN7Sim7SkAZwHFUEMBNlontBitgYl6z10VdKX739os6h07uXjGEs+mPk4/CkGZhvhnErV2T9FO+65jnU3mZkeX5tfJHqJ8PnDch2JD6O7+Mjpce4zs/x3mwH36peER6iiIBYGlSF0AlUDShdqj+fPWFu6gZ9piOAZ2L3YXDA0ulM6pL69SbulrUNOwtTy6LkBfKDwpaQK1KO1VOYBaKa7s+krOJXW18k+tpfo4aKSeTuwvykMPndKMKvxcsxNymkGo2AzLw017Qgshzv9rRbLNMBFd85S3krakGyBVL0HAVrAdkjvsWqj5FnHAjgBc1AZnZPbJu3g9/wm7k8rPMV0jxKMpW+zxjVFYDhFUWYp9w==
-    '';
-  };
-  ed25519 = {
-    inherit hostNames;
-    publicKey = ''
-      ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfiwlzGcNQjamtIwv7fmXnddjajraeovaM6gRNui1+v
-    '';
-  };
-}
diff --git a/system-profiles/openssh/known-hosts/sif/ed25519-cert.pub b/system-profiles/openssh/known-hosts/sif/ed25519-cert.pub
new file mode 100644
index 00000000..b27502d2
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/sif/ed25519-cert.pub
@@ -0,0 +1 @@
+ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIBCnP3j54kFxIKoWec6/srEmZkeGz2mTuJixCTT4y+ttAAAAIOfiwlzGcNQjamtIwv7fmXnddjajraeovaM6gRNui1+vQAAAAGIHpe8AAAACAAAAJGE4NTNmM2ExLTA0MzUtNDBiMy04NzgxLWYxZDkxZjU1ZmU3YQAAABEAAAANc2lmLnlnZ2RyYXNpbAAAAABiBlRlAAAAAGOwvvAAAAAAAAAAAAAAAAAAAAAzAAAAC3NzaC1lZDI1NTE5AAAAIC1t7HamptQ49VXtSZyRsaOuja5In1N0U9Ybdiu6ztziAAAAUwAAAAtzc2gtZWQyNTUxOQAAAEALCpwkVj4ZfDshL+b+lxRskj5lA7bffZOZQ8ZxyNnaAN8cZvuUzzuypLAkcHEZhOJVJkiTZYQSnjk8I3iuDg4I sif/ed25519.pub
diff --git a/system-profiles/openssh/known-hosts/sif/ed25519.pub b/system-profiles/openssh/known-hosts/sif/ed25519.pub
new file mode 100644
index 00000000..532f6694
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/sif/ed25519.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfiwlzGcNQjamtIwv7fmXnddjajraeovaM6gRNui1+v
diff --git a/system-profiles/openssh/known-hosts/sif/host-principals b/system-profiles/openssh/known-hosts/sif/host-principals
new file mode 100644
index 00000000..7f9156b4
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/sif/host-principals
@@ -0,0 +1 @@
+sif.yggdrasil
\ No newline at end of file
diff --git a/system-profiles/openssh/known-hosts/sif/rsa-cert.pub b/system-profiles/openssh/known-hosts/sif/rsa-cert.pub
new file mode 100644
index 00000000..201a4f86
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/sif/rsa-cert.pub
@@ -0,0 +1 @@
+ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1yc2EtY2VydC12MDFAb3BlbnNzaC5jb20AAAAg4XTmWbkyH6+3nLB86m96iWfJI7GqCjWQPP2BgTy74dYAAAADAQABAAACAQCeFqJep1CuWakcoiAkz4bSaHbAIwM89Er46o3KUpjCWGTmDmhJyBiG38pupcctH0awwElkX09GsNx230mTtjT6qcxN+vGsGMJIqFD+/7ZobSLJDHYCo6Jx23jZUjg1SqxYjwB5ooWGI61Vh6SaOy8WRrUn0q8rJyd9SEC+3tJlKO5QqRi/Vnwzj47m+YjGz2UlqJ9a4GeRh1O5SiGx5jd4a/VoeK1XJcW94XeWpPQdUGnVYUXZn9cwYVrogmXdr18ImnPxghsQg4xwS2A6KMjUw9m56XkqIq7vTslmL9JaYcjlSCHbsSVq9+Wu1oKxoyndN7Sim7SkAZwHFUEMBNlontBitgYl6z10VdKX739os6h07uXjGEs+mPk4/CkGZhvhnErV2T9FO+65jnU3mZkeX5tfJHqJ8PnDch2JD6O7+Mjpce4zs/x3mwH36peER6iiIBYGlSF0AlUDShdqj+fPWFu6gZ9piOAZ2L3YXDA0ulM6pL69SbulrUNOwtTy6LkBfKDwpaQK1KO1VOYBaKa7s+krOJXW18k+tpfo4aKSeTuwvykMPndKMKvxcsxNymkGo2AzLw017Qgshzv9rRbLNMBFd85S3krakGyBVL0HAVrAdkjvsWqj5FnHAjgBc1AZnZPbJu3g9/wm7k8rPMV0jxKMpW+zxjVFYDhFUWYp90AAAABiB6Y+AAAAAgAAACQ2ZGYzMjE0Yi04Y2M0LTRiOGEtYTFmMS1mZjFmNTI1MmRlNzYAAAARAAAADXNpZi55Z2dkcmFzaWwAAAAAYgZUtAAAAABjsL7wAAAAAAAAAAAAAAAAAAAAMwAAAAtzc2gtZWQyNTUxOQAAACAtbex2pqbUOPVV7UmckbGjro2uSJ9TdFPWG3Yrus7c4gAAAFMAAAALc3NoLWVkMjU1MTkAAABAVIm1QsbC4QMXKdgC115z6CYi+7hoZjpbCadc0xxN7w/hqJs84cmBEbc62FGN2EBEpT8lKcWW4beYD96Dd3ZLCg== sif/rsa.pub
diff --git a/system-profiles/openssh/known-hosts/sif/rsa.pub b/system-profiles/openssh/known-hosts/sif/rsa.pub
new file mode 100644
index 00000000..95556ed5
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/sif/rsa.pub
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCeFqJep1CuWakcoiAkz4bSaHbAIwM89Er46o3KUpjCWGTmDmhJyBiG38pupcctH0awwElkX09GsNx230mTtjT6qcxN+vGsGMJIqFD+/7ZobSLJDHYCo6Jx23jZUjg1SqxYjwB5ooWGI61Vh6SaOy8WRrUn0q8rJyd9SEC+3tJlKO5QqRi/Vnwzj47m+YjGz2UlqJ9a4GeRh1O5SiGx5jd4a/VoeK1XJcW94XeWpPQdUGnVYUXZn9cwYVrogmXdr18ImnPxghsQg4xwS2A6KMjUw9m56XkqIq7vTslmL9JaYcjlSCHbsSVq9+Wu1oKxoyndN7Sim7SkAZwHFUEMBNlontBitgYl6z10VdKX739os6h07uXjGEs+mPk4/CkGZhvhnErV2T9FO+65jnU3mZkeX5tfJHqJ8PnDch2JD6O7+Mjpce4zs/x3mwH36peER6iiIBYGlSF0AlUDShdqj+fPWFu6gZ9piOAZ2L3YXDA0ulM6pL69SbulrUNOwtTy6LkBfKDwpaQK1KO1VOYBaKa7s+krOJXW18k+tpfo4aKSeTuwvykMPndKMKvxcsxNymkGo2AzLw017Qgshzv9rRbLNMBFd85S3krakGyBVL0HAVrAdkjvsWqj5FnHAjgBc1AZnZPbJu3g9/wm7k8rPMV0jxKMpW+zxjVFYDhFUWYp9w==
diff --git a/system-profiles/openssh/known-hosts/surtr.nix b/system-profiles/openssh/known-hosts/surtr.nix
deleted file mode 100644
index 5f08474d..00000000
--- a/system-profiles/openssh/known-hosts/surtr.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-let
-  hostNames = ["surtr.yggdrasil" "surtr.yggdrasil.li"];
-in {
-  dsa = {
-    inherit hostNames;
-    publicKey = ''
