From 0cd8f15b4827772ad3fda0aefb00e553592f1ce2 Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Mon, 20 Jul 2026 17:12:16 +1000 Subject: [PATCH] Add buildImage shell function for building lxc-* tarballs with host keys lxc-* hosts need NIXOS_HOST_KEYS_DIR + --impure to bake in a pre-seeded SSH host key, otherwise sops-nix's .sops.yaml recipient never matches and every secret permanently fails to decrypt on first boot. That invocation is easy to forget, so wrap it as `buildImage ` alongside the existing Switch-nix/Test-nix helpers. Co-Authored-By: Claude Sonnet 5 --- modules/common/aliases.nix | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/modules/common/aliases.nix b/modules/common/aliases.nix index 41bddc1..c04cf56 100644 --- a/modules/common/aliases.nix +++ b/modules/common/aliases.nix @@ -17,6 +17,26 @@ let --refresh \ --flake git+https://${vars.lanDomain}/beatzaplenty/nixos.git#$(cat /etc/flake-target) ''; + + # lxc-* hosts pre-seed their SSH host key at build time (see + # modules/platforms/lxc.nix) so sops-nix's .sops.yaml recipient matches on + # first boot -- without it, secrets permanently fail to decrypt (see that + # file's comment for the confirmed failure). That requires --impure plus + # NIXOS_HOST_KEYS_DIR pointing at the repo's host-keys/ dir, same pattern + # docs/auto-installer.md uses for the installer ISO. A function, not a + # shellAlias, since the target name has to interpolate into the middle of + # the flake attribute path, not just append after it. Must be run from the + # repo root, same as every other host-keys/ command in this repo. + buildImageFn = '' + buildImage() { + if [ -z "$1" ]; then + echo "usage: buildImage (e.g. lxc-docker)" >&2 + return 1 + fi + NIXOS_HOST_KEYS_DIR="$(pwd)/host-keys" nix build --impure \ + ".#nixosConfigurations.$1.config.system.build.tarball" + } + ''; in { programs.bash = { @@ -25,5 +45,6 @@ in "Switch-nix" = mySwitchCmd; "Test-nix" = myTestCmd; }; + initExtra = buildImageFn; }; }