3 Commits

Include renames

Author	SHA1	Message	Date
beatzaplentyandClaude Sonnet 5	9ef2efad88	Fix LXC deployment path and clean up remaining eval warnings ... LXC hosts (device busy fix): modules/platforms/lxc.nix now imports nixpkgs' own virtualisation/proxmox-lxc.nix, giving every lxc-* host a real config.system.build.tarball output — a directly `pct restore`-able Proxmox container image. This is the actual bug fix behind the "cannot remove real root directory: device busy or in use" error: lxc-* targets were only reachable through nixos-install, which bind-mounts / onto /mnt for containers (no raw disk to partition) and then correctly refuses to modify the filesystem it's currently running on. auto-install.sh's menu now excludes lxc-* targets entirely (they deploy via nix build + pct restore instead, see docs/auto-installer.md) — and, on the same reasoning, also excludes `installer`/`proxmox-lxc`, which are the installer image's own flake targets, not deployable hosts. manageHostName = true keeps host.nix's declared hostnames (upstream's default would let Proxmox's ambient container config win instead); privileged = false matches how these containers are actually created. Eval warnings, now zero across all 19 nixosConfigurations + 4 packages: - Multiple password options (root/nixos in the installer): nixpkgs' own installer profile sets initialHashedPassword = "" for passwordless login, conflicting with our explicit hashedPassword. Force-nulled the upstream option rather than adopting passwordless login, since this image now also boots over LAN PXE with PasswordAuthentication enabled. - boot.zfs.forceImportRoot default value: set explicitly to false (matching the two places that already did) in modules/common/configuration.nix and modules/installer/common.nix, covering every host and the installer alike. - Deprecated pkgs.system in modules/build-types/gui.nix: switched to pkgs.stdenv.hostPlatform.system. All confirmed non-behavioral where it matters: unrelated hosts' drvPaths are byte-identical to their pre-existing baselines throughout. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot	2026-07-20 05:58:56 +10:00
beatzaplentyandClaude Sonnet 5	f55e33b807	Migrate host-key tooling from nix-auto-installer, bake keys into images ... Finishes the nix-auto-installer migration: scripts/prepare-host-key.sh and the local host-keys/ directory (gitignored, private key material, never committed — moved as plain files, not through git history) weren't carried over in the initial migration. Also implements automatic key staging, replacing the manual scp-after-boot step: - modules/installer/host-keys.nix reads host-keys/ via builtins.getEnv, which Nix silently returns as "" under normal (non---impure) evaluation — the module is a no-op by default, safe for CI, until explicitly opted into: NIXOS_HOST_KEYS_DIR=$(pwd)/host-keys nix build .#iso --impure When built this way every key present gets baked into the image at /etc/host-keys/, and auto-install.sh installs whichever one matches the flake target selected at install time — no manual per-host scp. - This deliberately includes the PXE netboot variant, even though pxe-boot serves it unauthenticated over LAN HTTP: accepted explicitly as a reasonable trade-off for a network that sits behind LAN-only infrastructure, not the open internet. auto-install.sh still falls back to /root/host-keys (manual scp) if a key isn't baked in, so images built without --impure keep working exactly as before. - docs/auto-installer.md replaces nix-auto-installer's README, updated for in-repo paths and the new build flow. Verified: normal `nix eval` (no --impure) evaluates identically across all 19 nixosConfigurations + 4 packages with zero host-keys/* entries (CI-unaffected); with --impure + the env var set, all three installer variants (installer/ISO, proxmox-lxc, pxe) correctly embed every key in host-keys/. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot	2026-07-20 04:41:34 +10:00
beatzaplentyandClaude Sonnet 5	0f7ab6fe7f	Migrate nix-auto-installer into this flake ... Folds the separate nix-auto-installer repo's build outputs into this flake so it can build every auto-installer artifact it used to, negating the need for that repo: - modules/installer/{common,iso,proxmox-lxc}.nix — migrated from nix-auto-installer's common.nix/installer.nix/proxmox-lxc.nix. - flake.nix gains nixosConfigurations.{installer,proxmox-lxc} and packages.x86_64-linux.{iso,lxc,pxe,all}, matching the original repo's interface (nix build .#iso / .#lxc / .#pxe / .#all). - Dropped the live Gitea PAT baked into every installer image via environment.etc."git-credentials" — gitea.lan.ddnsgeek.com/beatzaplenty/nixos.git allows anonymous read, so the installer (which only ever reads the flake, never pushes) doesn't need a credential at all. - installer_old.nix wasn't migrated — dead code, unreferenced by the source repo's flake.nix, and carried a second stale leaked token. - The installer environment's own hardcoded login password hash is preserved as-is: sops-nix has no stable per-boot host key to derive an age key from on ephemeral installer media, so it can't reuse the same per-host secret mechanism the rest of this repo uses without separate design work. - vars.adminSshKey / vars.dockerHost-style dedup: the installer's SSH authorized key and its FLAKE_BASE_URL domain were exact duplicates of values already in variables.nix / modules/common/configuration.nix, so both now reference the single source of truth instead. Verified eval-equivalent for every existing host (drvPath-identical) and confirmed the migrated auto-install.sh script renders byte-for-byte identical to the source repo's output. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot	2026-07-20 03:47:19 +10:00