-      ssh-dss AAAAB3NzaC1kc3MAAACBAIgY3WWK/yD1QzQMako4FDkD22YODiCA/d7Ga14xpx7ujSPQJ0PqFd1aTPhrEZdy6pMnL82chGJD/oeurAacBxeuUouKvr10vtpaDJpcvqr/9m4zsx0OSeHl9M5PuSumjEXL/bsF/QSeo9Vp8uznLgHP/oglP8OI4Qsdh/0wisK1AAAAFQD04cH0JaWgJEUePcuYd02KW7t4aQAAAIBkFCGDPkJedRdJRy+l2OW6H7XdCQnA814cWOGaUItw5IVWz6KlVGPlETrBtRJhrgiwApy1Sk2rHxmuHCirAFS6FCZ5ct5wHKV2L/1CDphJzsYql9hUBTgevEpuAg9Kn1WjtcV+t+3LO9URD64BKHzpvtM2I5hAU4Zu6G2OV150MQAAAIB7B3lRZBxkDfb5x4cjitzFXN3FUzBcl0SD6/TJ+TH2lbTONMIXdT9zHw5BfEz3ObcScxCT2g99bvkxDwPNFRAorLAlEhCYB2zUV5QnJd8ZpIB3AFbokUxq+Q8fs5tU16Wv9TQ4oYmY3m9UAEqVz6ph562Ss+axO9qfSlNZX8feGA==
-    '';
-  };
-  ecdsa = {
-    inherit hostNames;
-    publicKey = ''
-      ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKLjbW8GWc7dF8HD8QrFZpZJop2xvFgvZnYfIl/slFASvphD6MBOHq3jx0+Tuk51xd4mvByTwoh8eokLZJidkZQ=
-    '';
-  };
-  ed25519 = {
-    inherit hostNames;
-    publicKey = ''
-      ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO2LOAbV3XuAqJpXVY+YUnLIbhRsmAUmVQT3MioXGGgj
-    '';
-  };
-  rsa = {
-    inherit hostNames;
-    publicKey = ''
-      ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQClFn6IDsDjuLXpThBtrRj+HLkNAwuBc4BgNqqIXkSRXy1FhDVgdI2iXKnJJLT/MWBMz73+QEYI+nDV6cxMCu292sZal+EAkyXJG6gQ9/rboucTuMWosrifAYabY4jUY79vYOiQGHG3XMIVjTQE8dRoXASzPKcok7PHftuW2qUu6ti7s3tqxY89Ez0cUz7jIECR7zHpIHZQbPd7z9luWOwZZc/eUGGWSxxz6idSPi/Adjk4FS56kIBk/uq9bZ8ylE/nwuJFUV90GzIr2nIQAcg6UVjYkw22+tA8BKzkS5Kx9ur7jVAhgs1qavKGnkYBuE4MvfjDzrkxRtlIPOjUQ3uuqYXkkkdMCooDl6+oKvN8dug6+cMdXn3/Q63cA0ols5rJz8iAtBoPRI8b835BWZcYHCk2aF2xT5hmB+GVhnFRZP8p9cRlr0jhYRjJKp80gTT7BPlMAQ0Sfmz5jLPd7X9yInKXCXdzxLTWvGqDq4GpunWVR6rgDMq5AswIcNhcwCc=
-    '';
-  };
-}
diff --git a/system-profiles/openssh/known-hosts/surtr/ed25519-cert.pub b/system-profiles/openssh/known-hosts/surtr/ed25519-cert.pub
new file mode 100644
index 00000000..23bb41e8
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/surtr/ed25519-cert.pub
@@ -0,0 +1 @@
+ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIAQK6fyRzCbFzDxDdQ0SLL4VD0XlvZI1hNIwA3/sjWrfAAAAIO2LOAbV3XuAqJpXVY+YUnLIbhRsmAUmVQT3MioXGGgjQAAAAGIHpj8AAAACAAAAJGIyZDIzNDQzLWMwNjEtNGUxZC04OTc5LWM5ZjUwNWNjOTBiMAAAACkAAAAPc3VydHIueWdnZHJhc2lsAAAAEnN1cnRyLnlnZ2RyYXNpbC5saQAAAABiBlS1AAAAAGOwvvAAAAAAAAAAAAAAAAAAAAAzAAAAC3NzaC1lZDI1NTE5AAAAIC1t7HamptQ49VXtSZyRsaOuja5In1N0U9Ybdiu6ztziAAAAUwAAAAtzc2gtZWQyNTUxOQAAAECmpaSkdzjwOQpQ8TS57TLUE3pERmmnC3ADkWur5sKtAJOADtrAlj1Lz4Ju39ew1LKalkLlpwd2ZUfl0+/U0qwA surtr/ed25519.pub
diff --git a/system-profiles/openssh/known-hosts/surtr/ed25519.pub b/system-profiles/openssh/known-hosts/surtr/ed25519.pub
new file mode 100644
index 00000000..d972c5b9
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/surtr/ed25519.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO2LOAbV3XuAqJpXVY+YUnLIbhRsmAUmVQT3MioXGGgj
