3 Commits

Include renames

Author	SHA1	Message	Date
beatzaplentyandClaude Sonnet 5	7e7e294371	Fix LXC container creation: unprivileged, nesting/keyctl, swap sizing ... Found and fixed live against a real test container (VMID 100, lxc-nix-cache on pve.sweet.home) after the previous pct-restore-to-pct-create fix still produced a container that booted into garbled console output: 1. pct create's own CLI default for --unprivileged is privileged (unlike the web UI, whose checkbox defaults the other way), but modules/platforms/lxc.nix sets proxmoxLXC.privileged = false, so the image assumes it's running unprivileged. Real mismatch -- now passes --unprivileged 1 explicitly. 2. The actual root cause of the garbled console: modern (v247+) systemd routinely uses nested user namespaces and credential mounts (even plain getty units, via LoadCredential=-style mechanisms), which AppArmor's default LXC confinement denies without --features nesting=1,keyctl=1. Confirmed via the host's kernel audit log: every getty unit was crash-looping on a denied /run/credentials/* mount every ~3s, and core services like nsncd failed userns_create the same way -- the system never finished activating. Fixed live (pct set + restart on the running test container) before committing the script change: systemctl is-system-running went from never completing to "running" with zero failed units. 3. --memory doesn't touch swap -- confirmed live it silently stayed at Proxmox's own 512M default with --memory 2048. Now defaults --swap to whatever --memory resolves to. docs/auto-installer.md's manual pct create walkthrough gets the same fixes, with the "why" for each flag, since a human following it by hand would hit the identical bugs. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot	2026-07-20 11:33:53 +10:00
beatzaplentyandClaude Sonnet 5	a3e85b5079	Fix nix-cache retry storms and lxc creation in create-proxmox-resource.sh ... Two independent problems found while actually running the script: 1. nix build/nix-shell retry each unreachable substituter/builder up to 5x with backoff, per store path -- with nix-cache down this compounds into minutes of noise. scripts/env.sh gains nix_extra_opts(), which probes http://nix-cache and nixremote@nix-cache:22 once via plain curl/TCP (bypassing Nix's own retry logic entirely -- confirmed nix store ping still retries 5x even with a short connect-timeout) and exports the decision so create-proxmox-resource.sh and the sync-host-keys.sh subprocess it shells out to both reuse it instead of probing independently. 2. The actual failure: "archive contains no configuration file". pct restore expects a vzdump backup archive with embedded config; config.system.build.tarball is a plain CT template tarball -- wrong Proxmox mechanism entirely. Fixed to pct create against it as a vztmpl template instead, uploaded to /var/lib/vz/template/cache/ rather than /var/lib/vz/dump/. This same wrong claim had propagated into docs/auto-installer.md, README.md, and CLAUDE.md from when the script was first written -- corrected everywhere. Also: checks for an already-uploaded image on the node (fixed <flake_target>.tar.xz/.raw naming) before building, skipping build+upload entirely if found (--force-rebuild to always rebuild). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot	2026-07-20 11:05:26 +10:00
beatzaplentyandClaude Sonnet 5	2858891c20	Add sync-host-keys.sh and create-proxmox-resource.sh ... sync-host-keys.sh: generates/registers SSH host keys and their .sops.yaml/secrets/*.yaml recipients for flake targets, idempotently. --all, <target>, --remove, --regenerate-all-keys, all with --dry-run (verified zero-side-effect via a sandboxed git-status check across every mode). Only ever touches anchors with a corresponding host-keys/ file -- &admin and any hand-registered real-host anchor are never listed, removed, or regenerated. Supersedes running prepare-host-key.sh one host at a time for any target that already has a flake entry. create-proxmox-resource.sh: builds a lxc-*/proxmox-* target's tarball/disk image and creates it on a real Proxmox node, or reconfigures an existing resource's cores/memory/disk (--modify, always requires typing the VMID back to confirm). Refuses to create a new resource for a VMID that already exists, and refuses to duplicate a host identity that already has a real deployment elsewhere (variables.nix's new deployedTargets, checked by hostName so it also catches cross-platform duplicates) unless --allow-duplicate-host is passed. --dry-run throughout. scripts/env.sh centralizes the Proxmox connection config both scripts (and future ones) share. Also fixes an unrelated gap found along the way: proxmox-* Disko image builds write their .raw file straight into the repo root, and .gitignore never covered it. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot	2026-07-20 10:31:06 +10:00