Trust nix-cache's SSH host key declaratively on remote-builder clients #4

2026-07-20T07:25:16Z

beatzaplenty commented

2026-07-20 07:25:16 +00:00

Distributed builds (e.g. lxc-docker) failed with "Host key verification failed" on any client that had never manually SSH'd to nix-cache before, since nothing populated root's known_hosts for it.

variables.nix: add vars.nixCacheHostKey (nix-cache's SSH host public key — not a secret)
modules/nix-cache/remote-builder-client.nix: wire it into programs.ssh.knownHosts
docs/nix-cache.md: document the new declarative trust and how to update it on key rotation

Validated: lxc-docker and proxmox-nix-cache both eval cleanly, nixpkgs-fmt --check clean, gitleaks pre-commit hook clean.

Distributed builds (e.g. `lxc-docker`) failed with "Host key verification failed" on any client that had never manually SSH'd to nix-cache before, since nothing populated root's `known_hosts` for it. - `variables.nix`: add `vars.nixCacheHostKey` (nix-cache's SSH host public key — not a secret) - `modules/nix-cache/remote-builder-client.nix`: wire it into `programs.ssh.knownHosts` - `docs/nix-cache.md`: document the new declarative trust and how to update it on key rotation Validated: `lxc-docker` and `proxmox-nix-cache` both eval cleanly, `nixpkgs-fmt --check` clean, gitleaks pre-commit hook clean.

beatzaplenty added 1 commit 2026-07-20 07:25:21 +00:00

Declaratively trust nix-cache's SSH host key on remote-builder clients

Check NixOS configurations / eval-hosts (pull_request) Failing after 14m48s

Details

b2dda869a4

Distributed builds failed with "Host key verification failed" on any
client that had never manually SSH'd to nix-cache before, since
nothing populated root's known_hosts for it. Wire nix-cache's host
public key into programs.ssh.knownHosts via a new vars.nixCacheHostKey
so every client picks it up automatically on rebuild.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

beatzaplenty merged commit e0fb6ebcb2 into main

2026-07-20 07:26:26 +00:00

beatzaplenty deleted branch worktree-magical-cooking-book

2026-07-20 07:26:29 +00:00

beatzaplenty referenced this issue from a commit

2026-07-20 10:47:29 +00:00

Merge pull request #4 from beatz174-bit/chore/update-flake-lock

beatzaplenty referenced this issue from a commit

2026-07-20 10:47:30 +00:00

Merge pull request 'Trust nix-cache's SSH host key declaratively on remote-builder clients' (#4) from worktree-magical-cooking-book into main

This repo is archived. You cannot comment on pull requests.