diff --git a/system-profiles/openssh/known-hosts/surtr/host-principals b/system-profiles/openssh/known-hosts/surtr/host-principals
new file mode 100644
index 00000000..ac8e9c53
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/surtr/host-principals
@@ -0,0 +1 @@
+surtr.yggdrasil,surtr.yggdrasil.li
\ No newline at end of file
diff --git a/system-profiles/openssh/known-hosts/surtr/rsa-cert.pub b/system-profiles/openssh/known-hosts/surtr/rsa-cert.pub
new file mode 100644
index 00000000..d0761088
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/surtr/rsa-cert.pub
@@ -0,0 +1 @@
+ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1yc2EtY2VydC12MDFAb3BlbnNzaC5jb20AAAAgHiB84BX5OqjCKkD5V6ZvuWFEJo67U12OFAv7Qobp55QAAAADAQABAAABgQClFn6IDsDjuLXpThBtrRj+HLkNAwuBc4BgNqqIXkSRXy1FhDVgdI2iXKnJJLT/MWBMz73+QEYI+nDV6cxMCu292sZal+EAkyXJG6gQ9/rboucTuMWosrifAYabY4jUY79vYOiQGHG3XMIVjTQE8dRoXASzPKcok7PHftuW2qUu6ti7s3tqxY89Ez0cUz7jIECR7zHpIHZQbPd7z9luWOwZZc/eUGGWSxxz6idSPi/Adjk4FS56kIBk/uq9bZ8ylE/nwuJFUV90GzIr2nIQAcg6UVjYkw22+tA8BKzkS5Kx9ur7jVAhgs1qavKGnkYBuE4MvfjDzrkxRtlIPOjUQ3uuqYXkkkdMCooDl6+oKvN8dug6+cMdXn3/Q63cA0ols5rJz8iAtBoPRI8b835BWZcYHCk2aF2xT5hmB+GVhnFRZP8p9cRlr0jhYRjJKp80gTT7BPlMAQ0Sfmz5jLPd7X9yInKXCXdzxLTWvGqDq4GpunWVR6rgDMq5AswIcNhcwCdAAAAAYgemQQAAAAIAAAAkMDViYWI5Y2MtZTY2MS00YzE4LWFkMDktMzZiOTYwYmQ4ZTE5AAAAKQAAAA9zdXJ0ci55Z2dkcmFzaWwAAAASc3VydHIueWdnZHJhc2lsLmxpAAAAAGIGVLcAAAAAY7C+8AAAAAAAAAAAAAAAAAAAADMAAAALc3NoLWVkMjU1MTkAAAAgLW3sdqam1Dj1Ve1JnJGxo66NrkifU3RT1ht2K7rO3OIAAABTAAAAC3NzaC1lZDI1NTE5AAAAQAPniQamYBJmBZvObcINQUC7YGZW85w1tlMkfep3gJ8D0sWQKx2RFhdLsTkTpEfoHGHWk+9sabeClBgCANsWmAg= surtr/rsa.pub
diff --git a/system-profiles/openssh/known-hosts/surtr/rsa.pub b/system-profiles/openssh/known-hosts/surtr/rsa.pub
new file mode 100644
index 00000000..078c0b50
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/surtr/rsa.pub
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQClFn6IDsDjuLXpThBtrRj+HLkNAwuBc4BgNqqIXkSRXy1FhDVgdI2iXKnJJLT/MWBMz73+QEYI+nDV6cxMCu292sZal+EAkyXJG6gQ9/rboucTuMWosrifAYabY4jUY79vYOiQGHG3XMIVjTQE8dRoXASzPKcok7PHftuW2qUu6ti7s3tqxY89Ez0cUz7jIECR7zHpIHZQbPd7z9luWOwZZc/eUGGWSxxz6idSPi/Adjk4FS56kIBk/uq9bZ8ylE/nwuJFUV90GzIr2nIQAcg6UVjYkw22+tA8BKzkS5Kx9ur7jVAhgs1qavKGnkYBuE4MvfjDzrkxRtlIPOjUQ3uuqYXkkkdMCooDl6+oKvN8dug6+cMdXn3/Q63cA0ols5rJz8iAtBoPRI8b835BWZcYHCk2aF2xT5hmB+GVhnFRZP8p9cRlr0jhYRjJKp80gTT7BPlMAQ0Sfmz5jLPd7X9yInKXCXdzxLTWvGqDq4GpunWVR6rgDMq5AswIcNhcwCc=
