2 Commits

Include renames

Author	SHA1	Message	Date
beatzaplentyandClaude Sonnet 5	6b09a808ed	Make lxc-docker a privileged container: unprivileged can't NFS-mount at all ... The kernel's NFS client filesystem doesn't set FS_USERNS_MOUNT, so mounting NFS from inside any non-init user namespace -- exactly what an unprivileged LXC container's UID-mapped root runs in -- is rejected at the VFS layer with EPERM, regardless of Proxmox's mount=nfs;nfs4 container feature (which only patches the AppArmor layer). Confirmed live on the redeployed lxc-docker container: TCP to the NFS server's port 2049 succeeds, the server's export table matches the container's IP, and mount.nfs: Operation not permitted still fires immediately with no corresponding denial anywhere in the server's own logs -- a kernel-level rejection that no amount of DNS/ automount/export tweaking (this branch's earlier commits) could ever fix. modules/platforms/lxc.nix now keys proxmoxLXC.privileged off hostName ("docker" -> true) rather than a blanket false, since build-types/docker.nix is also composed for linode-docker/proxmox-docker, which don't import proxmox-lxc.nix at all -- setting this option there would break their eval. create-proxmox-resource.sh reads the value back via a new flake_target_lxc_privileged helper instead of hardcoding --unprivileged 1, so the two stay in sync automatically for every lxc-* target. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T48qgH3VTvs8wvwj44FEbE	2026-07-21 05:57:06 +00:00
rootandClaude Sonnet 5	7e51168d1b	Deduplicate reusable shell code in scripts/ into scripts/lib/ ... Three chunks of copy-pasted logic were drifting across scripts/*.sh: - codex-setup.sh and codex-maintenance.sh each carried an identical NIX_CONFIG bootstrap + ensure_nix_profile() -> scripts/lib/nix-bootstrap.sh - sync-host-keys.sh and prepare-host-key.sh each ran the same ssh-keygen/ssh-to-age nix-shell invocations -> scripts/lib/ssh-host-keys.sh (prepare-host-key.sh now also calls env.sh's nix_extra_opts before using them, closing a gap where it alone skipped the nix-cache reachability check env.sh exists for) - the "list nixosConfigurations attrNames" / "get one target's hostName" nix eval pattern was repeated across codex-setup.sh, codex-maintenance.sh, sync-host-keys.sh and create-proxmox-resource.sh (the latter twice, in its own --list and --host lookup) -> scripts/lib/nix-eval.sh, which also centralizes the --no-use-registries --no-accept-flake-config flag pair used on every such call Verified against the real flake/node config (nix is available here): create-proxmox-resource.sh --list for both --type lxc/vm, a full --dry-run create, and prepare-host-key.sh generating and cleaning up a real key/age-pubkey pair. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-20 10:35:49 +00:00