fix(create-proxmox-resource): case-insensitive importdisk parse + warn on --disk-size for VMs

qm importdisk in QEMU 11.x outputs lowercase "successfully imported disk
as '...'" rather than the capitalised form the original grep expected.
The case mismatch made disk_id always empty, which caused the script to
exit 1 after qm create had already run -- leaving the VM with only an
EFI disk, no scsi0, and boot order still set to net0.

Fix by adding -i (case-insensitive) to the grep. Both the old capitalised
format (where the disk id had an "unused0:" prefix inside the quotes) and
the new lowercase format are handled correctly: the sed strip of unused0:
is preserved for backward compatibility, and the regex result is identical
either way.

Also add an early warning when --disk-size is passed for --type vm: the
flag is LXC-only for create mode and was silently ignored, leaving users
expecting a different size than the proxmoxImageSize in variables.nix.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

modules/common/configuration.nix

@@ -61,32 +61,24 @@
     !include ${config.sops.templates."nix-github-token.conf".path}
   '';
 
-  users = {
-    # With mutableUsers = false, update-users-groups.pl enforces hashedPasswordFile
-    # on every activation regardless of whether the account already exists in
-    # /etc/shadow. The default (true) only applies hashedPasswordFile to newly-
-    # created accounts — which means a freshly-built proxmox disk image (where
-    # activation runs without a usable sops key, so both accounts land in shadow
-    # with ‘!’) will never have its passwords fixed by subsequent boots.
-    mutableUsers = false;
+  #Set root password
+  users.users.root = {
+    hashedPasswordFile = config.sops.secrets."root-hashedPassword".path;
+  };
 
-    users.root = {
-      hashedPasswordFile = config.sops.secrets."root-hashedPassword".path;
-    };
-
-    users.${vars.primaryUser} = {
-      isNormalUser = true;
-      extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
-      packages = with pkgs; [
-        tree
-      ];
-      hashedPasswordFile = config.sops.secrets."nixos-hashedPassword".path;
-      openssh.authorizedKeys.keys = [
-        vars.adminSshKey
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMJhrfFayLBG+gWtO6oAvgambw5nWWgztiTFEaaaVRH debian@surface"
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGygkCljN6uKpdJbHTOQtn8ZnH+wKXDLAwrDFbLrE/65 nixos@nixos"
-      ];
-    };
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  users.users.${vars.primaryUser} = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
+    packages = with pkgs; [
+      tree
+    ];
+    hashedPasswordFile = config.sops.secrets."nixos-hashedPassword".path;
+    openssh.authorizedKeys.keys = [
+      vars.adminSshKey
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMJhrfFayLBG+gWtO6oAvgambw5nWWgztiTFEaaaVRH debian@surface"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGygkCljN6uKpdJbHTOQtn8ZnH+wKXDLAwrDFbLrE/65 nixos@nixos"
+    ];
   };
 
 

modules/platforms/proxmox.nix

@@ -1,81 +1,9 @@
-{ lib, flakeTarget, ... }:
+{ ... }:
 
