3 Commits

Include renames

Author	SHA1	Message	Date
beatzaplentyandClaude Sonnet 5	a2b557c034	Lift duplicated sops/age and confirm-prompt logic into scripts/lib/ ... scripts/backup-admin-key.sh, rotate-admin-key.sh, and sync-host-keys.sh each independently resolved sops/age's default key-file path, derived an age pubkey from an identity file, and (two of them) ran `sops updatekeys` the same way -- now shared via scripts/lib/sops-age.sh. Also extracted the "type X to confirm" prompt duplicated across create-proxmox-resource.sh and sync-host-keys.sh into scripts/lib/confirm.sh. Pure extraction, no behavior change -- each call site produces identical commands/output to before. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-20 15:38:32 +00:00
rootandClaude Sonnet 5	7e51168d1b	Deduplicate reusable shell code in scripts/ into scripts/lib/ ... Three chunks of copy-pasted logic were drifting across scripts/*.sh: - codex-setup.sh and codex-maintenance.sh each carried an identical NIX_CONFIG bootstrap + ensure_nix_profile() -> scripts/lib/nix-bootstrap.sh - sync-host-keys.sh and prepare-host-key.sh each ran the same ssh-keygen/ssh-to-age nix-shell invocations -> scripts/lib/ssh-host-keys.sh (prepare-host-key.sh now also calls env.sh's nix_extra_opts before using them, closing a gap where it alone skipped the nix-cache reachability check env.sh exists for) - the "list nixosConfigurations attrNames" / "get one target's hostName" nix eval pattern was repeated across codex-setup.sh, codex-maintenance.sh, sync-host-keys.sh and create-proxmox-resource.sh (the latter twice, in its own --list and --host lookup) -> scripts/lib/nix-eval.sh, which also centralizes the --no-use-registries --no-accept-flake-config flag pair used on every such call Verified against the real flake/node config (nix is available here): create-proxmox-resource.sh --list for both --type lxc/vm, a full --dry-run create, and prepare-host-key.sh generating and cleaning up a real key/age-pubkey pair. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-20 10:35:49 +00:00
beatzaplentyandClaude Sonnet 5	bd8d93d890	Add sync-host-keys.sh and create-proxmox-resource.sh ... sync-host-keys.sh: generates/registers SSH host keys and their .sops.yaml/secrets/*.yaml recipients for flake targets, idempotently. --all, <target>, --remove, --regenerate-all-keys, all with --dry-run (verified zero-side-effect via a sandboxed git-status check across every mode). Only ever touches anchors with a corresponding host-keys/ file -- &admin and any hand-registered real-host anchor are never listed, removed, or regenerated. Supersedes running prepare-host-key.sh one host at a time for any target that already has a flake entry. create-proxmox-resource.sh: builds a lxc-*/proxmox-* target's tarball/disk image and creates it on a real Proxmox node, or reconfigures an existing resource's cores/memory/disk (--modify, always requires typing the VMID back to confirm). Refuses to create a new resource for a VMID that already exists, and refuses to duplicate a host identity that already has a real deployment elsewhere (variables.nix's new deployedTargets, checked by hostName so it also catches cross-platform duplicates) unless --allow-duplicate-host is passed. --dry-run throughout. scripts/env.sh centralizes the Proxmox connection config both scripts (and future ones) share. Also fixes an unrelated gap found along the way: proxmox-* Disko image builds write their .raw file straight into the repo root, and .gitignore never covered it. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot	2026-07-20 10:31:06 +10:00