Merge pull request 'fix(gc-hosts): filter discovered guests against flake to exclude non-NixOS hosts' (#107) from worktree-crispy-churning-kernighan into main

Reviewed-on: #107

scripts/gc-hosts.sh

@@ -14,8 +14,8 @@
 # "nix-collect-garbage -d" if sudo needs a password — still collects
 # unreferenced store paths and old nixos-user profile generations, but leaves
 # old system generations in place.
-# pve1: runs "nix-collect-garbage -d" as the login user (no system generations
-# on a non-NixOS host).
+# pve1: runs "bash -l -c nix-collect-garbage -d" as the login user so
+# /etc/profile is sourced and the Nix daemon's PATH is set up automatically.
 #
 # Usage (from repo root):
 #   bash scripts/gc-hosts.sh [--dry-run]
@@ -30,7 +30,12 @@ source scripts/lib/nix-eval.sh 2>/dev/null || true
 : "${MAX_JOBS:=8}"
 : "${NIXOS_USER:=nixos}"
 : "${PVE1_SSH_USER:=${PROXMOX_SSH_USER:-wayne}}"
+
+# GC connections use BatchMode — no interactive prompts, just succeed or fail.
 SSH_OPTS=(-o StrictHostKeyChecking=no -o BatchMode=yes -o ConnectTimeout=10)
+# Discovery connections do NOT use BatchMode so that sudo can prompt if needed
+# (pct/qm list require root access on Proxmox).
+SSH_QUERY_OPTS=(-o StrictHostKeyChecking=no -o ConnectTimeout=10)
 
 DRY_RUN=0
 for arg in "$@"; do
@@ -44,7 +49,7 @@ done
 
 # ORDERED_HOSTS: names in display/execution order.
 # HOST_TARGET[name]: SSH target string (user@host).
-# HOST_TYPE[name]: "nixos" (try sudo gc, fallback user) | "nix" (user gc only).
+# HOST_TYPE[name]: "nixos" (try sudo gc, fallback user) | "nix" (login-shell gc).
 declare -a  ORDERED_HOSTS=()
 declare -A  HOST_TARGET=()
 declare -A  HOST_TYPE=()
@@ -66,42 +71,47 @@ _add_host "nixos" "${NIXOS_USER}@nixos" "nixos"
 _add_host "pve1" "${PVE1_SSH_USER}@${PVE1_HOST}" "nix"
 
 # 3. Dynamically discover running NixOS guests on pve1
+#
+# create-proxmox-resource.sh names every guest after its NixOS hostname:
+#   pct create ... --hostname <nixos-hostname>  (LXC)
+#   qm  create ... --name    <nixos-hostname>   (VM)
+# So pct/qm list output already contains the NixOS hostname directly.
+# We validate against the flake to filter out non-NixOS guests on pve1
+# (e.g. FreeIPA, Proxmox Backup Server) that share the same Proxmox node.
 echo "Discovering running guests on ${PVE1_HOST}..."
 
-# Evaluate the full flake hostname map in one shot.
-hostname_map="{}"
-if ! hostname_map="$(
+# Eval the flake once to get the set of hostnames that are actually NixOS.
+# Values are NixOS hostnames (e.g. "docker"); keys are flake targets ("lxc-docker").
+nixos_hostnames=""
+nixos_hostnames="$(
   nix eval --json "${NIX_EVAL_FLAGS[@]}" .#nixosConfigurations \
-    --apply 'cfgs: builtins.mapAttrs (_: cfg: cfg.config.networking.hostName) cfgs' \
-    2>/dev/null
-)"; then
-  echo "  warning: flake eval failed — skipping dynamic host discovery" >&2
-fi
+    --apply 'cfgs: builtins.attrValues (builtins.mapAttrs (_: cfg: cfg.config.networking.hostName) cfgs)' \
+    2>/dev/null | jq -r '.[]' | sort -u
+)" || { echo "  warning: flake eval failed — non-NixOS guests will not be filtered" >&2; }
 
