fix(lxc): clan vars for lxc-tor-relay + sops-reinstall service fix (network.target) #57

2026-07-25T09:52:34Z

beatzaplenty commented

2026-07-25 09:52:34 +00:00

Summary

Add clan vars SSH host key for lxc-tor-relay (recovered from pve1 backup, verified fingerprint matches .sops.yaml &lxc-tor-relay anchor)
Fix nixos-lxc-sops-reinstall.service: move from sysinit.target to network.target so D-Bus is available when switch-to-configuration test runs

Details

The sops-reinstall service was reporting failure on every boot (exit 1: Failed to open dbus connection) because it ran at sysinit.target before D-Bus started. Secrets were actually installed correctly (activation scripts run before the D-Bus call), but the service marked as failed. Fix: run at network.target instead, where basic.target (including dbus-broker.service) is already complete. Also added SuccessExitStatus=11 for the edge case where a concurrent rebuild holds the activation lock.

Test plan

Eval passes (all lxc-* hosts)
nixpkgs-fmt + statix clean
Redeploy lxc-tor-relay on pve1 to verify service reports active on boot

🤖 Generated with Claude Code

https://claude.ai/code/session_01B2EJ4qTsM5KUqhS5c3GAwx

## Summary - Add clan vars SSH host key for lxc-tor-relay (recovered from pve1 backup, verified fingerprint matches .sops.yaml `&lxc-tor-relay` anchor) - Fix `nixos-lxc-sops-reinstall.service`: move from `sysinit.target` to `network.target` so D-Bus is available when `switch-to-configuration test` runs ## Details The sops-reinstall service was reporting failure on every boot (exit 1: `Failed to open dbus connection`) because it ran at `sysinit.target` before D-Bus started. Secrets were actually installed correctly (activation scripts run before the D-Bus call), but the service marked as failed. Fix: run at `network.target` instead, where `basic.target` (including `dbus-broker.service`) is already complete. Also added `SuccessExitStatus=11` for the edge case where a concurrent rebuild holds the activation lock. ## Test plan - [ ] Eval passes (all lxc-* hosts) - [ ] nixpkgs-fmt + statix clean - [ ] Redeploy lxc-tor-relay on pve1 to verify service reports active on boot 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01B2EJ4qTsM5KUqhS5c3GAwx

beatzaplenty added 2 commits 2026-07-25 09:52:34 +00:00

chore(vars): commit clan vars SSH host key for lxc-tor-relay 68aea4cdcc

The key was generated in a prior session but not committed — the clan vars
files existed only in that session's working tree. Recovered the original
private key from pve1's host-keys/ backup (fingerprint age16kqf... matches
the &lxc-tor-relay anchor already in .sops.yaml), re-encrypted for admin
age key only, and stored in the canonical clan vars layout.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B2EJ4qTsM5KUqhS5c3GAwx

fix(lxc): move sops-reinstall service from sysinit to network.target

Check NixOS configurations / eval-hosts (pull_request) Successful in 10m34s

Details

1a14b1d4d3

nixos-lxc-sops-reinstall.service called switch-to-configuration test at
sysinit.target time (DefaultDependencies=false), before D-Bus was up.
D-Bus is required to restart systemd targets after activation scripts
run. The service reported failure on every boot (exit 1: "Failed to open
dbus connection") even though secrets were correctly installed, because
the D-Bus call happens after activation scripts complete.

Move the service to network.target so basic.target (which includes
dbus-broker.service) runs first. Also drop DefaultDependencies=false so
systemd auto-adds After=basic.target. Add SuccessExitStatus=11 to handle
the edge case where switch-to-configuration holds the lock during a
concurrent rebuild (exit 11 = "Could not acquire lock" -- the rebuild's
own activation already installed the secrets, so treating it as success
is correct).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B2EJ4qTsM5KUqhS5c3GAwx

beatzaplenty merged commit 67752fb1e8 into main

2026-07-25 09:55:25 +00:00

This repo is archived. You cannot comment on pull requests.

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: beatzaplenty/nixos#57