LXC containers have no raw disk visible from inside them, only their
already-mounted root filesystem, so hosts like lxc-minimal have no
disko config and auto-install.sh's disko branch was a no-op. With
nothing pointing /mnt at anything, nixos-install (which defaults to
--root /mnt) built the new system into a disconnected empty directory
on the container's own root — never the filesystem it actually boots
from. After reboot, Proxmox just re-execs the *original* /sbin/init,
so the container silently keeps running the installer environment
forever, with the "installed" system sitting inert and unused.
Confirmed on a real lxc-minimal attempt: /etc/flake-target (stamped by
every nixos flake target) didn't exist post-"install", the only SSH
key present matched this installer's own common.nix rather than the
target flake's modules/common/configuration.nix, and sshd was still
socket-activated (nixpkgs' proxmox-lxc.nix default) rather than
running as the target's plain sshd.service.
Fix: bind-mount / onto /mnt when there's no disko config, so
nixos-install actually lands on the filesystem the container boots
from — installing NixOS in place rather than into a void.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Without this the installer only ever sees cache.nixos.org, which
doesn't carry sops-install-secrets — it's built straight from the
sops-nix flake's own Go source, not part of nixpkgs. Every install had
to compile it from scratch, which is what ran an 8GB LXC container's
disk out of space (Go toolchain fetch plus a large module tree of
small files, all on the same disk that needs to hold the rest of the
system).
Once sops-install-secrets has been built once anywhere and served via
the existing nix-cache/nix-serve setup (naturally happens the next
time nix-cache itself gets switched with the sops-nix changes), every
future install of any type fetches the pre-built binary instead of
rebuilding.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
string were parsed as command substitution by the outer shell
The whole keygen+instructions block ran inside one big double-quoted
nix-shell --run "..." string. Markdown-style `keys:` backticks in the
instructions heredoc are live to the *outer* shell in that context (it
parses the string before nix-shell ever sees it) — bash tried to run a
command literally called "keys:", failed, and silently dropped the
backtick-quoted text from the output.
Split into two minimal, single-purpose nix-shell --run invocations
(keygen, then age derivation into a captured variable) and moved the
instructions to a plain heredoc in the outer script, where normal
quoting rules apply and there's nothing left to misinterpret. Also
resolves host-keys/ to an absolute path instead of the literal
./scripts/../host-keys/... that showed up in output before.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
proxmox-lxc.nix was missing nixpkgs's own
nixos/modules/virtualisation/proxmox-lxc.nix — the module that actually
provides system.build.tarball — so nix build .#images (the old
combined target) failed with "attribute 'tarball' missing" for the LXC
half. Importing it (enabled by default) fixes this with no other
config needed.
flake.nix packages now expose exactly four targets instead of the
previous ad-hoc netboot-ipxe/netboot-initrd/netboot-kernel/images:
- iso — installer ISO/netboot image
- lxc — Proxmox LXC installer tarball
- pxe — the three netboot components, bundled
- all — iso + lxc + pxe, bundled
README updated to match (Build Targets section replaces the stale
nixos-generators-based instructions).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds a "Creating a New Machine" walkthrough tying together the steps
that were previously scattered or missing entirely: running
scripts/prepare-host-key.sh, editing .sops.yaml + sops updatekeys,
pushing nixos, scp'ing the key to the live installer, and verifying
/run/secrets after first boot.
Also fixes several places that still described the pre-refactor
layout (installer.nix as the sole config file, only the nixos user
triggering the installer, "Pre-Seeding..." section name that no
longer existed) to match the current common.nix/installer.nix/
proxmox-lxc.nix split.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
sops-nix (in the nixos flake) derives each host's age decryption key
from its own /etc/ssh/ssh_host_ed25519_key at activation time, which
runs before systemd would otherwise generate that key on first boot
(sshd-keygen is a plain systemd service gated behind multi-user.target;
activation scripts run earlier). Without pre-seeding, secrets --
including the login password -- fail to decrypt on a fresh install's
very first boot.
- scripts/prepare-host-key.sh: run on the admin workstation before an
install, generates the host's ed25519 keypair and prints the exact
steps to register its derived age key in nixos/.sops.yaml and
re-encrypt the affected secrets/*.yaml files.
- common.nix's auto-install.sh: after disko mounts /mnt and before
nixos-install, installs a pre-seeded key from /root/host-keys/ into
/mnt/etc/ssh/ if present, otherwise warns and asks for confirmation
before continuing without one.
- installer.nix now imports common.nix (previously only proxmox-lxc.nix
did), so the ISO/netboot path used for EFI VM installs gets the same
auto-install.sh and pre-seed check, not just the LXC path.
- Also fixes a pre-existing stray backtick in the disko invocation that
broke auto-install.sh's bash syntax entirely, independent of this
change (found while rendering the script to verify the new logic).
README.md documents the new pre-flight workflow.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Replaces the single monolithic installer.nix (preserved as
installer_old.nix for reference) with a shared common.nix carrying the
install-script/user/SSH baseline, consumed by per-platform targets
(installer.nix for netboot/ISO, new proxmox-lxc.nix for the Proxmox
LXC-based flow). flake.nix drops the nixos-generators input in favor
of building images directly from each nixosConfiguration's
system.build.isoImage/tarball.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
beatzaplentyandClaude Sonnet 5