Merge pull request 'Trust nix-cache's SSH host key declaratively on remote-builder clients' (#4) from worktree-magical-cooking-book into main

2026-07-20 07:26:18 +00:00
parent f4a2d2d830 b2dda869a4
commit e0fb6ebcb2
3 changed files with 26 additions and 0 deletions
@@ -5,6 +5,14 @@
  #   sudo install -d -m 0700 /root/.ssh
  #   sudo install -m 0600 ./nixremote /root/.ssh/nixremote
  #   sudo ssh -i /root/.ssh/nixremote nixremote@nix-cache nix-store --version
+  # Trust nix-cache's SSH host key declaratively so the nix-daemon (root)
+  # can connect the first time without a manual ssh-keyscan/known_hosts
+  # step on every new client.
+  programs.ssh.knownHosts.${vars.nixCacheHost} = {
+    hostNames = [ vars.nixCacheHost ];
+    publicKey = vars.nixCacheHostKey;
+  };
+
  nix = {
    distributedBuilds = true;