-let
-  # Bakes this exact flake target's pre-generated SSH host key straight
-  # into /etc/ssh/ -- mirrors lxc.nix's builtins.getEnv pattern (impure
-  # and empty under normal `nix build`/`nix eval`, so this is a no-op
-  # unless explicitly opted into with NIXOS_HOST_KEYS_DIR=... --impure).
-  #
-  # Unlike --pre-format-files (which places files on the QEMU builder VM's
-  # rootfs, not the target disk), embedding via environment.etc here means
-  # nixos-install's own activation step installs the key onto the target
-  # disk. sshd-keygen then finds it already present and skips generation,
-  # so the disk image boots with the clan-registered key and sops can
-  # decrypt on first boot.
-  #
-  # Without this, nixos-install's sshd-keygen activation generates a fresh
-  # key (unregistered in .sops.yaml), sops decryption fails permanently,
-  # and password hashes are never applied -- confirmed live: passwords
-  # stayed '!' even with mutableUsers = false because hashedPasswordFile
-  # pointed to a path that sops never wrote.
-  hostKeysDirStr = builtins.getEnv "NIXOS_HOST_KEYS_DIR";
-  hasHostKeysDir = hostKeysDirStr != "" && builtins.pathExists hostKeysDirStr;
-  hostKeysDir = /. + hostKeysDirStr;
-
-  privKeyFile = hostKeysDir + "/${flakeTarget}_ssh_host_ed25519_key";
-  pubKeyFile = hostKeysDir + "/${flakeTarget}_ssh_host_ed25519_key.pub";
-  hasKeyForThisTarget =
-    hasHostKeysDir
-    && builtins.pathExists privKeyFile
-    && builtins.pathExists pubKeyFile;
-in
 {
   imports = [
     ../hardware-configuration/vm/proxmox.nix
     ../boot/efi.nix
     ../disko/proxmox.nix
   ];
-
-  environment.etc = lib.mkIf hasKeyForThisTarget {
-    "ssh/ssh_host_ed25519_key" = {
-      source = privKeyFile;
-      mode = "0600";
-    };
-    "ssh/ssh_host_ed25519_key.pub" = {
-      source = pubKeyFile;
-      mode = "0644";
-    };
-  };
-
-  # NixOS's etc activation removes any /etc file that was in the previous
-  # generation's environment.etc but is absent from the current one. Since
-  # the SSH key is only in environment.etc during the --impure build (when
-  # NIXOS_HOST_KEYS_DIR is set), normal rebuilds would remove it as
-  # "obsolete". These scripts mirror lxc.nix's approach: save the live key
-  # before etc runs, restore it after. Without the explicit deps, the
-  # topological sort places preserveSshHostKey after etc (confirmed live on
-  # lxc-tor-relay: position 7 vs etc's position 5), so the key is gone
-  # before it can be saved.
-  system.activationScripts = {
-    preserveSshHostKey = ''
-      if [ -f /etc/ssh/ssh_host_ed25519_key ]; then
-        cp /etc/ssh/ssh_host_ed25519_key /run/sshd-host-key-preserve.tmp
-        cp /etc/ssh/ssh_host_ed25519_key.pub /run/sshd-host-key-preserve.pub.tmp
-      fi
-    '';
-
-    restoreSshHostKey = {
-      deps = [ "etc" ];
-      text = ''
-        if [ ! -f /etc/ssh/ssh_host_ed25519_key ] && [ -f /run/sshd-host-key-preserve.tmp ]; then
-          install -m 0600 /run/sshd-host-key-preserve.tmp /etc/ssh/ssh_host_ed25519_key
-          install -m 0644 /run/sshd-host-key-preserve.pub.tmp /etc/ssh/ssh_host_ed25519_key.pub
-        fi
-        rm -f /run/sshd-host-key-preserve.tmp /run/sshd-host-key-preserve.pub.tmp
-      '';
-    };
-
-    etc = { deps = [ "preserveSshHostKey" ]; };
-    setupSecrets = { deps = [ "restoreSshHostKey" ]; };
-  };
 }

scripts/proxmox/create-proxmox-resource.sh

@@ -302,6 +302,12 @@ platform_prefix="lxc"
 [[ -z "$cores" ]] && cores="$PROXMOX_DEFAULT_CORES"
 [[ -z "$memory" ]] && memory="$PROXMOX_DEFAULT_MEMORY_MB"
 
+if [[ "$type" == "vm" && -n "$disk_size" ]]; then
+  echo "WARNING: --disk-size is LXC-only for create mode and is ignored for VMs." >&2
+  echo "  VM disk size comes from proxmoxImageSize in variables.nix (currently ${disk_size}G was requested)." >&2
+  echo "  To expand after creation, use: --modify --vmid <n> --grow-disk <GB>" >&2
+fi
+
 # --- discover / resolve the flake target from --host --------------------
 # Emits "<target>\t<hostName>" pairs for every ${platform_prefix}-* flake
 # target -- the one source both --list and the --host lookup below read
@@ -354,14 +360,6 @@ fi
 # feeds straight into the guest's real hostname) disagree with host.nix.
 [[ -z "$name" ]] && name="$host"
 