diff --git a/system-profiles/openssh/known-hosts/vidhar.nix b/system-profiles/openssh/known-hosts/vidhar.nix
deleted file mode 100644
index 0e4b784e..00000000
--- a/system-profiles/openssh/known-hosts/vidhar.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-let
-  hostNames = ["192.168.2.168" "vidhar.yggdrasil" "vidhar.yggdrasil.li"];
-in {
-  rsa = {
-    inherit hostNames;
-    publicKey = ''
-      ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCopJQaFGSf5/FioXnjppVvzqAxW8/Hcr9xpCpj1WDn5hZoKCzyPmZet43ATG7IxHtEXK1O+FfIN7HUDlPrfOEiw/1W8j/fzFCsjXC/c5031wBaPmBpf0uXOGjuJ2INps7qPfOUqfWKYIKgmdk4Sr2vjRxpSoO08mPgECVwWYDBfRrZD3RYVls9NSW3GZFsCOHNUVxV1O112EFbwzyJUDVpTWqF5uSmW5HD7zAhHRs96q1AiOo7rQ9LfYD51Hc/0XkbUQ+wi9jxZwhwsBmEMMGFVRPGBOXqN5x4DItY8hpzq3h4WJEHvGdtRg89TxBeRIV96six0ThA9aS5JrND6DWOgEueoOv0WnLPswUh/+jg6hnECYW0mg7SbxInU/qESFxYp9jRjErQxThwM4u0fuE2+8LR3cB7Ui2GkjuQvvgI/LTHXucy7nTK9Fm87NDSx7oMyCBu8+I/8wntHD4s2SMvGi+BBI5i2dH+VBEoZEbi58DLZa+bwzfuAj+h46DNdR8=
-    '';
-  };
-  ed25519 = {
-    inherit hostNames;
-    publicKey = ''
-      ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKHGEME8AQDpXnDuI2G4aruVnz3of37+ZgXJh85h8Frq
-    '';
-  };
-}
diff --git a/system-profiles/openssh/known-hosts/vidhar/ed25519-cert.pub b/system-profiles/openssh/known-hosts/vidhar/ed25519-cert.pub
new file mode 100644
index 00000000..adb2db7a
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/vidhar/ed25519-cert.pub
@@ -0,0 +1 @@
+ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAIJw+mpMw6Oi54ijwamx0+bIcDvIQAfzdztCsk7WCh0K7AAAAIKHGEME8AQDpXnDuI2G4aruVnz3of37+ZgXJh85h8FrqQAAAAGIHpkMAAAACAAAAJDRlOTBjMWQ4LTk2ZmItNDlmNC04OTA1LTk4MmExZDBmNzU3NgAAACsAAAATdmlkaGFyLnlnZ2RyYXNpbC5saQAAABB2aWRoYXIueWdnZHJhc2lsAAAAAGIGVLkAAAAAY7C+8AAAAAAAAAAAAAAAAAAAADMAAAALc3NoLWVkMjU1MTkAAAAgLW3sdqam1Dj1Ve1JnJGxo66NrkifU3RT1ht2K7rO3OIAAABTAAAAC3NzaC1lZDI1NTE5AAAAQDNXe2wt0RFSnn2fkLh1QEBGJub0xKii1DbtbZvk4Pu9NVbPh9DAZ6LNgcSlb1Leo4uLfP8+11G5TAMNCLQu4gc= vidhar/ed25519.pub
diff --git a/system-profiles/openssh/known-hosts/vidhar/ed25519.pub b/system-profiles/openssh/known-hosts/vidhar/ed25519.pub
new file mode 100644
index 00000000..63146e47
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/vidhar/ed25519.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKHGEME8AQDpXnDuI2G4aruVnz3of37+ZgXJh85h8Frq
diff --git a/system-profiles/openssh/known-hosts/vidhar/host-principals b/system-profiles/openssh/known-hosts/vidhar/host-principals
new file mode 100644