-# Get names of all currently running guests from pve1.
-if ssh "${SSH_OPTS[@]}" "${PVE1_SSH_USER}@${PVE1_HOST}" "true" 2>/dev/null; then
+# SSH_QUERY_OPTS (no BatchMode) so sudo can prompt if needed for pct/qm.
+if ssh "${SSH_QUERY_OPTS[@]}" "${PVE1_SSH_USER}@${PVE1_HOST}" "true" 2>/dev/null; then
   running_guests="$(
-    ssh "${SSH_OPTS[@]}" "${PVE1_SSH_USER}@${PVE1_HOST}" bash <<'REMOTE'
-      { sudo pct list 2>/dev/null | awk 'NR>1 && $2=="running" { print $NF }';
-        sudo qm  list 2>/dev/null | awk 'NR>1 && $3=="running" { print $2  }'; } | sort -u
-REMOTE
+    ssh "${SSH_QUERY_OPTS[@]}" "${PVE1_SSH_USER}@${PVE1_HOST}" bash -s <<'DISCOVER'
+sudo pct list 2>/dev/null | awk 'NR>1 && $2=="running" { print $NF }'
+sudo qm  list 2>/dev/null | awk 'NR>1 && $3=="running" { print $2  }'
+DISCOVER
   )" || running_guests=""
 
-  while IFS= read -r guest; do
-    [[ -z "$guest" ]] && continue
-
-    # Resolve flake target name → NixOS hostname.
-    hostname="$(printf '%s' "$hostname_map" \
-      | jq -r --arg g "$guest" '.[$g] // empty' 2>/dev/null || true)"
+  while IFS= read -r hostname; do
     [[ -z "$hostname" ]] && continue
-
-    # Exclude nix-cache and any target whose hostname is already in our list.
-    case "$hostname" in nix-cache) continue ;; esac
+    # Exclude nix-cache.
+    case "$hostname" in *nix-cache*) continue ;; esac
+    # Skip if not a flake-managed NixOS host (filters non-NixOS pve1 guests).
+    if [[ -n "$nixos_hostnames" ]] && ! grep -qxF "$hostname" <<< "$nixos_hostnames"; then
+      continue
+    fi
+    # Skip if already in the list (e.g. a proxmox-gui guest whose hostname is nixos).
     if [[ -n "${_SEEN_HOSTNAMES[$hostname]+_}" ]]; then continue; fi
 
-    echo "  + $guest → $hostname"
+    echo "  + $hostname"
     _add_host "$hostname" "${NIXOS_USER}@${hostname}" "nixos"
-  done <<< "$running_guests"
+  done <<< "$(echo "$running_guests" | sort -u)"
 else
   echo "  warning: ${PVE1_HOST} unreachable — skipping dynamic host discovery" >&2
 fi
@@ -121,7 +131,7 @@ if [[ "$DRY_RUN" -eq 1 ]]; then
       echo "  ssh ${SSH_OPTS[*]} $target 'sudo -n nix-collect-garbage -d'"
       echo "  # fallback: ssh ... $target 'nix-collect-garbage -d'"
     else
-      echo "  ssh ${SSH_OPTS[*]} $target '. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix-collect-garbage -d'"
+      echo "  ssh ${SSH_OPTS[*]} $target 'bash -l -c nix-collect-garbage -d'"
     fi
   done
   exit 0
@@ -147,10 +157,10 @@ gc_one() {
       echo "ok(user)"; return
     fi
   else
-    # Non-NixOS node: BatchMode SSH doesn't source the Nix daemon profile, so
-    # nix-collect-garbage won't be on PATH unless we source it explicitly.
-    local nix_profile='. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh 2>/dev/null || true'
-    if ssh "${SSH_OPTS[@]}" "$target" "$nix_profile && nix-collect-garbage -d" \
+    # Non-NixOS node: use a login shell so /etc/profile is sourced and the
+    # Nix daemon's bin dir is on PATH (set up by /etc/profile.d/nix-daemon.sh
+    # which the Nix installer adds to /etc/profile).
+    if ssh "${SSH_OPTS[@]}" "$target" "bash -l -c 'nix-collect-garbage -d'" \
         >>"$logfile" 2>>"$logfile"; then
       echo "ok"; return
     fi