beatzaplenty/nix-auto-installer
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix prepare-host-key.sh: backticks in a double-quoted nix-shell --run

Browse Source 
string were parsed as command substitution by the outer shell

The whole keygen+instructions block ran inside one big double-quoted
nix-shell --run "..." string. Markdown-style `keys:` backticks in the
instructions heredoc are live to the *outer* shell in that context (it
parses the string before nix-shell ever sees it) — bash tried to run a
command literally called "keys:", failed, and silently dropped the
backtick-quoted text from the output.

Split into two minimal, single-purpose nix-shell --run invocations
(keygen, then age derivation into a captured variable) and moved the
instructions to a plain heredoc in the outer script, where normal
quoting rules apply and there's nothing left to misinterpret. Also
resolves host-keys/ to an absolute path instead of the literal
./scripts/../host-keys/... that showed up in output before.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
beatzaplenty
2026-07-19 15:00:40 +10:00
co-authored by Claude Sonnet 5
parent 0c70c63371
commit dd2d3b5914
1 changed files with 8 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/prepare-host-key.sh
+8 -9
View File
@@ -26,7 +26,7 @@ if [[ ! -f "$sops_yaml" ]]; then
exit 1 exit 1
fi fi
keydir="$(dirname "$0")/../host-keys" keydir="$(cd "$(dirname "$0")/.." && pwd)/host-keys"
mkdir -p "$keydir" mkdir -p "$keydir"
keyfile="${keydir}/${hostname}_ssh_host_ed25519_key" keyfile="${keydir}/${hostname}_ssh_host_ed25519_key"
@@ -35,16 +35,16 @@ if [[ -f "$keyfile" ]]; then
exit 1 exit 1
fi fi
nix-shell -p openssh ssh-to-age --run " nix-shell -p openssh --run "ssh-keygen -t ed25519 -N '' -C '${hostname}' -f '${keyfile}'" >/dev/null
set -euo pipefail
ssh-keygen -t ed25519 -N '' -C '${hostname}' -f '${keyfile}' >/dev/null age_pub="$(nix-shell -p ssh-to-age --run "ssh-to-age -i '${keyfile}.pub'")"
age_pub=\$(ssh-to-age -i '${keyfile}.pub')
cat <<EOF cat <<EOF
Generated: ${keyfile}(.pub) Generated: ${keyfile}(.pub)
=== 1. Add this line under `keys:` in ${sops_yaml} === === 1. Add this line under keys: in ${sops_yaml} ===
- &${hostname} \${age_pub} - &${hostname} ${age_pub}
=== 2. Add *${hostname} to whichever creation_rules key_groups this host needs === === 2. Add *${hostname} to whichever creation_rules key_groups this host needs ===
(e.g. secrets/common.yaml always; add a per-host secrets/${hostname}.yaml (e.g. secrets/common.yaml always; add a per-host secrets/${hostname}.yaml
@@ -62,4 +62,3 @@ Generated: ${keyfile}(.pub)
Then continue with /etc/auto-install.sh as normal — it will find the Then continue with /etc/auto-install.sh as normal — it will find the
pre-seeded key and install it before running nixos-install. pre-seeded key and install it before running nixos-install.
EOF EOF
"