fix(gc-hosts): filter discovered guests against flake to exclude non-NixOS hosts

pve1 runs non-NixOS guests (FreeIPA domain-controller, Proxmox Data Manager, etc.)
alongside NixOS ones. Validate each discovered hostname against the set of
hostnames defined in nixosConfigurations before adding it to the gc list.

Brings back the flake eval but uses it correctly: extract all hostname values
(not target-name keys) to build a filter set, then only include pve1 guests
whose name matches a flake-managed NixOS host.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/gc-hosts.sh

@@ -71,42 +71,47 @@ _add_host "nixos" "${NIXOS_USER}@nixos" "nixos"
 _add_host "pve1" "${PVE1_SSH_USER}@${PVE1_HOST}" "nix"
 
 # 3. Dynamically discover running NixOS guests on pve1
+#
+# create-proxmox-resource.sh names every guest after its NixOS hostname:
+#   pct create ... --hostname <nixos-hostname>  (LXC)
+#   qm  create ... --name    <nixos-hostname>   (VM)
+# So pct/qm list output already contains the NixOS hostname directly.
+# We validate against the flake to filter out non-NixOS guests on pve1
+# (e.g. FreeIPA, Proxmox Backup Server) that share the same Proxmox node.
 echo "Discovering running guests on ${PVE1_HOST}..."
 
-# Evaluate the full flake hostname map in one shot.
+# Eval the flake once to get the set of hostnames that are actually NixOS.
-hostname_map="{}"
+# Values are NixOS hostnames (e.g. "docker"); keys are flake targets ("lxc-docker").
-if ! hostname_map="$(
+nixos_hostnames=""
+nixos_hostnames="$(
   nix eval --json "${NIX_EVAL_FLAGS[@]}" .#nixosConfigurations \
-    --apply 'cfgs: builtins.mapAttrs (_: cfg: cfg.config.networking.hostName) cfgs' \
+    --apply 'cfgs: builtins.attrValues (builtins.mapAttrs (_: cfg: cfg.config.networking.hostName) cfgs)' \
-    2>/dev/null
+    2>/dev/null | jq -r '.[]' | sort -u
-)"; then
+)" || { echo "  warning: flake eval failed — non-NixOS guests will not be filtered" >&2; }
-  echo "  warning: flake eval failed — skipping dynamic host discovery" >&2
-fi
 
-# SSH_QUERY_OPTS (no BatchMode) so sudo can prompt if wayne's sudo needs a password.
+# SSH_QUERY_OPTS (no BatchMode) so sudo can prompt if needed for pct/qm.
 if ssh "${SSH_QUERY_OPTS[@]}" "${PVE1_SSH_USER}@${PVE1_HOST}" "true" 2>/dev/null; then
   running_guests="$(
-    ssh "${SSH_QUERY_OPTS[@]}" "${PVE1_SSH_USER}@${PVE1_HOST}" bash <<'REMOTE'
+    ssh "${SSH_QUERY_OPTS[@]}" "${PVE1_SSH_USER}@${PVE1_HOST}" bash -s <<'DISCOVER'
-      { sudo pct list 2>/dev/null | awk 'NR>1 && $2=="running" { print $NF }';
+sudo pct list 2>/dev/null | awk 'NR>1 && $2=="running" { print $NF }'
-        sudo qm  list 2>/dev/null | awk 'NR>1 && $3=="running" { print $2  }'; } | sort -u
+sudo qm  list 2>/dev/null | awk 'NR>1 && $3=="running" { print $2  }'
-REMOTE
+DISCOVER
   )" || running_guests=""
 
