Archived
string were parsed as command substitution by the outer shell The whole keygen+instructions block ran inside one big double-quoted nix-shell --run "..." string. Markdown-style `keys:` backticks in the instructions heredoc are live to the *outer* shell in that context (it parses the string before nix-shell ever sees it) — bash tried to run a command literally called "keys:", failed, and silently dropped the backtick-quoted text from the output. Split into two minimal, single-purpose nix-shell --run invocations (keygen, then age derivation into a captured variable) and moved the instructions to a plain heredoc in the outer script, where normal quoting rules apply and there's nothing left to misinterpret. Also resolves host-keys/ to an absolute path instead of the literal ./scripts/../host-keys/... that showed up in output before. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>