index 00000000..2c778e1a
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/vidhar/host-principals
@@ -0,0 +1 @@
+vidhar.yggdrasil.li,vidhar.yggdrasil
\ No newline at end of file
diff --git a/system-profiles/openssh/known-hosts/vidhar/rsa-cert.pub b/system-profiles/openssh/known-hosts/vidhar/rsa-cert.pub
new file mode 100644
index 00000000..7ff7c9cc
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/vidhar/rsa-cert.pub
@@ -0,0 +1 @@
+ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1yc2EtY2VydC12MDFAb3BlbnNzaC5jb20AAAAg3crwfqBj13EfGAezc4gwGf6DALho+jkFSVoZ5PrKN0IAAAADAQABAAABgQCopJQaFGSf5/FioXnjppVvzqAxW8/Hcr9xpCpj1WDn5hZoKCzyPmZet43ATG7IxHtEXK1O+FfIN7HUDlPrfOEiw/1W8j/fzFCsjXC/c5031wBaPmBpf0uXOGjuJ2INps7qPfOUqfWKYIKgmdk4Sr2vjRxpSoO08mPgECVwWYDBfRrZD3RYVls9NSW3GZFsCOHNUVxV1O112EFbwzyJUDVpTWqF5uSmW5HD7zAhHRs96q1AiOo7rQ9LfYD51Hc/0XkbUQ+wi9jxZwhwsBmEMMGFVRPGBOXqN5x4DItY8hpzq3h4WJEHvGdtRg89TxBeRIV96six0ThA9aS5JrND6DWOgEueoOv0WnLPswUh/+jg6hnECYW0mg7SbxInU/qESFxYp9jRjErQxThwM4u0fuE2+8LR3cB7Ui2GkjuQvvgI/LTHXucy7nTK9Fm87NDSx7oMyCBu8+I/8wntHD4s2SMvGi+BBI5i2dH+VBEoZEbi58DLZa+bwzfuAj+h46DNdR9AAAAAYgemRAAAAAIAAAAkODQwMjY2N2ItY2YyYy00MDM2LWI3YmEtM2E0MTBkOTYxN2Q4AAAAKwAAABN2aWRoYXIueWdnZHJhc2lsLmxpAAAAEHZpZGhhci55Z2dkcmFzaWwAAAAAYgZUugAAAABjsL7wAAAAAAAAAAAAAAAAAAAAMwAAAAtzc2gtZWQyNTUxOQAAACAtbex2pqbUOPVV7UmckbGjro2uSJ9TdFPWG3Yrus7c4gAAAFMAAAALc3NoLWVkMjU1MTkAAABAUfd4GP/toabf6XHInr9cRdszVZCfLolsB2NnuCVD/hZ3k6hvCrTtqhGzBpWj1CeJ65bTWo5ZQkbOrm4r9S9lBA== vidhar/rsa.pub
diff --git a/system-profiles/openssh/known-hosts/vidhar/rsa.pub b/system-profiles/openssh/known-hosts/vidhar/rsa.pub
new file mode 100644
index 00000000..c4974543
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/vidhar/rsa.pub
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCopJQaFGSf5/FioXnjppVvzqAxW8/Hcr9xpCpj1WDn5hZoKCzyPmZet43ATG7IxHtEXK1O+FfIN7HUDlPrfOEiw/1W8j/fzFCsjXC/c5031wBaPmBpf0uXOGjuJ2INps7qPfOUqfWKYIKgmdk4Sr2vjRxpSoO08mPgECVwWYDBfRrZD3RYVls9NSW3GZFsCOHNUVxV1O112EFbwzyJUDVpTWqF5uSmW5HD7zAhHRs96q1AiOo7rQ9LfYD51Hc/0XkbUQ+wi9jxZwhwsBmEMMGFVRPGBOXqN5x4DItY8hpzq3h4WJEHvGdtRg89TxBeRIV96six0ThA9aS5JrND6DWOgEueoOv0WnLPswUh/+jg6hnECYW0mg7SbxInU/qESFxYp9jRjErQxThwM4u0fuE2+8LR3cB7Ui2GkjuQvvgI/LTHXucy7nTK9Fm87NDSx7oMyCBu8+I/8wntHD4s2SMvGi+BBI5i2dH+VBEoZEbi58DLZa+bwzfuAj+h46DNdR8=
diff --git a/system-profiles/openssh/known-hosts/ymir.nix b/system-profiles/openssh/known-hosts/ymir.nix
deleted file mode 100644
index f29baf1d..00000000