-  while IFS= read -r guest; do
+  while IFS= read -r hostname; do
-    [[ -z "$guest" ]] && continue
-
-    # Resolve flake target name → NixOS hostname.
-    hostname="$(printf '%s' "$hostname_map" \
-      | jq -r --arg g "$guest" '.[$g] // empty' 2>/dev/null || true)"
     [[ -z "$hostname" ]] && continue
-
+    # Exclude nix-cache.
-    # Exclude nix-cache and any hostname already in the list.
+    case "$hostname" in *nix-cache*) continue ;; esac
-    case "$hostname" in nix-cache) continue ;; esac
+    # Skip if not a flake-managed NixOS host (filters non-NixOS pve1 guests).
+    if [[ -n "$nixos_hostnames" ]] && ! grep -qxF "$hostname" <<< "$nixos_hostnames"; then
+      continue
+    fi
+    # Skip if already in the list (e.g. a proxmox-gui guest whose hostname is nixos).
     if [[ -n "${_SEEN_HOSTNAMES[$hostname]+_}" ]]; then continue; fi
 
-    echo "  + $guest → $hostname"
+    echo "  + $hostname"
     _add_host "$hostname" "${NIXOS_USER}@${hostname}" "nixos"
-  done <<< "$running_guests"
+  done <<< "$(echo "$running_guests" | sort -u)"
 else
   echo "  warning: ${PVE1_HOST} unreachable — skipping dynamic host discovery" >&2
 fi

scripts/ha/resize-data-disk.sh

@@ -30,8 +30,6 @@ DATA_DISK_SLOT="${DATA_DISK_SLOT:-scsi1}"   # Proxmox disk name (scsi1 = data di
 HA_USER="${HA_USER:-nixos}"
 PVE_HOST="${PVE_HOST:-${PVE1_HOST}}"
 PVE_SSH_USER="${PVE_SSH_USER:-${PROXMOX_SSH_USER}}"
-PVE_SUDO=""
-[[ "$PVE_SSH_USER" != "root" ]] && PVE_SUDO="sudo"
 # By-id symlink for the data disk; basename resolves to the raw block device.
 # matches variables.nix's haServerDrbdDisk.
 DATA_DISK_BYID="${DATA_DISK_BYID:-scsi-0QEMU_QEMU_HARDDISK_drive-${DATA_DISK_SLOT}}"
@@ -142,7 +140,7 @@ fi
 echo ""
 echo "Looking up VM IDs on ${PVE_HOST}..."
 
-QM_LIST=$(pve "$PVE_SUDO qm list 2>/dev/null" || true)
+QM_LIST=$(pve "qm list 2>/dev/null" || true)
 VMID1=$(echo "$QM_LIST" | awk -v name="$NODE1" '$0 ~ name {print $1}' | head -1)
 VMID2=$(echo "$QM_LIST" | awk -v name="$NODE2" '$0 ~ name {print $1}' | head -1)
 
@@ -184,12 +182,12 @@ echo "── Phase 1 — Proxmox disk resize (${DATA_DISK_SLOT} ${SIZE} on both
 
 echo "  ${DRY_PREFIX}qm resize $VMID1 ${DATA_DISK_SLOT} ${SIZE}  ($NODE1 on ${PVE_HOST})"
 if ! $DRY_RUN; then
-  pve "$PVE_SUDO qm resize $VMID1 ${DATA_DISK_SLOT} ${SIZE}"
+  pve "qm resize $VMID1 ${DATA_DISK_SLOT} ${SIZE}"
 fi
 
 echo "  ${DRY_PREFIX}qm resize $VMID2 ${DATA_DISK_SLOT} ${SIZE}  ($NODE2 on ${PVE_HOST})"
 if ! $DRY_RUN; then
-  pve "$PVE_SUDO qm resize $VMID2 ${DATA_DISK_SLOT} ${SIZE}"
+  pve "qm resize $VMID2 ${DATA_DISK_SLOT} ${SIZE}"
 fi
 
 echo "  Phase 1 done."

variables.nix

@@ -58,7 +58,6 @@
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBZ9WKKAlP9Z7GQdgaZ1Xgw9C+vja2lqEZO5rJFpVqYN root@ha-server-1"
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEGNKlaaMckd8nLWNGz4B2QokXjnnIvM+rEUv+R6h0sp root@ha-server-2"
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK+XeMco7OxUpjrjZm54HogMs9QB5xlcKmElASRvrmlW root@nixos"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMseQwPpmaa6cgV5U8KhUsiVSYARG85zGa9rho0LJWks wayne@pve1"
   ];
 
   # Admin SSH public key, authorized on the primary user of every host and