feat(nix-cache): authorize pve1's wayne key as remote builder client

Generated /home/wayne/.ssh/id_ed25519 on pve1 (single-user Nix install owned by wayne, no daemon — builds run as wayne not root). Adds the public key to remoteBuilderAuthorizedKeys so nix-cache accepts it. After deploying nix-cache, re-run configure-nix-cache-client.sh as wayne on pve1 to wire in the builder line and known_hosts entry. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Merge branch 'main' of https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos
2026-07-29 13:16:30 +10:00 · 2026-07-29 13:02:03 +10:00 · 2026-07-29 13:01:53 +10:00 · 2026-07-29 02:54:12 +00:00 · 2026-07-29 12:51:50 +10:00
3 changed files with 11 additions and 1 deletions
@@ -30,7 +30,7 @@ in
    ../ha/pacemaker-stack.nix
    ../ha/iscsi-target.nix
    ../ha/cluster-config.nix
-    # ../beszel/enable-agent.nix
+    ../beszel/enable-agent.nix
  ];

  # xfsprogs: mkfs.xfs/xfs_info needed by cluster-init.sh.
@@ -45,4 +45,7 @@ in
  # Pacemaker controls nfs-server — prevent systemd from starting it at boot
  # on both nodes (only the Active node should be serving NFS).
  systemd.services.nfs-server.wantedBy = lib.mkForce [ ];
+
+  # Same reason as server.nix: exports use standard auth, not Kerberos.
+  systemd.services.rpc-svcgssd.enable = false;
 }
@@ -102,6 +102,12 @@ in
    requires = [ "zfs-mount.service" ];
  };

+  # rpc-svcgssd handles Kerberos/GSS-API for NFS. Not needed: exports use
+  # standard auth, not sec=krb5. On IPA-joined hosts the keytab exists (host/
+  # principal only) but has no nfs/ principal, causing spurious failure.
+  # Mask it so nfs-server's Wants= can't pull it in.
+  systemd.services.rpc-svcgssd.enable = false;
+
  services.nfs.server = {
    enable = true;
    exports = mkNfsExports vars.storageRoot;
@@ -58,6 +58,7 @@
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBZ9WKKAlP9Z7GQdgaZ1Xgw9C+vja2lqEZO5rJFpVqYN root@ha-server-1"
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEGNKlaaMckd8nLWNGz4B2QokXjnnIvM+rEUv+R6h0sp root@ha-server-2"
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK+XeMco7OxUpjrjZm54HogMs9QB5xlcKmElASRvrmlW root@nixos"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMseQwPpmaa6cgV5U8KhUsiVSYARG85zGa9rho0LJWks wayne@pve1"
  ];

  # Admin SSH public key, authorized on the primary user of every host and
Author	SHA1	Message	Date
beatzaplentyandClaude Sonnet 4.6	fa163b613d	feat(nix-cache): authorize pve1's wayne key as remote builder client Check NixOS configurations / eval-hosts (pull_request) Successful in 10m31s Details Generated /home/wayne/.ssh/id_ed25519 on pve1 (single-user Nix install owned by wayne, no daemon — builds run as wayne not root). Adds the public key to remoteBuilderAuthorizedKeys so nix-cache accepts it. After deploying nix-cache, re-run configure-nix-cache-client.sh as wayne on pve1 to wire in the builder line and known_hosts entry. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-29 13:16:30 +10:00
beatzaplenty	15bc5bd369	Merge branch 'main' of https://gitea.lan.ddnsgeek.com/beatzaplenty/nixos Check NixOS configurations / eval-hosts (push) Successful in 10m30s Details	2026-07-29 13:02:03 +10:00
beatzaplenty	5a4fbbf7ad	enable beszel agent	2026-07-29 13:01:53 +10:00
beatzaplenty	e720bbb018	Merge pull request 'fix(nfs): mask rpc-svcgssd on server and ha-server build types' (#99 ) from worktree-docs-beszel-guide into main Check NixOS configurations / eval-hosts (push) Failing after 9m46s Details Reviewed-on: #99	2026-07-29 02:54:12 +00:00
beatzaplentyandClaude Sonnet 4.6	40cdf724b4	fix(nfs): mask rpc-svcgssd on server and ha-server build types Check NixOS configurations / eval-hosts (pull_request) Failing after 9m43s Details nfs-utils changed ConditionPathExists from !/etc/krb5.keytab to /etc/krb5.keytab, so on IPA-joined hosts the service now starts instead of skipping. Exports use standard auth (no sec=krb5) so the nfs/ Kerberos principal is never provisioned and the service fails. enable = false masks the unit so nfs-server's Wants= can't pull it in. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-29 12:51:50 +10:00