2 Commits

Include renames

Author	SHA1	Message	Date
beatzaplentyandClaude Sonnet 5	ff021ca6f7	Consolidate CI on codex-maintenance.sh; clean up dead scripts and docs ... Both check-nixos.yml workflows (GitHub + Gitea) now call scripts/codex-maintenance.sh instead of a hand-rolled eval-only loop, closing a real gap: CI previously enforced none of the secret grep, nixpkgs-fmt, or statix checks that codex-maintenance.sh already runs locally — nothing was stopping that from regressing. One script now backs both, instead of two copies that can drift from each other. codex-maintenance.sh itself is extended to cover buildable surface that wasn't validated anywhere before: packages.x86_64-linux.*, plus config.system.build.tarball (lxc-* hosts) and config.system.build.diskoImagesScript (proxmox-*, excluding the installer's own proxmox-lxc target, which has no disko config). Also: - scripts/prepare-host-key.sh: dropped the redundant [path-to-nixos-repo] parameter — it always defaults to the repo the script itself lives in now, so a second argument never made sense after the nix-auto-installer migration. - Removed prepare.sh (dead pre-disko manual parted/mkfs/mkswap partitioning, fully superseded) and scripts/create-linode-installer-disk.sh (incomplete draft for an abandoned dd-via-rescue-mode approach; Linode hosts already deploy fine through the normal auto-installer flow). - docs/pxe-boot.md: fixed a stale `nixosConfigurations.pxe-boot` eval command (pre-refactor flat name, not a real flake attribute anymore) and added a cross-reference to docs/auto-installer.md. - CLAUDE.md/README.md: full documentation pass reconciling this session's changes — modules/installer/, modules/pxe-boot/, the LXC/Proxmox image-building deployment paths, corrected the password-hash/SSH-key locations in the safety-rules section (both had drifted to reference files/paths that no longer exist), and added session-workflow guidance to prefer targeted host evals over full-repo sweeps for incremental changes (explicitly scoped to interactive sessions, not CI). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot	2026-07-20 07:02:23 +10:00
beatzaplentyandClaude Sonnet 5	f55e33b807	Migrate host-key tooling from nix-auto-installer, bake keys into images ... Finishes the nix-auto-installer migration: scripts/prepare-host-key.sh and the local host-keys/ directory (gitignored, private key material, never committed — moved as plain files, not through git history) weren't carried over in the initial migration. Also implements automatic key staging, replacing the manual scp-after-boot step: - modules/installer/host-keys.nix reads host-keys/ via builtins.getEnv, which Nix silently returns as "" under normal (non---impure) evaluation — the module is a no-op by default, safe for CI, until explicitly opted into: NIXOS_HOST_KEYS_DIR=$(pwd)/host-keys nix build .#iso --impure When built this way every key present gets baked into the image at /etc/host-keys/, and auto-install.sh installs whichever one matches the flake target selected at install time — no manual per-host scp. - This deliberately includes the PXE netboot variant, even though pxe-boot serves it unauthenticated over LAN HTTP: accepted explicitly as a reasonable trade-off for a network that sits behind LAN-only infrastructure, not the open internet. auto-install.sh still falls back to /root/host-keys (manual scp) if a key isn't baked in, so images built without --impure keep working exactly as before. - docs/auto-installer.md replaces nix-auto-installer's README, updated for in-repo paths and the new build flow. Verified: normal `nix eval` (no --impure) evaluates identically across all 19 nixosConfigurations + 4 packages with zero host-keys/* entries (CI-unaffected); with --impure + the env var set, all three installer variants (installer/ISO, proxmox-lxc, pxe) correctly embed every key in host-keys/. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot	2026-07-20 04:41:34 +10:00