nixos

638 Commits 70 Branches 0 Tags

2 Commits

Include renames

Author	SHA1	Message	Date
beatzaplentyandClaude Sonnet 4.6	6e1e992652	fix(proxmox): embed SSH host key via NIXOS_HOST_KEYS_DIR so sops can decrypt on first boot Check NixOS configurations / eval-hosts (pull_request) Successful in 10m30s Details --pre-format-files placed the key on the QEMU builder VM's rootfs, not the target disk. nixos-install chroots into the target and runs sshd-keygen, which found no key in the chroot and generated a fresh (unregistered) one. sops then could not decrypt on first boot because the key didn't match .sops.yaml, leaving both root and nixos with '!' in /etc/shadow even after mutableUsers = false was set (hashedPasswordFile pointed to paths sops never wrote). Fix modules/platforms/proxmox.nix to embed the clan SSH host key in environment.etc via NIXOS_HOST_KEYS_DIR at eval time -- the same pattern lxc.nix uses. nixos-install's own activation places the key on the target disk, sshd-keygen finds it already present and skips generation, and sops decrypts correctly on first boot. Includes the same preserveSshHostKey/restoreSshHostKey activation scripts as lxc.nix so subsequent nixos-rebuild switch calls (without NIXOS_HOST_KEYS_DIR) don't remove the key as "obsolete" from environment.etc. Update create-proxmox-resource.sh: switch VM builds from ./result-<target> --pre-format-files ... --build-memory 2048 to NIXOS_HOST_KEYS_DIR=$(pwd)/host-keys nix build --impure ... diskoImagesScript ./result-<target> --build-memory 2048 matching the LXC build path. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011uRcikkTp3D5VbXj2DwNpQ	2026-07-26 08:54:39 +10:00
beatzaplentyandClaude Sonnet 5	e76486efbe	Refactor flake targets into platform x build-type matrix Generates all nixosConfigurations from mkTarget(platform, buildType, hostPath) instead of hand-written per-host blocks, so adding a new platform or build type is a one-line addition. Per-machine identity (hostname, hostId, secrets, stateVersion) moves into hosts/<name>/host.nix; platform-specific config (hardware, boot, networking) into modules/platforms/.nix; build-type config (minimal/server/docker/gui/ nix-cache/pxe-boot) into modules/build-types/.nix. Old flat targets (nixos, docker, server, nix-cache, nix-minimal, pxe-boot) are replaced by the 17-target <platform>-<buildtype> matrix; each new target was verified to evaluate before its old counterpart was removed. CI workflows and docs/aliases now discover hosts dynamically via nixosConfigurations attrNames and /etc/flake-target instead of hardcoded lists, so they can't drift from flake.nix again. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-19 12:03:33 +10:00

Author

SHA1

Message

Date

beatzaplentyandClaude Sonnet 4.6

6e1e992652

fix(proxmox): embed SSH host key via NIXOS_HOST_KEYS_DIR so sops can decrypt on first boot

Check NixOS configurations / eval-hosts (pull_request) Successful in 10m30s

Details

--pre-format-files placed the key on the QEMU builder VM's rootfs, not the
target disk. nixos-install chroots into the target and runs sshd-keygen, which
found no key in the chroot and generated a fresh (unregistered) one. sops then
could not decrypt on first boot because the key didn't match .sops.yaml, leaving
both root and nixos with '!' in /etc/shadow even after mutableUsers = false was
set (hashedPasswordFile pointed to paths sops never wrote).

Fix modules/platforms/proxmox.nix to embed the clan SSH host key in
environment.etc via NIXOS_HOST_KEYS_DIR at eval time -- the same pattern
lxc.nix uses. nixos-install's own activation places the key on the target disk,
sshd-keygen finds it already present and skips generation, and sops decrypts
correctly on first boot. Includes the same preserveSshHostKey/restoreSshHostKey
activation scripts as lxc.nix so subsequent nixos-rebuild switch calls (without
NIXOS_HOST_KEYS_DIR) don't remove the key as "obsolete" from environment.etc.

Update create-proxmox-resource.sh: switch VM builds from
  ./result-<target> --pre-format-files ... --build-memory 2048
to
  NIXOS_HOST_KEYS_DIR=$(pwd)/host-keys nix build --impure ... diskoImagesScript
  ./result-<target> --build-memory 2048
matching the LXC build path.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011uRcikkTp3D5VbXj2DwNpQ

2026-07-26 08:54:39 +10:00

beatzaplentyandClaude Sonnet 5

e76486efbe

Refactor flake targets into platform x build-type matrix

Generates all nixosConfigurations from mkTarget(platform, buildType,
hostPath) instead of hand-written per-host blocks, so adding a new
platform or build type is a one-line addition. Per-machine identity
(hostname, hostId, secrets, stateVersion) moves into hosts/<name>/host.nix;
platform-specific config (hardware, boot, networking) into
modules/platforms/*.nix; build-type config (minimal/server/docker/gui/
nix-cache/pxe-boot) into modules/build-types/*.nix.

Old flat targets (nixos, docker, server, nix-cache, nix-minimal, pxe-boot)
are replaced by the 17-target <platform>-<buildtype> matrix; each new
target was verified to evaluate before its old counterpart was removed.
CI workflows and docs/aliases now discover hosts dynamically via
nixosConfigurations attrNames and /etc/flake-target instead of hardcoded
lists, so they can't drift from flake.nix again.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-07-19 12:03:33 +10:00