-# For VM builds: the diskoImagesScript (run via QEMU on the node) writes the
-# raw disk image as <hostname>.raw into the CWD it was called from (the remote
-# repo dir), not to /var/lib/vz/import/ or anywhere else.  Import directly from
-# there -- no intermediate mv that can fail crossing filesystem boundaries or
-# leave a stale file on error.
-vm_built_raw=""
-[[ "$type" == "vm" ]] && vm_built_raw="${remote_repo_dir}/${host}.raw"
-
 # --- refuse to duplicate a host that's already live on the node ---------
 # Queries the node itself (qm/pct's own name/hostname config), not any
 # static list in this repo -- a file can't track whether a resource still
@@ -696,14 +694,10 @@ if [[ -n "$image" ]]; then
 elif [[ "$force_rebuild" -eq 1 ]]; then
   echo "--force-rebuild: skipping the existing-image check on ${node}."
 else
-  # VMs: check for the raw image in the remote repo dir (where disko writes it).
-  # LXC: check for the tarball in iso_storage (where the LXC build stages it).
-  _check_path="$remote_path"
-  [[ "$type" == "vm" ]] && _check_path="$vm_built_raw"
-  echo "==> Checking whether ${node} already has ${_check_path}..."
+  echo "==> Checking whether ${node} already has ${remote_path}..."
   if [[ "$dry_run" -eq 1 ]]; then
-    echo "[dry-run] would check: ssh ${ssh_target} -- test -f ${_check_path}"
-  elif ssh "$ssh_target" "test -f '${_check_path}'" 2>/dev/null; then
+    echo "[dry-run] would check: ssh ${ssh_target} -- test -f ${remote_path}"
+  elif ssh "$ssh_target" "test -f '${remote_path}'" 2>/dev/null; then
     echo "Found it -- reusing, skipping build (use --force-rebuild to override)."
     image_already_remote=1
   else
@@ -778,29 +772,23 @@ REMOTE_SCRIPT
     fi
   else
     if [[ "$dry_run" -eq 1 ]]; then
-      echo "[dry-run] would build on ${node}: NIXOS_HOST_KEYS_DIR=\$(pwd)/host-keys nix build --impure --no-use-registries --no-accept-flake-config${nix_opts_display} \\"
+      echo "[dry-run] would build on ${node}: nix build --no-use-registries --no-accept-flake-config${nix_opts_display} \\"
       echo "[dry-run]   .#nixosConfigurations.${flake_target}.config.system.build.diskoImagesScript"
-      echo "[dry-run] would run:   ${sudo_display}./result-${flake_target} --build-memory 2048"
-      echo "[dry-run] image will be at ${vm_built_raw} (imported from there; no mv to /var/lib/vz/import/)"
+      echo "[dry-run] would run:   ${sudo_display}./result-${flake_target} \\"
+      echo "[dry-run]                --pre-format-files host-keys/${flake_target}_ssh_host_ed25519_key /etc/ssh/ssh_host_ed25519_key \\"
+      echo "[dry-run]                --pre-format-files host-keys/${flake_target}_ssh_host_ed25519_key.pub /etc/ssh/ssh_host_ed25519_key.pub \\"
+      echo "[dry-run]                --build-memory 2048"
+      echo "[dry-run] would stage the result at ${remote_path}"
       local_image="<built-image>.raw"
     else
       echo "==> Building Disko image for ${flake_target} on ${node}..."
       # See the LXC branch above for why this is one %q-quoted command
       # string rather than separate ssh argv elements.
-      # $7 = image_name (hostname, the diskoImagesScript's own output filename).
-      #
-      # NIXOS_HOST_KEYS_DIR + --impure: modules/platforms/proxmox.nix reads
-      # this env var at eval time (like lxc.nix) to embed the clan SSH host
