string were parsed as command substitution by the outer shell
The whole keygen+instructions block ran inside one big double-quoted
nix-shell --run "..." string. Markdown-style `keys:` backticks in the
instructions heredoc are live to the *outer* shell in that context (it
parses the string before nix-shell ever sees it) — bash tried to run a
command literally called "keys:", failed, and silently dropped the
backtick-quoted text from the output.
Split into two minimal, single-purpose nix-shell --run invocations
(keygen, then age derivation into a captured variable) and moved the
instructions to a plain heredoc in the outer script, where normal
quoting rules apply and there's nothing left to misinterpret. Also
resolves host-keys/ to an absolute path instead of the literal
./scripts/../host-keys/... that showed up in output before.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
sops-nix (in the nixos flake) derives each host's age decryption key
from its own /etc/ssh/ssh_host_ed25519_key at activation time, which
runs before systemd would otherwise generate that key on first boot
(sshd-keygen is a plain systemd service gated behind multi-user.target;
activation scripts run earlier). Without pre-seeding, secrets --
including the login password -- fail to decrypt on a fresh install's
very first boot.
- scripts/prepare-host-key.sh: run on the admin workstation before an
install, generates the host's ed25519 keypair and prints the exact
steps to register its derived age key in nixos/.sops.yaml and
re-encrypt the affected secrets/*.yaml files.
- common.nix's auto-install.sh: after disko mounts /mnt and before
nixos-install, installs a pre-seeded key from /root/host-keys/ into
/mnt/etc/ssh/ if present, otherwise warns and asks for confirmation
before continuing without one.
- installer.nix now imports common.nix (previously only proxmox-lxc.nix
did), so the ISO/netboot path used for EFI VM installs gets the same
auto-install.sh and pre-seed check, not just the LXC path.
- Also fixes a pre-existing stray backtick in the disko invocation that
broke auto-install.sh's bash syntax entirely, independent of this
change (found while rendering the script to verify the new logic).
README.md documents the new pre-flight workflow.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
beatzaplentyandClaude Sonnet 5