4 Commits

Include renames

Author	SHA1	Message	Date
beatzaplentyandClaude Sonnet 5	fd773b65da	Fix nix-cache remote-builder trust: stale host key + wrong sshKey path ... variables.nix's nixCacheHostKey no longer matched nix-cache's actual SSH host key (confirmed via ssh-keyscan against the live container), so every declaratively-configured client's programs.ssh.knownHosts trusted the wrong key -- distributed builds would fail host-key verification. Also, modules/nix-cache/remote-builder-client.nix hardcoded sshKey to /root/.ssh/nixremote, but the `server` host only has its own default /root/.ssh/id_ed25519 installed (confirmed live via qm guest-agent) -- that file was never even present, so the build machine config pointed at nothing. Standardize on each client's own default identity, matching the per-host-key pattern vars.remoteBuilderAuthorizedKeys already uses instead of a shared/differently-named keypair, and add scripts/secrets/sync-nix-cache-host-key.sh (wired into codex-maintenance.sh's --check) so the host-key drift doesn't silently recur next time nix-cache is rebuilt or recreated. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V7yVH71vGrDVzovh9UaMu8	2026-07-20 17:21:12 +00:00
beatzaplentyandClaude Sonnet 5	75f1342339	Declaratively trust nix-cache's SSH host key on remote-builder clients ... Distributed builds failed with "Host key verification failed" on any client that had never manually SSH'd to nix-cache before, since nothing populated root's known_hosts for it. Wire nix-cache's host public key into programs.ssh.knownHosts via a new vars.nixCacheHostKey so every client picks it up automatically on rebuild. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-20 17:21:48 +10:00
beatzaplentyandClaude Sonnet 5	6f8c6c8ef1	Resolve all statix and nixpkgs-fmt warnings repo-wide ... Zero W20 (repeated attribute keys), W10 (empty { ... }: variadic pattern, use _: instead), and W04 (a = x.a instead of inherit) warnings remain anywhere in the tree, and nixpkgs-fmt --check is clean on all 46 .nix files. Repeated-key merges go as deep as statix actually flags per file (e.g. boot.loader.* nested under boot.loader = { ... } once the outer boot.* merge exposed it as its own repeat) — every merge is a pure attribute-path restructuring with no value changes, verified by comparing config.system.build.toplevel.drvPath before/after for a representative host per changed module plus a full 19-host + 4-package eval sweep. One indentation slip caught and fixed during this pass: nesting modules/installer/common.nix's environment.etc."auto-install.sh".text under an environment = { ... } block initially normalized the script's shebang/set line indentation, which actually changes the rendered file (Nix's '' string dedent treats it as real content, not cosmetic whitespace) — reproduced the original's exact indentation and reverified the rendered script is byte-identical to before. modules/services/zfs/auto-mount-volumes.nix picked up formatting too; worth noting it isn't imported by anything in this flake at all. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot	2026-07-20 03:47:42 +10:00
beatzaplentyandClaude Sonnet 5	c5f8bb4d1d	Reorganize loose modules into themed directories ... Several single-purpose modules sat at modules/ root or in the services/ catch-all despite the repo's established pattern of one directory per concern (tailscale/, beszel/, docker/, nix-cache/): - remote-builder-client.nix -> nix-cache/ (always co-included with nix-cache/client.nix in flake.nix's mkTarget, same buildType guard) - set-locale.nix -> common/ (unconditionally imported by common/configuration.nix already) - enable-ip-forwarding.nix -> networking/ - rotate-traefik-logs.nix -> traefik/rotate-logs.nix - services/docker-health-to-gotify.nix and services/nextcloud-cron-job.nix -> docker/ (both only ever imported by the docker build type, same as the rest of modules/docker/*) Pure path moves plus import-path updates in flake.nix, common/configuration.nix, and build-types/docker.nix — verified eval-equivalent (drvPath-identical) across representative hosts. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot	2026-07-20 02:58:09 +10:00