Merge pull request 'fix(common): set mutableUsers = false to fix password setup on disk images' (#65 ) from worktree-warm-discovering-moon into main

Reviewed-on: #65
Merge pull request 'fix(create-proxmox-resource): case-insensitive importdisk parse + warn on --disk-size for VMs' (#64 ) from worktree-gentle-cuddling-hippo into main
2026-07-25 21:37:34 +00:00 · 2026-07-25 21:37:14 +00:00 · 2026-07-26 07:36:06 +10:00 · 2026-07-26 06:40:54 +10:00 · 2026-07-25 14:36:31 +00:00
2 changed files with 32 additions and 18 deletions
@@ -61,24 +61,32 @@
    !include ${config.sops.templates."nix-github-token.conf".path}
  '';

-  #Set root password
-  users.users.root = {
-    hashedPasswordFile = config.sops.secrets."root-hashedPassword".path;
-  };
+  users = {
+    # With mutableUsers = false, update-users-groups.pl enforces hashedPasswordFile
+    # on every activation regardless of whether the account already exists in
+    # /etc/shadow. The default (true) only applies hashedPasswordFile to newly-
+    # created accounts — which means a freshly-built proxmox disk image (where
+    # activation runs without a usable sops key, so both accounts land in shadow
+    # with ‘!’) will never have its passwords fixed by subsequent boots.
+    mutableUsers = false;

-  # Define a user account. Don't forget to set a password with ‘passwd’.
-  users.users.${vars.primaryUser} = {
-    isNormalUser = true;
-    extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
-    packages = with pkgs; [
-      tree
-    ];
-    hashedPasswordFile = config.sops.secrets."nixos-hashedPassword".path;
-    openssh.authorizedKeys.keys = [
-      vars.adminSshKey
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMJhrfFayLBG+gWtO6oAvgambw5nWWgztiTFEaaaVRH debian@surface"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGygkCljN6uKpdJbHTOQtn8ZnH+wKXDLAwrDFbLrE/65 nixos@nixos"
-    ];
+    users.root = {
+      hashedPasswordFile = config.sops.secrets."root-hashedPassword".path;
+    };
+
+    users.${vars.primaryUser} = {
+      isNormalUser = true;
+      extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
+      packages = with pkgs; [
+        tree
+      ];
+      hashedPasswordFile = config.sops.secrets."nixos-hashedPassword".path;
+      openssh.authorizedKeys.keys = [
+        vars.adminSshKey
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMJhrfFayLBG+gWtO6oAvgambw5nWWgztiTFEaaaVRH debian@surface"
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGygkCljN6uKpdJbHTOQtn8ZnH+wKXDLAwrDFbLrE/65 nixos@nixos"
+      ];
+    };
  };


@@ -302,6 +302,12 @@ platform_prefix="lxc"
 [[ -z "$cores" ]] && cores="$PROXMOX_DEFAULT_CORES"
 [[ -z "$memory" ]] && memory="$PROXMOX_DEFAULT_MEMORY_MB"

+if [[ "$type" == "vm" && -n "$disk_size" ]]; then
+  echo "WARNING: --disk-size is LXC-only for create mode and is ignored for VMs." >&2
+  echo "  VM disk size comes from proxmoxImageSize in variables.nix (currently ${disk_size}G was requested)." >&2
+  echo "  To expand after creation, use: --modify --vmid <n> --grow-disk <GB>" >&2
+fi
+
 # --- discover / resolve the flake target from --host --------------------
 # Emits "<target>\t<hostName>" pairs for every ${platform_prefix}-* flake
 # target -- the one source both --list and the --host lookup below read
@@ -896,7 +902,7 @@ else
  else
    importdisk_output="$(ssh "$ssh_target" "${sudo_prefix} qm importdisk ${vmid} ${remote_path} ${storage}")"
    echo "$importdisk_output"
-    disk_id="$(echo "$importdisk_output" | grep -oP "(?<=Successfully imported disk as ')[^']+" | sed 's/^unused[0-9]*://')"
+    disk_id="$(echo "$importdisk_output" | grep -ioP "(?<=successfully imported disk as ')[^']+" | sed 's/^unused[0-9]*://')"
    if [[ -z "$disk_id" ]]; then
      echo "ERROR: couldn't parse the imported disk identifier from qm importdisk's output above." >&2
      echo "The VM shell (${vmid}) and imported disk both exist -- finish attaching it by hand:" >&2
Author	SHA1	Message	Date
beatzaplenty	18cd6e884e	Merge pull request 'fix(common): set mutableUsers = false to fix password setup on disk images' (#65 ) from worktree-warm-discovering-moon into main Check NixOS configurations / eval-hosts (push) Successful in 10m36s Details Reviewed-on: #65	2026-07-25 21:37:34 +00:00
beatzaplenty	3102d66337	Merge pull request 'fix(create-proxmox-resource): case-insensitive importdisk parse + warn on --disk-size for VMs' (#64 ) from worktree-gentle-cuddling-hippo into main Check NixOS configurations / eval-hosts (push) Successful in 10m22s Details Reviewed-on: #64	2026-07-25 21:37:14 +00:00
beatzaplentyandClaude Sonnet 4.6	dfa5452af5	fix(common): set mutableUsers = false to fix password setup on disk images Check NixOS configurations / eval-hosts (pull_request) Successful in 10m31s Details When a proxmox-* disk image is built, activation runs during the image build without a valid sops age key (the SSH host key doesn't exist yet), so root and nixos land in /etc/shadow with locked '!' entries. With the default mutableUsers = true, update-users-groups.pl preserves existing shadow entries for accounts that already exist, so hashedPasswordFile is silently ignored on every subsequent boot — passwords are never fixed. Setting mutableUsers = false forces update-users-groups.pl to apply hashedPasswordFile unconditionally on every activation. On first real boot the sops-decrypted hash is now written regardless of whether the account already existed in shadow from the image build. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011uRcikkTp3D5VbXj2DwNpQ	2026-07-26 07:36:06 +10:00
beatzaplentyandClaude Sonnet 4.6	852ba2240f	fix(create-proxmox-resource): case-insensitive importdisk parse + warn on --disk-size for VMs Check NixOS configurations / eval-hosts (pull_request) Successful in 10m22s Details qm importdisk in QEMU 11.x outputs lowercase "successfully imported disk as '...'" rather than the capitalised form the original grep expected. The case mismatch made disk_id always empty, which caused the script to exit 1 after qm create had already run -- leaving the VM with only an EFI disk, no scsi0, and boot order still set to net0. Fix by adding -i (case-insensitive) to the grep. Both the old capitalised format (where the disk id had an "unused0:" prefix inside the quotes) and the new lowercase format are handled correctly: the sed strip of unused0: is preserved for backward compatibility, and the regex result is identical either way. Also add an early warning when --disk-size is passed for --type vm: the flag is LXC-only for create mode and was silently ignored, leaving users expecting a different size than the proxmoxImageSize in variables.nix. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-26 06:40:54 +10:00
beatzaplenty	096dff4fa0	Merge pull request 'docs(sync-host-keys): fix stale host-keys/ references in comments and usage' (#63 ) from fix-stale-wording into main Check NixOS configurations / eval-hosts (push) Successful in 10m23s Details Reviewed-on: #63	2026-07-25 14:36:31 +00:00