6 Commits

Include renames

Author	SHA1	Message	Date
beatzaplentyandClaude Sonnet 5	f5ef3194d4	Fix remote-build bootstrap: retry on partial failure, fix sudo-less root Nix install ... Two bugs found running scripts/create-proxmox-resource.sh against a real Proxmox node for the first time: - The Nix installer's single-user root path still shells out to `sudo` to create /nix even though it already detected it's running as root, which fails outright on a minimal, sudo-less Debian/Proxmox node. codex-setup.sh now pre-creates /nix itself so that branch of the installer is skipped. - ensure_remote_repo() only ran scripts/codex-setup.sh right after a fresh git clone, so a bootstrap that cloned the repo but then failed installing Nix (exactly the failure above) left every subsequent run silently building with a `nix` that was never actually installed, since the repo already existing skipped tooling setup entirely. It now checks `command -v nix` (via the same ensure_nix_profile used elsewhere, since a non-interactive ssh session won't otherwise have a single-user install on PATH) on every run and re-bootstraps if it's missing. Both remote build heredocs also now source scripts/lib/nix-bootstrap.sh themselves for the same PATH reason. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-20 14:39:43 +00:00
rootandClaude Sonnet 5	7e51168d1b	Deduplicate reusable shell code in scripts/ into scripts/lib/ ... Three chunks of copy-pasted logic were drifting across scripts/*.sh: - codex-setup.sh and codex-maintenance.sh each carried an identical NIX_CONFIG bootstrap + ensure_nix_profile() -> scripts/lib/nix-bootstrap.sh - sync-host-keys.sh and prepare-host-key.sh each ran the same ssh-keygen/ssh-to-age nix-shell invocations -> scripts/lib/ssh-host-keys.sh (prepare-host-key.sh now also calls env.sh's nix_extra_opts before using them, closing a gap where it alone skipped the nix-cache reachability check env.sh exists for) - the "list nixosConfigurations attrNames" / "get one target's hostName" nix eval pattern was repeated across codex-setup.sh, codex-maintenance.sh, sync-host-keys.sh and create-proxmox-resource.sh (the latter twice, in its own --list and --host lookup) -> scripts/lib/nix-eval.sh, which also centralizes the --no-use-registries --no-accept-flake-config flag pair used on every such call Verified against the real flake/node config (nix is available here): create-proxmox-resource.sh --list for both --type lxc/vm, a full --dry-run create, and prepare-host-key.sh generating and cleaning up a real key/age-pubkey pair. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-20 10:35:49 +00:00
beatzaplentyandClaude Sonnet 5	71d052e737	Migrate live secrets to sops-nix (Milestone 2) ... Audited the working tree and full git history for committed secrets (gitleaks + trufflehog + manual grep, see secrets-inventory.md, kept local/gitignored per the spec). Found: a password hash shared by root and the nixos user across every host, two live Beszel monitoring tokens, and a GitHub fine-grained PAT embedded in a home-manager nix.conf. Migrates all of them to sops-nix: - .sops.yaml + secrets/*.yaml, encrypted for admin + the age keys derived (via ssh-to-age) from each live host's existing SSH host key — no new key material transferred to any machine. - users.users.{root,nixos}.hashedPasswordFile replaces the inline hashedPassword shared by every target. - The GitHub PAT moves from a home-manager-managed, store-visible nix.conf to a sops.templates-rendered file included via nix.conf's native !include, system-wide instead of per-user. - Beszel TOKEN moves from `environment` (store-visible) to `environmentFile` (runtime-only via sops.templates); the dead commented-out docker token is removed from the tree entirely. Added a tracked pre-commit hook (gitleaks protect --staged, wired via core.hooksPath) so a secret can't be committed by accident again, and documented the sops workflow in README.md. Structural verification only: all 17 flake targets evaluate, and `nix build --dry-run --no-link` succeeds for the three currently deployed hosts. Per CLAUDE.md, actual `nixos-rebuild switch` — the step that confirms secrets decrypt and services start on a real machine — is left for manual verification. Git history still contains the original plaintext secrets; scrubbing history (Milestone 3) and rotating every credential (Milestone 4) are separate, deliberately gated steps per remove-sensetive-info-refactor.md. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-19 12:46:39 +10:00
beatz174-bit	26eec71b8c	Fix pure eval and harden nix script bootstrap	2026-05-12 11:09:23 +10:00
beatzaplenty	554f484593	update setup script	2026-05-12 07:15:12 +10:00
beatzaplenty	7de7c76597	Add codex environment scripts, README and AGENTS	2026-05-12 07:02:43 +10:00