-      # key in environment.etc. nixos-install's own activation then places the
-      # key on the target disk, so sshd-keygen finds it already present and
-      # skips generation. --pre-format-files put the key on the QEMU builder
-      # VM's rootfs (not the target disk), so sshd-keygen regenerated a fresh
-      # key -- one not registered in .sops.yaml -- and sops could never decrypt.
-      printf -v remote_cmd 'bash -s -- %q %q %q %q %q %q %q' \
-        "$remote_repo_dir" "$flake_target" "$remote_dir" "$remote_filename" "$NIX_EXTRA_OPTS" "$sudo_prefix" "$host"
+      printf -v remote_cmd 'bash -s -- %q %q %q %q %q %q' \
+        "$remote_repo_dir" "$flake_target" "$remote_dir" "$remote_filename" "$NIX_EXTRA_OPTS" "$sudo_prefix"
       ssh "$ssh_target" "$remote_cmd" <<'REMOTE_SCRIPT'
 set -euo pipefail
-repo_dir="$1"; target="$2"; dest_dir="$3"; dest_name="$4"; nix_extra_opts_str="$5"; sudo_pfx="$6"; image_name="$7"
+repo_dir="$1"; target="$2"; dest_dir="$3"; dest_name="$4"; nix_extra_opts_str="$5"; sudo_pfx="$6"
 declare -a NIX_OPTS=()
 [[ -n "$nix_extra_opts_str" ]] && eval "NIX_OPTS=(${nix_extra_opts_str})"
 cd "$repo_dir"
@@ -812,26 +800,24 @@ if [[ ! -f "host-keys/${target}_ssh_host_ed25519_key" ]]; then
   echo "and ensure it was synced here before starting the build." >&2
   exit 1
 fi
-# Build diskoImagesScript with NIXOS_HOST_KEYS_DIR so proxmox.nix embeds the
-# clan SSH key in environment.etc (same as lxc.nix). This causes nixos-install
-# to place the key on the target disk, so sshd-keygen finds it and skips
-# generation -- the disk image boots with the registered key, sops decrypts.
-NIXOS_HOST_KEYS_DIR="$(pwd)/host-keys" nix build --impure \
-  --no-use-registries --no-accept-flake-config "${NIX_OPTS[@]}" \
+nix build --no-use-registries --no-accept-flake-config "${NIX_OPTS[@]}" \
   ".#nixosConfigurations.${target}.config.system.build.diskoImagesScript" \
   --out-link "result-${target}"
-# Remove any stale .raw from a previous failed build so the post-build check
-# below is unambiguous (diskoImagesScript writes to CWD as ${image_name}.raw).
-$sudo_pfx rm -f "${image_name}.raw" 2>/dev/null || true
-$sudo_pfx "./result-${target}" --build-memory 2048
-if [[ ! -f "${image_name}.raw" ]]; then
-  echo "ERROR: ${image_name}.raw not found in ${repo_dir} after build -- disko/QEMU may have failed." >&2
+$sudo_pfx "./result-${target}" \
+  --pre-format-files "$(pwd)/host-keys/${target}_ssh_host_ed25519_key" /etc/ssh/ssh_host_ed25519_key \
+  --pre-format-files "$(pwd)/host-keys/${target}_ssh_host_ed25519_key.pub" /etc/ssh/ssh_host_ed25519_key.pub \
+  --build-memory 2048
+built="$(find . -maxdepth 1 -name '*.raw' -newer "result-${target}" | head -1)"
+if [[ -z "$built" ]]; then
+  echo "ERROR: no .raw image found in ${repo_dir} after build." >&2
   exit 1
 fi
-echo "Built image: ${repo_dir}/${image_name}.raw"
+$sudo_pfx mkdir -p "$dest_dir"
+$sudo_pfx mv "$built" "${dest_dir}/${dest_name}"
+echo "Built and staged: ${dest_dir}/${dest_name}"
 REMOTE_SCRIPT
-      local_image="$vm_built_raw"
-      echo "Built on ${node}: ${vm_built_raw}"
+      local_image="$remote_path"
+      echo "Built on ${node}: ${remote_path}"
     fi
   fi
 fi
@@ -909,35 +895,14 @@ else
 --net0 virtio,bridge=${bridge} --bios ovmf --machine q35 --scsihw virtio-scsi-pci \
 --efidisk0 ${storage}:1,efitype=4m,pre-enrolled-keys=0 --agent enabled=1"
 
