3 Commits

Include renames

Author	SHA1	Message	Date
beatzaplentyandClaude Sonnet 5	a9a204eaf2	Remove packages.all bundle and the installer's own proxmox-lxc target ... Both existed only so the installer could boot as an LXC container and nixos-install some other host from within it, but lxc-* targets are already excluded from the install menu (nixos-install can't touch its own running root filesystem), and now have their own direct tarball path anyway. That left the installer's own LXC form with no real use case, and packages.all with only two members worth bundling. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot	2026-07-20 08:04:08 +10:00
beatzaplentyandClaude Sonnet 5	ff021ca6f7	Consolidate CI on codex-maintenance.sh; clean up dead scripts and docs ... Both check-nixos.yml workflows (GitHub + Gitea) now call scripts/codex-maintenance.sh instead of a hand-rolled eval-only loop, closing a real gap: CI previously enforced none of the secret grep, nixpkgs-fmt, or statix checks that codex-maintenance.sh already runs locally — nothing was stopping that from regressing. One script now backs both, instead of two copies that can drift from each other. codex-maintenance.sh itself is extended to cover buildable surface that wasn't validated anywhere before: packages.x86_64-linux.*, plus config.system.build.tarball (lxc-* hosts) and config.system.build.diskoImagesScript (proxmox-*, excluding the installer's own proxmox-lxc target, which has no disko config). Also: - scripts/prepare-host-key.sh: dropped the redundant [path-to-nixos-repo] parameter — it always defaults to the repo the script itself lives in now, so a second argument never made sense after the nix-auto-installer migration. - Removed prepare.sh (dead pre-disko manual parted/mkfs/mkswap partitioning, fully superseded) and scripts/create-linode-installer-disk.sh (incomplete draft for an abandoned dd-via-rescue-mode approach; Linode hosts already deploy fine through the normal auto-installer flow). - docs/pxe-boot.md: fixed a stale `nixosConfigurations.pxe-boot` eval command (pre-refactor flat name, not a real flake attribute anymore) and added a cross-reference to docs/auto-installer.md. - CLAUDE.md/README.md: full documentation pass reconciling this session's changes — modules/installer/, modules/pxe-boot/, the LXC/Proxmox image-building deployment paths, corrected the password-hash/SSH-key locations in the safety-rules section (both had drifted to reference files/paths that no longer exist), and added session-workflow guidance to prefer targeted host evals over full-repo sweeps for incremental changes (explicitly scoped to interactive sessions, not CI). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot	2026-07-20 07:02:23 +10:00
beatzaplentyandClaude Sonnet 5	f55e33b807	Migrate host-key tooling from nix-auto-installer, bake keys into images ... Finishes the nix-auto-installer migration: scripts/prepare-host-key.sh and the local host-keys/ directory (gitignored, private key material, never committed — moved as plain files, not through git history) weren't carried over in the initial migration. Also implements automatic key staging, replacing the manual scp-after-boot step: - modules/installer/host-keys.nix reads host-keys/ via builtins.getEnv, which Nix silently returns as "" under normal (non---impure) evaluation — the module is a no-op by default, safe for CI, until explicitly opted into: NIXOS_HOST_KEYS_DIR=$(pwd)/host-keys nix build .#iso --impure When built this way every key present gets baked into the image at /etc/host-keys/, and auto-install.sh installs whichever one matches the flake target selected at install time — no manual per-host scp. - This deliberately includes the PXE netboot variant, even though pxe-boot serves it unauthenticated over LAN HTTP: accepted explicitly as a reasonable trade-off for a network that sits behind LAN-only infrastructure, not the open internet. auto-install.sh still falls back to /root/host-keys (manual scp) if a key isn't baked in, so images built without --impure keep working exactly as before. - docs/auto-installer.md replaces nix-auto-installer's README, updated for in-repo paths and the new build flow. Verified: normal `nix eval` (no --impure) evaluates identically across all 19 nixosConfigurations + 4 packages with zero host-keys/* entries (CI-unaffected); with --impure + the env var set, all three installer variants (installer/ISO, proxmox-lxc, pxe) correctly embed every key in host-keys/. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot	2026-07-20 04:41:34 +10:00