Add sync-host-keys.sh and create-proxmox-resource.sh

sync-host-keys.sh: generates/registers SSH host keys and their
.sops.yaml/secrets/*.yaml recipients for flake targets, idempotently.
--all, <target>, --remove, --regenerate-all-keys, all with --dry-run
(verified zero-side-effect via a sandboxed git-status check across every
mode). Only ever touches anchors with a corresponding host-keys/ file --
&admin and any hand-registered real-host anchor are never listed,
removed, or regenerated. Supersedes running prepare-host-key.sh one host
at a time for any target that already has a flake entry.

create-proxmox-resource.sh: builds a lxc-*/proxmox-* target's
tarball/disk image and creates it on a real Proxmox node, or reconfigures
an existing resource's cores/memory/disk (--modify, always requires
typing the VMID back to confirm). Refuses to create a new resource for a
VMID that already exists, and refuses to duplicate a host identity that
already has a real deployment elsewhere (variables.nix's new
deployedTargets, checked by hostName so it also catches cross-platform
duplicates) unless --allow-duplicate-host is passed. --dry-run throughout.

scripts/env.sh centralizes the Proxmox connection config both scripts
(and future ones) share. Also fixes an unrelated gap found along the way:
proxmox-* Disko image builds write their .raw file straight into the
repo root, and .gitignore never covered it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot

docs/auto-installer.md

@@ -56,8 +56,14 @@ it does for the ISO/PXE installer images.
   `docs/pxe-boot.md`).
 - `modules/installer/host-keys.nix` — optionally bakes pre-generated SSH
   host keys into the image; see "Host keys" below.
-- `scripts/prepare-host-key.sh` — admin-workstation pre-flight tool, see
-  "Creating a New Machine" below.
+- `scripts/sync-host-keys.sh` — admin-workstation tool that generates,
+  registers, and (via `--remove`/`--regenerate-all-keys`) retires host
+  keys; see "Creating a New Machine" below.
+- `scripts/prepare-host-key.sh` — narrower predecessor: generates a single
+  key by an arbitrary name without touching `.sops.yaml`. Still useful for
+  pre-generating a key *before* its flake target exists (`sync-host-keys.sh`
+  can only act on targets `nixosConfigurations` already has); otherwise
+  `sync-host-keys.sh` does the same thing and more.
 
 Flake outputs:
 
@@ -164,24 +170,28 @@ host consumes any sops-nix secret — as of this writing, that's every host
 (`modules/common/configuration.nix` puts the root/nixos password hash and the
 GitHub token behind sops-nix for all of them).
 
-1. **On your admin workstation**, decide the new machine's flake target name
-   (`<platform>-<buildtype>`, e.g. `proxmox-server`) and generate + register
-   its host key:
+1. **Add the flake target** — `hosts/<name>/host.nix` plus the matching
+   `mkTarget { ... }` entry in `flake.nix`'s `generatedTargets` (see
+   "Composition pattern" in `CLAUDE.md`). No secrets involved yet, so this
+   is safe to commit on its own if you want a clean history.
+
+2. **On your admin workstation, generate and register its host key:**
 
    ```sh
-   ./scripts/prepare-host-key.sh <hostname>
+   ./scripts/sync-host-keys.sh <flake-target>
    ```
 
-   This generates `host-keys/<hostname>_ssh_host_ed25519_key(.pub)` and
-   prints the `.sops.yaml` snippet to add, which secrets files to
-   re-encrypt it into, and the next steps below.
+   This generates `host-keys/<flake-target>_ssh_host_ed25519_key(.pub)`,
+   adds it as a new `.sops.yaml` anchor, works out which `secrets/*.yaml`
+   files this specific host actually references (from its own
+   `config.sops.secrets`, not guessed), adds it to each one's
+   `key_groups`, and re-encrypts them with `sops updatekeys` — no manual
+   YAML editing. Safe to re-run; it only fills in what's missing.
 
-2. **Edit `.sops.yaml`** with the printed snippet, then re-encrypt every
-   secrets file you added the new host to:
-
-   ```sh
-   nix-shell -p sops --run 'sops updatekeys secrets/common.yaml'
-   ```
+   Doing this for every host that needs one at once — after adding several
+   new targets, or just to catch up any that were missed — is
+   `./scripts/sync-host-keys.sh --all`. See `scripts/sync-host-keys.sh --help`
+   for its other modes (`--remove`, `--regenerate-all-keys`).
 
 3. **Commit and push.** The flake build the installer uses has to see the
    new recipient before you install, or decryption fails on first boot

docs/proxmox-images.md

@@ -7,6 +7,12 @@ config (`modules/disko/proxmox.nix`) already used to format a real disk on
 install, so there's nothing host-specific to write; it's available for every
 `proxmox-*` target automatically.
 
+`scripts/create-proxmox-resource.sh --type vm --host <name>` automates the
+whole walkthrough below (and the equivalent LXC one) end to end, including
+host-key handling and upload — see its `--help`. The steps here are what it
+runs under the hood, useful for doing any of it by hand or understanding
+what it does before you trust it against real infrastructure.
+
 ## Building
 
 ```sh
@@ -43,9 +49,10 @@ sudo ./result \
   --build-memory 2048
 ```
 
-Generate the key first with `scripts/prepare-host-key.sh <hostname>`, same
-as any other host — see `docs/auto-installer.md` for the full sops.yaml
-registration walkthrough.
+Generate the key first with `scripts/sync-host-keys.sh <hostname>`, same
+as any other host — see `docs/auto-installer.md` for the full walkthrough
+(it registers the new key in `.sops.yaml` and re-encrypts the affected
+`secrets/*.yaml` files too, no manual editing needed).
 
 ## Deploying to Proxmox