Archived
beatzaplentyandClaude Sonnet 5
02ea1929e5
sops-nix (in the nixos flake) derives each host's age decryption key from its own /etc/ssh/ssh_host_ed25519_key at activation time, which runs before systemd would otherwise generate that key on first boot (sshd-keygen is a plain systemd service gated behind multi-user.target; activation scripts run earlier). Without pre-seeding, secrets -- including the login password -- fail to decrypt on a fresh install's very first boot. - scripts/prepare-host-key.sh: run on the admin workstation before an install, generates the host's ed25519 keypair and prints the exact steps to register its derived age key in nixos/.sops.yaml and re-encrypt the affected secrets/*.yaml files. - common.nix's auto-install.sh: after disko mounts /mnt and before nixos-install, installs a pre-seeded key from /root/host-keys/ into /mnt/etc/ssh/ if present, otherwise warns and asks for confirmation before continuing without one. - installer.nix now imports common.nix (previously only proxmox-lxc.nix did), so the ISO/netboot path used for EFI VM installs gets the same auto-install.sh and pre-seed check, not just the LXC path. - Also fixes a pre-existing stray backtick in the disko invocation that broke auto-install.sh's bash syntax entirely, independent of this change (found while rendering the script to verify the new logic). README.md documents the new pre-flight workflow. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
23 lines
522 B
Nix
23 lines
522 B
Nix
{ modulesPath, ... }:
|
|
|
|
{
|
|
imports = [
|
|
"${modulesPath}/installer/cd-dvd/installation-cd-minimal.nix"
|
|
./common.nix
|
|
];
|
|
|
|
# Only for ISO/Linode serial environments if required
|
|
# NOT for LXC
|
|
#
|
|
# boot.kernelParams = [
|
|
# "console=ttyS0,19200n8"
|
|
# ];
|
|
|
|
# Run installer when logging in (same pattern as proxmox-lxc.nix)
|
|
environment.etc."bash_profile-nixos".text = ''
|
|
if [ -n "$PS1" ] && [ ! -e ~/.auto_install_ran ]; then
|
|
sudo /etc/auto-install.sh
|
|
touch ~/.auto_install_ran
|
|
fi
|
|
'';
|
|
} |