string were parsed as command substitution by the outer shell
The whole keygen+instructions block ran inside one big double-quoted
nix-shell --run "..." string. Markdown-style `keys:` backticks in the
instructions heredoc are live to the *outer* shell in that context (it
parses the string before nix-shell ever sees it) — bash tried to run a
command literally called "keys:", failed, and silently dropped the
backtick-quoted text from the output.
Split into two minimal, single-purpose nix-shell --run invocations
(keygen, then age derivation into a captured variable) and moved the
instructions to a plain heredoc in the outer script, where normal
quoting rules apply and there's nothing left to misinterpret. Also
resolves host-keys/ to an absolute path instead of the literal
./scripts/../host-keys/... that showed up in output before.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
proxmox-lxc.nix was missing nixpkgs's own
nixos/modules/virtualisation/proxmox-lxc.nix — the module that actually
provides system.build.tarball — so nix build .#images (the old
combined target) failed with "attribute 'tarball' missing" for the LXC
half. Importing it (enabled by default) fixes this with no other
config needed.
flake.nix packages now expose exactly four targets instead of the
previous ad-hoc netboot-ipxe/netboot-initrd/netboot-kernel/images:
- iso — installer ISO/netboot image
- lxc — Proxmox LXC installer tarball
- pxe — the three netboot components, bundled
- all — iso + lxc + pxe, bundled
README updated to match (Build Targets section replaces the stale
nixos-generators-based instructions).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds a "Creating a New Machine" walkthrough tying together the steps
that were previously scattered or missing entirely: running
scripts/prepare-host-key.sh, editing .sops.yaml + sops updatekeys,
pushing nixos, scp'ing the key to the live installer, and verifying
/run/secrets after first boot.
Also fixes several places that still described the pre-refactor
layout (installer.nix as the sole config file, only the nixos user
triggering the installer, "Pre-Seeding..." section name that no
longer existed) to match the current common.nix/installer.nix/
proxmox-lxc.nix split.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
sops-nix (in the nixos flake) derives each host's age decryption key
from its own /etc/ssh/ssh_host_ed25519_key at activation time, which
runs before systemd would otherwise generate that key on first boot
(sshd-keygen is a plain systemd service gated behind multi-user.target;
activation scripts run earlier). Without pre-seeding, secrets --
including the login password -- fail to decrypt on a fresh install's
very first boot.
- scripts/prepare-host-key.sh: run on the admin workstation before an
install, generates the host's ed25519 keypair and prints the exact
steps to register its derived age key in nixos/.sops.yaml and
re-encrypt the affected secrets/*.yaml files.
- common.nix's auto-install.sh: after disko mounts /mnt and before
nixos-install, installs a pre-seeded key from /root/host-keys/ into
/mnt/etc/ssh/ if present, otherwise warns and asks for confirmation
before continuing without one.
- installer.nix now imports common.nix (previously only proxmox-lxc.nix
did), so the ISO/netboot path used for EFI VM installs gets the same
auto-install.sh and pre-seed check, not just the LXC path.
- Also fixes a pre-existing stray backtick in the disko invocation that
broke auto-install.sh's bash syntax entirely, independent of this
change (found while rendering the script to verify the new logic).
README.md documents the new pre-flight workflow.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Replaces the single monolithic installer.nix (preserved as
installer_old.nix for reference) with a shared common.nix carrying the
install-script/user/SSH baseline, consumed by per-platform targets
(installer.nix for netboot/ISO, new proxmox-lxc.nix for the Proxmox
LXC-based flow). flake.nix drops the nixos-generators input in favor
of building images directly from each nixosConfiguration's
system.build.isoImage/tarball.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
beatzaplentyandClaude Sonnet 5