-  # VMs built on the node: import from the repo dir (where disko/QEMU wrote it).
-  # VMs from --image: import from remote_path (where scp uploaded it).
-  _import_path="${remote_path}"
-  [[ -z "$image" ]] && _import_path="${vm_built_raw}"
   if [[ "$dry_run" -eq 1 ]]; then
-    echo "[dry-run] ssh ${ssh_target} -- ${sudo_display}qm importdisk ${vmid} ${_import_path} ${storage}"
+    echo "[dry-run] ssh ${ssh_target} -- ${sudo_display}qm importdisk ${vmid} ${remote_path} ${storage}"
     echo "[dry-run] (would parse the resulting disk identifier from that output)"
     echo "[dry-run] ssh ${ssh_target} -- ${sudo_display}qm set ${vmid} --scsi0 ${storage}:<parsed-disk-id>"
   else
-    if ! importdisk_output="$(ssh "$ssh_target" "${sudo_prefix} qm importdisk ${vmid} ${_import_path} ${storage}" 2>&1)"; then
-      echo "ERROR: qm importdisk failed:" >&2
-      echo "${importdisk_output}" >&2
-      exit 1
-    fi
+    importdisk_output="$(ssh "$ssh_target" "${sudo_prefix} qm importdisk ${vmid} ${remote_path} ${storage}")"
     echo "$importdisk_output"
-    # PVE output format: "unusedN: successfully imported disk '<storage>:<vol>'"
-    # (lowercase "successfully", no "as"; the primary regex targets this form; the
-    # || true inside the substitution prevents set -e from aborting when grep finds
-    # no match -- without it the script would silently exit before reaching the
-    # fallback whenever the PVE format doesn't match).
-    disk_id="$(echo "$importdisk_output" | grep -oP "successfully imported disk '\\K[^']+" || true)"
-    if [[ -z "$disk_id" ]]; then
-      # Fallback for other PVE output variants: read qm config directly.
-      unused_line="$(ssh "$ssh_target" "${sudo_prefix} qm config ${vmid}" | grep '^unused[0-9]*:' | head -1 || true)"
-      if [[ -n "$unused_line" ]]; then
-        disk_id="${unused_line#*: }"
-        echo "Note: disk ID resolved from qm config: ${disk_id}"
-      fi
-    fi
+    disk_id="$(echo "$importdisk_output" | grep -ioP "(?<=successfully imported disk as ')[^']+" | sed 's/^unused[0-9]*://')"
     if [[ -z "$disk_id" ]]; then
       echo "ERROR: couldn't parse the imported disk identifier from qm importdisk's output above." >&2
       echo "The VM shell (${vmid}) and imported disk both exist -- finish attaching it by hand:" >&2
@@ -946,12 +911,6 @@ else
       exit 1
     fi
     remote "${sudo_prefix} qm set ${vmid} --scsi0 ${disk_id}"
-    # The disk data is now in ZFS; remove the source raw file (only for images
-    # we built on the node -- --image uploads are the operator's to manage).
-    if [[ -z "$image" ]]; then
-      ssh "$ssh_target" "${sudo_prefix} rm -f '${_import_path}'" 2>/dev/null || \
-        echo "Warning: couldn't remove ${_import_path} from ${node} -- you can delete it manually" >&2
-    fi
   fi
   remote "${sudo_prefix} qm set ${vmid} --boot order=scsi0"
   remote "${sudo_prefix} qm start ${vmid}"