fix(proxmox): embed SSH host key via NIXOS_HOST_KEYS_DIR so sops can decrypt on first boot

--pre-format-files placed the key on the QEMU builder VM's rootfs, not the
target disk. nixos-install chroots into the target and runs sshd-keygen, which
found no key in the chroot and generated a fresh (unregistered) one. sops then
could not decrypt on first boot because the key didn't match .sops.yaml, leaving
both root and nixos with '!' in /etc/shadow even after mutableUsers = false was
set (hashedPasswordFile pointed to paths sops never wrote).

Fix modules/platforms/proxmox.nix to embed the clan SSH host key in
environment.etc via NIXOS_HOST_KEYS_DIR at eval time -- the same pattern
lxc.nix uses. nixos-install's own activation places the key on the target disk,
sshd-keygen finds it already present and skips generation, and sops decrypts
correctly on first boot. Includes the same preserveSshHostKey/restoreSshHostKey
activation scripts as lxc.nix so subsequent nixos-rebuild switch calls (without
NIXOS_HOST_KEYS_DIR) don't remove the key as "obsolete" from environment.etc.

Update create-proxmox-resource.sh: switch VM builds from
  ./result-<target> --pre-format-files ... --build-memory 2048
to
  NIXOS_HOST_KEYS_DIR=$(pwd)/host-keys nix build --impure ... diskoImagesScript
  ./result-<target> --build-memory 2048
matching the LXC build path.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011uRcikkTp3D5VbXj2DwNpQ

modules/build-types/tailscale-router.nix

@@ -1,4 +1,4 @@
-{ vars, ... }:
+{ ... }:
 
 {
   imports = [
@@ -12,31 +12,8 @@
   # own setting) so the intent is clear at the build-type level.
   services.tailscale.useRoutingFeatures = "server";
 
-  # Advertise the LAN subnet so Tailscale peers can route back to LAN machines.
-  # Must also be approved in the Tailscale admin console (Machines → Edit route settings).
-  services.tailscale.extraUpFlags = [ "--advertise-routes=${vars.lanCidr}" ];
-
-  networking.firewall = {
-    # Forwarded subnet-router traffic arrives on tailscale0 already
-    # tailscale-authenticated -- the firewall's normal per-port allow-list
-    # would otherwise drop it. Standard NixOS/Tailscale subnet-router guidance.
-    trustedInterfaces = [ "tailscale0" ];
-
-    # SNAT LAN traffic going into Tailscale so the remote peer sees it as
-    # coming from this router's Tailscale IP rather than a raw LAN IP.
-    # Without this, Tailscale drops forwarded packets whose source is not a
-    # recognised Tailscale address.
-    #
-    # We target POSTROUTING directly (always-existing built-in chain) rather
-    # than nixos-nat-post: extraCommands runs after the old nixos-nat-post is
-    # deleted but before the new one is created, so -A nixos-nat-post silently
-    # fails.  The -C check makes the rule idempotent across firewall reloads.
-    extraCommands = ''
-      iptables -t nat -C POSTROUTING -s ${vars.lanCidr} -o tailscale0 -j MASQUERADE 2>/dev/null || \
-        iptables -t nat -A POSTROUTING -s ${vars.lanCidr} -o tailscale0 -j MASQUERADE
-    '';
-    extraStopCommands = ''
-      iptables -t nat -D POSTROUTING -s ${vars.lanCidr} -o tailscale0 -j MASQUERADE 2>/dev/null || true
-    '';
-  };
+  # Forwarded subnet-router traffic arrives on tailscale0 already
+  # tailscale-authenticated -- the firewall's normal per-port allow-list
+  # would otherwise drop it. Standard NixOS/Tailscale subnet-router guidance.
+  networking.firewall.trustedInterfaces = [ "tailscale0" ];
 }

modules/tailscale/subnet-router.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+_:
 
 {
   imports = [ ./enable-service.nix ];
@@ -12,24 +12,4 @@
     # instead of relaying through DERP.
     openFirewall = true;
   };
-
-  # Tailscale recommends these ethtool flags on the uplink interface to get
-  # full UDP GRO throughput on subnet routers (https://tailscale.com/s/ethtool-config-udp-gro).
-  # The interface is derived from the default route so it works regardless of
-  # what the NIC is named on a given host.
-  systemd.services.tailscale-udp-gro = {
-    description = "Enable UDP GRO forwarding on uplink for Tailscale subnet router";
-    after = [ "network-online.target" ];
-    wants = [ "network-online.target" ];
-    wantedBy = [ "multi-user.target" ];
-    path = [ pkgs.ethtool pkgs.iproute2 ];
-    serviceConfig = {
-      Type = "oneshot";
-      RemainAfterExit = true;
-      ExecStart = pkgs.writeShellScript "tailscale-udp-gro" ''
-        NETDEV=$(ip -o route get 8.8.8.8 | cut -f 5 -d " ")
-        ethtool -K "$NETDEV" rx-udp-gro-forwarding on rx-gro-list off
-      '';
-    };
-  };
 }

scripts/proxmox/create-proxmox-resource.sh

@@ -302,12 +302,6 @@ platform_prefix="lxc"
 [[ -z "$cores" ]] && cores="$PROXMOX_DEFAULT_CORES"
 [[ -z "$memory" ]] && memory="$PROXMOX_DEFAULT_MEMORY_MB"
 
-if [[ "$type" == "vm" && -n "$disk_size" ]]; then
-  echo "WARNING: --disk-size is LXC-only for create mode and is ignored for VMs." >&2
-  echo "  VM disk size comes from proxmoxImageSize in variables.nix (currently ${disk_size}G was requested)." >&2
-  echo "  To expand after creation, use: --modify --vmid <n> --grow-disk <GB>" >&2
-fi
-
 # --- discover / resolve the flake target from --host --------------------
 # Emits "<target>\t<hostName>" pairs for every ${platform_prefix}-* flake
 # target -- the one source both --list and the --host lookup below read

variables.nix

@@ -166,7 +166,7 @@
   # build (modules/disko/proxmox.nix, config.system.build.diskoImagesScript
   # — see docs/proxmox-images.md). Root fills whatever's left after the ESP
   # and swap partitions within this total.
-  proxmoxImageSize = "50G";
+  proxmoxImageSize = "20G";
 
   # nix-cache's Nix store garbage collection retention
   # (modules/nix-cache/server.nix).