--- a/system-profiles/openssh/known-hosts/ymir.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-let
-  hostNames = ["ymir.yggdrasil.li" "ymir.niflheim.yggdrasil"];
-in {
-  rsa = {
-    inherit hostNames;
-    publicKey = ''
-      ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDNr7oFNneR3sVuAhdbnU83PuG6gTU6rDmiz+qykkRUr5Qdtm0NIr9lI7nhoO/MaALWmkMXsBGjvJ2UxvY959g0wQRHJZnuJDwOMo3YJjfuDGMTtp8ikzd646uMHQB+y/xb4dou6f0INr94eRsZcji7AQgZQnyWVV3DZuSADBfNK0Tx6sT6IdbJXaCwYoexnfSfzDdu3i5zMuReF4zdkFUEfAdcbOM8Cr0Abnn4+iLVrof/QaOEuZDC+Pf5QUhkAArETdavSCUIbV6+1md0jz/T8yalgrTCsYOoEUbSPwM/8vmiYDWSo/tvAf3KnVIPjjK2UFz7Qu0HyK0y1dBEXoYLGZ1ep4x67aE4zy7GlR2GZdAYilHknugZB+/kvYGDEixHFfcUh/uvF5PY8sm63C6HUBT1s/aQHXGHgE4uUru6YvbU3UW3fRdslABY/atZ9gc3MuKu9Zk27b1SYfAAoK1R8rKsOKWqUWvvMVCfKBNKqqb7+30q75iGeneB8Tb1C9lToyDG2Yl5p+Gpfnj8YmaU/xFm0HFEC42crRbaQyz01LmupHWf8VwH/O2LsjztAF9b4Oe2q/NwqQAF+h5hIm2tfM2fzxHGCmw1sFYf6dEdkyV5pge/IJrnuQn27iO06tRC6tvrt/ocbpwEEOk/3WWpAWW4oT8L5ceh7iAXrCRWpw==
-    '';
-  };
-  ed25519 = {
-    inherit hostNames;
-    publicKey = ''
-      ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDeBBux2bIXnS/RUv+Y/NCpzI/SCW0KOJSzf48KDiEZD
-    '';
-  };
-}
diff --git a/system-profiles/openssh/known-hosts/ymir/ed25519-cert.pub b/system-profiles/openssh/known-hosts/ymir/ed25519-cert.pub
new file mode 100644
index 00000000..83ec913e
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/ymir/ed25519-cert.pub
@@ -0,0 +1 @@
+ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5LWNlcnQtdjAxQG9wZW5zc2guY29tAAAAICUd5T+t6Giaq52opNtwkdA/h6DDVMV5mSAwmUY2U9cTAAAAIDeBBux2bIXnS/RUv+Y/NCpzI/SCW0KOJSzf48KDiEZDQAAAAGIHpkUAAAACAAAAJGQ5NmYwYWY1LTBjYjUtNDM1Zi1hYTFlLTc5ZjFhMjVlOTcyMAAAABUAAAAReW1pci55Z2dkcmFzaWwubGkAAAAAYgZUuwAAAABjsL7wAAAAAAAAAAAAAAAAAAAAMwAAAAtzc2gtZWQyNTUxOQAAACAtbex2pqbUOPVV7UmckbGjro2uSJ9TdFPWG3Yrus7c4gAAAFMAAAALc3NoLWVkMjU1MTkAAABAorc2x49gJECkdwOjFrpSVKGpG/eapaFTFjNE0KIt+BUidQn821ort2lV+ycdZKO8XvWsFjzfCvdIMakpnDB9BA== ymir/ed25519.pub
diff --git a/system-profiles/openssh/known-hosts/ymir/ed25519.pub b/system-profiles/openssh/known-hosts/ymir/ed25519.pub
new file mode 100644
index 00000000..aaf4b012
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/ymir/ed25519.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDeBBux2bIXnS/RUv+Y/NCpzI/SCW0KOJSzf48KDiEZD
diff --git a/system-profiles/openssh/known-hosts/ymir/host-principals b/system-profiles/openssh/known-hosts/ymir/host-principals
new file mode 100644
index 00000000..7c4e9d7c
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/ymir/host-principals
