nixos

828 Commits 70 Branches 0 Tags

2 Commits

Include renames

Author	SHA1	Message	Date
beatzaplentyandClaude Sonnet 4.6	d74efd9f66	feat(secrets): add push-host-keys.sh; integrate into sync/recover scripts Check NixOS configurations / eval-hosts (pull_request) Successful in 10m18s Details New script: scripts/secrets/push-host-keys.sh - Pushes newly-generated SSH host keys from host-keys/ to already-running NixOS hosts after sync-host-keys.sh --regenerate-all-keys. - Before pushing any key, checks that .sops.yaml and secrets/*.yaml are committed and pushed to the remote Gitea flake (hosts rebuild from there, so recipient changes must land first); offers to auto-commit/push if not. - Reads /etc/flake-target from each host to confirm which key to install, handling the case where multiple flake targets share a hostname. - Deduplicates by hostname in --all mode; skips hand-registered targets that have no host-keys/ entry. - --dry-run, --skip-git-check, SSH_USER override (default: nixos). sync-host-keys.sh --regenerate-all-keys: - Updated pre-confirmation warning to distinguish already-running hosts (need push-host-keys.sh) from not-yet-deployed hosts (need installer image rebuild). - Added next-steps block after regeneration completes pointing to push-host-keys.sh --all. recover-hosts.sh: - Header and SSH host key mismatch warn now cross-reference push-host-keys.sh as the proactive (pre-drift) alternative. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-25 15:29:16 +10:00
beatzaplentyandClaude Sonnet 4.6	dce3788499	fix(lxc): prevent SSH host key deletion on every rebuild; add recovery script Check NixOS configurations / eval-hosts (pull_request) Successful in 10m33s Details NixOS's etc activation removes files that were in a previous generation's environment.etc but absent from the current one -- even real copies, not only symlinks. LXC tarballs bake the host key into environment.etc (via NIXOS_HOST_KEYS_DIR), but every subsequent nixos-rebuild switch lacks that env var, so the key is removed as "obsolete". sops-nix derives its age decryption key from /etc/ssh/ssh_host_ed25519_key, so deletion cascades into "Error getting data key: 0 successful groups required, got 0" for every sops secret on the host. Fix: two activation scripts bracket the etc step. preserveSshHostKey (no deps, runs before etc): copies the live key to /run (tmpfs) before etc can delete it. restoreSshHostKey (deps=[etc], runs after etc): reinstalls via `install` if etc removed the key. The resulting file is not tracked in either generation's environment.etc, so subsequent rebuilds leave it alone. scripts/recover-hosts.sh: restore both private and public key files (not just the private key), use install(1) for atomic mode setting, and add a post-rebuild sops-nix verification step to confirm success. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014zT1L6hmsq6i1evAEH7dmi	2026-07-24 09:17:58 +10:00

Author

SHA1

Message

Date

beatzaplentyandClaude Sonnet 4.6

d74efd9f66

feat(secrets): add push-host-keys.sh; integrate into sync/recover scripts

Check NixOS configurations / eval-hosts (pull_request) Successful in 10m18s

Details

New script: scripts/secrets/push-host-keys.sh
- Pushes newly-generated SSH host keys from host-keys/ to already-running
  NixOS hosts after sync-host-keys.sh --regenerate-all-keys.
- Before pushing any key, checks that .sops.yaml and secrets/*.yaml are
  committed and pushed to the remote Gitea flake (hosts rebuild from there,
  so recipient changes must land first); offers to auto-commit/push if not.
- Reads /etc/flake-target from each host to confirm which key to install,
  handling the case where multiple flake targets share a hostname.
- Deduplicates by hostname in --all mode; skips hand-registered targets
  that have no host-keys/ entry.
- --dry-run, --skip-git-check, SSH_USER override (default: nixos).

sync-host-keys.sh --regenerate-all-keys:
- Updated pre-confirmation warning to distinguish already-running hosts
  (need push-host-keys.sh) from not-yet-deployed hosts (need installer
  image rebuild).
- Added next-steps block after regeneration completes pointing to
  push-host-keys.sh --all.

recover-hosts.sh:
- Header and SSH host key mismatch warn now cross-reference
  push-host-keys.sh as the proactive (pre-drift) alternative.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-07-25 15:29:16 +10:00

beatzaplentyandClaude Sonnet 4.6

dce3788499

fix(lxc): prevent SSH host key deletion on every rebuild; add recovery script

Check NixOS configurations / eval-hosts (pull_request) Successful in 10m33s

Details

NixOS's etc activation removes files that were in a previous generation's
environment.etc but absent from the current one -- even real copies, not
only symlinks.  LXC tarballs bake the host key into environment.etc (via
NIXOS_HOST_KEYS_DIR), but every subsequent nixos-rebuild switch lacks that
env var, so the key is removed as "obsolete".  sops-nix derives its age
decryption key from /etc/ssh/ssh_host_ed25519_key, so deletion cascades
into "Error getting data key: 0 successful groups required, got 0" for
every sops secret on the host.

Fix: two activation scripts bracket the etc step.
  preserveSshHostKey (no deps, runs before etc): copies the live key to
    /run (tmpfs) before etc can delete it.
  restoreSshHostKey (deps=[etc], runs after etc): reinstalls via `install`
    if etc removed the key.  The resulting file is not tracked in either
    generation's environment.etc, so subsequent rebuilds leave it alone.

scripts/recover-hosts.sh: restore both private and public key files (not
just the private key), use install(1) for atomic mode setting, and add a
post-rebuild sops-nix verification step to confirm success.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014zT1L6hmsq6i1evAEH7dmi

2026-07-24 09:17:58 +10:00