6 Commits

Include renames

Author	SHA1	Message	Date
beatzaplentyandClaude Sonnet 5	fd773b65da	Fix nix-cache remote-builder trust: stale host key + wrong sshKey path ... variables.nix's nixCacheHostKey no longer matched nix-cache's actual SSH host key (confirmed via ssh-keyscan against the live container), so every declaratively-configured client's programs.ssh.knownHosts trusted the wrong key -- distributed builds would fail host-key verification. Also, modules/nix-cache/remote-builder-client.nix hardcoded sshKey to /root/.ssh/nixremote, but the `server` host only has its own default /root/.ssh/id_ed25519 installed (confirmed live via qm guest-agent) -- that file was never even present, so the build machine config pointed at nothing. Standardize on each client's own default identity, matching the per-host-key pattern vars.remoteBuilderAuthorizedKeys already uses instead of a shared/differently-named keypair, and add scripts/secrets/sync-nix-cache-host-key.sh (wired into codex-maintenance.sh's --check) so the host-key drift doesn't silently recur next time nix-cache is rebuilt or recreated. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V7yVH71vGrDVzovh9UaMu8	2026-07-20 17:21:12 +00:00
beatzaplentyandClaude Sonnet 5	75f1342339	Declaratively trust nix-cache's SSH host key on remote-builder clients ... Distributed builds failed with "Host key verification failed" on any client that had never manually SSH'd to nix-cache before, since nothing populated root's known_hosts for it. Wire nix-cache's host public key into programs.ssh.knownHosts via a new vars.nixCacheHostKey so every client picks it up automatically on rebuild. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-20 17:21:48 +10:00
beatzaplentyandClaude Sonnet 5	53b9a64826	Move nix-cache's binary cache signing key into sops ... nix-serve's secretKeyFile was a manual, undocumented-outside-a-comment `nix-store --generate-binary-cache-key` step per host -- easy to miss on a fresh nix-cache instance (as lxc-nix-cache testing just found: systemd fails the unit with EXIT_CREDENTIALS when LoadCredential can't find the source file, which nginx then reports as a 502 from clients). It also can't be regenerated per-host safely: modules/nix-cache/client.nix hardcodes every client's trust in one specific public key, so every nix-cache instance has to share the exact same keypair. Sourced from secrets/nix-cache.yaml's new cache-priv-key entry instead, via the same sops-nix pattern every other secret in this repo already uses. Verified the added value derives to the exact public key modules/nix-cache/client.nix already trusts before committing. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot	2026-07-20 09:49:30 +10:00
beatzaplentyandClaude Sonnet 5	745f4d6fb4	Refresh stale architecture docs ... CLAUDE.md's "Composition pattern" section still described the pre-refactor layout (hosts/<host>/configuration.nix as a thin imports list, hardware-configuration wired in from flake.nix) from before the platform x build-type matrix landed. Rewrite it to match the current mkTarget/host.nix architecture and the module moves from the prior commit. Also fixes docs/nix-cache.md, which referenced a modules/nix/ path that never existed in this repo. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot	2026-07-20 02:58:25 +10:00
beatzaplenty	3259391451	updated documentation	2026-06-01 18:22:05 +10:00
beatz174-bit	26eec71b8c	Fix pure eval and harden nix script bootstrap	2026-05-12 11:09:23 +10:00