@@ -0,0 +1 @@
+ymir.yggdrasil.li
\ No newline at end of file
diff --git a/system-profiles/openssh/known-hosts/ymir/rsa-cert.pub b/system-profiles/openssh/known-hosts/ymir/rsa-cert.pub
new file mode 100644
index 00000000..f2d60979
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/ymir/rsa-cert.pub
@@ -0,0 +1 @@
+ssh-rsa-cert-v01@openssh.com AAAAHHNzaC1yc2EtY2VydC12MDFAb3BlbnNzaC5jb20AAAAg9cWaz1e9vLZV008c3egsA3xB56YLxvExYAzLBKN/nSoAAAADAQABAAACAQDNr7oFNneR3sVuAhdbnU83PuG6gTU6rDmiz+qykkRUr5Qdtm0NIr9lI7nhoO/MaALWmkMXsBGjvJ2UxvY959g0wQRHJZnuJDwOMo3YJjfuDGMTtp8ikzd646uMHQB+y/xb4dou6f0INr94eRsZcji7AQgZQnyWVV3DZuSADBfNK0Tx6sT6IdbJXaCwYoexnfSfzDdu3i5zMuReF4zdkFUEfAdcbOM8Cr0Abnn4+iLVrof/QaOEuZDC+Pf5QUhkAArETdavSCUIbV6+1md0jz/T8yalgrTCsYOoEUbSPwM/8vmiYDWSo/tvAf3KnVIPjjK2UFz7Qu0HyK0y1dBEXoYLGZ1ep4x67aE4zy7GlR2GZdAYilHknugZB+/kvYGDEixHFfcUh/uvF5PY8sm63C6HUBT1s/aQHXGHgE4uUru6YvbU3UW3fRdslABY/atZ9gc3MuKu9Zk27b1SYfAAoK1R8rKsOKWqUWvvMVCfKBNKqqb7+30q75iGeneB8Tb1C9lToyDG2Yl5p+Gpfnj8YmaU/xFm0HFEC42crRbaQyz01LmupHWf8VwH/O2LsjztAF9b4Oe2q/NwqQAF+h5hIm2tfM2fzxHGCmw1sFYf6dEdkyV5pge/IJrnuQn27iO06tRC6tvrt/ocbpwEEOk/3WWpAWW4oT8L5ceh7iAXrCRWp0AAAABiB6ZGAAAAAgAAACRiZTBlYjg0MS0xNmEyLTQwY2MtYjQwNy02Nzc3MzVmZTg1ODkAAAAVAAAAEXltaXIueWdnZHJhc2lsLmxpAAAAAGIGVLwAAAAAY7C+8AAAAAAAAAAAAAAAAAAAADMAAAALc3NoLWVkMjU1MTkAAAAgLW3sdqam1Dj1Ve1JnJGxo66NrkifU3RT1ht2K7rO3OIAAABTAAAAC3NzaC1lZDI1NTE5AAAAQMHTfT5Y+8BLsPFfhsQwGbyrd6ufCph8WGTTH8e8D/FhFApIjPCnCuZJVOXrmdRAzc7BXFnJBBOX34Z7o8Y30wA= ymir/rsa.pub
diff --git a/system-profiles/openssh/known-hosts/ymir/rsa.pub b/system-profiles/openssh/known-hosts/ymir/rsa.pub
new file mode 100644
index 00000000..7748d3a1
--- /dev/null
+++ b/system-profiles/openssh/known-hosts/ymir/rsa.pub
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDNr7oFNneR3sVuAhdbnU83PuG6gTU6rDmiz+qykkRUr5Qdtm0NIr9lI7nhoO/MaALWmkMXsBGjvJ2UxvY959g0wQRHJZnuJDwOMo3YJjfuDGMTtp8ikzd646uMHQB+y/xb4dou6f0INr94eRsZcji7AQgZQnyWVV3DZuSADBfNK0Tx6sT6IdbJXaCwYoexnfSfzDdu3i5zMuReF4zdkFUEfAdcbOM8Cr0Abnn4+iLVrof/QaOEuZDC+Pf5QUhkAArETdavSCUIbV6+1md0jz/T8yalgrTCsYOoEUbSPwM/8vmiYDWSo/tvAf3KnVIPjjK2UFz7Qu0HyK0y1dBEXoYLGZ1ep4x67aE4zy7GlR2GZdAYilHknugZB+/kvYGDEixHFfcUh/uvF5PY8sm63C6HUBT1s/aQHXGHgE4uUru6YvbU3UW3fRdslABY/atZ9gc3MuKu9Zk27b1SYfAAoK1R8rKsOKWqUWvvMVCfKBNKqqb7+30q75iGeneB8Tb1C9lToyDG2Yl5p+Gpfnj8YmaU/xFm0HFEC42crRbaQyz01LmupHWf8VwH/O2LsjztAF9b4Oe2q/NwqQAF+h5hIm2tfM2fzxHGCmw1sFYf6dEdkyV5pge/IJrnuQn27iO06tRC6tvrt/ocbpwEEOk/3WWpAWW4oT8L5ceh7iAXrCRWpw==