From 68aea4cdcc0e40d38280ba3fb689ffadaa079a7f Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Sat, 25 Jul 2026 19:29:21 +1000 Subject: [PATCH 1/2] chore(vars): commit clan vars SSH host key for lxc-tor-relay MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The key was generated in a prior session but not committed — the clan vars files existed only in that session's working tree. Recovered the original private key from pve1's host-keys/ backup (fingerprint age16kqf... matches the &lxc-tor-relay anchor already in .sops.yaml), re-encrypted for admin age key only, and stored in the canonical clan vars layout. Co-Authored-By: Claude Sonnet 4.6 Claude-Session: https://claude.ai/code/session_01B2EJ4qTsM5KUqhS5c3GAwx --- .../openssh/ssh_host_ed25519_key.pub/value | 1 + .../openssh/ssh_host_ed25519_key/secret | 14 ++++++++++++++ 2 files changed, 15 insertions(+) create mode 100644 vars/per-machine/lxc-tor-relay/openssh/ssh_host_ed25519_key.pub/value create mode 100644 vars/per-machine/lxc-tor-relay/openssh/ssh_host_ed25519_key/secret diff --git a/vars/per-machine/lxc-tor-relay/openssh/ssh_host_ed25519_key.pub/value b/vars/per-machine/lxc-tor-relay/openssh/ssh_host_ed25519_key.pub/value new file mode 100644 index 0000000..fa58c82 --- /dev/null +++ b/vars/per-machine/lxc-tor-relay/openssh/ssh_host_ed25519_key.pub/value @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOAzES7wlgL7gIyxOHbmwhzI8SJ5uMSEd26u+ek6knVh lxc-tor-relay diff --git a/vars/per-machine/lxc-tor-relay/openssh/ssh_host_ed25519_key/secret b/vars/per-machine/lxc-tor-relay/openssh/ssh_host_ed25519_key/secret new file mode 100644 index 0000000..179560b --- /dev/null +++ b/vars/per-machine/lxc-tor-relay/openssh/ssh_host_ed25519_key/secret @@ -0,0 +1,14 @@ +{ + "data": "ENC[AES256_GCM,data:Gx0ZxQ4OZUKUDFEPYjOEgTERHOFDYO+O36qA6h7+wp6G3ld4hTs4NhODdeCpz3xq7/EZ09Jej/ZZriIhiTUp7IjDIjR+hOsIWW7XQNUqBDfq/nO2Fz6nOd7ph1fgQfaSUvmUBo5qr68VmDs6ArnkDJ5TFNTwqypC9Ou/HXvKEvqfG+XjL8FT05ZG3iTqH68O73DlBhePhVuWby/8txyCL+fz9pXaqyFIGxmsMDE3d0Itveyi/bReOnf4g6UvCjnrA1nMpTB3rQLzVF0TvxfTv9XfaeV3On6eu8M+qUk9fqv0ytKS6+IcozuCax5kLMIGz7Y4kbw+yolgotWaM33Wu+e+UAZMHSksWAJAI/zqxHwRcyY5uEH8DJdqz6EtA06Yssup89iqMA4Nz88l+LpZ+1BPeY6PlhbubP+X1x34mbDixO8EguuUG908vd2jKi8f7GtYzDXm3ECN1iodiAXVJZ3TEGfYPfhvH6p9kSkwS9Jug1GVP5pDaPPkwvtsLjq2fV0HB/4qJQAkVJmwRz2L,iv:3sN+t1HvduJjlj+l0Jp9jqWIh0q1bwz4WiPPDLXyNzg=,tag:Qk3P3xoHoOhYQL3xzmJpaw==,type:str]", + "sops": { + "age": [ + { + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBETjR1YzVoaUtGTlo4QnUv\nbVE4ZXZmMmJ4ZzFhcXlaVWNEWHAxVW4xSm44CmlOaEVxSGpKelZwTEFCcitvcThE\na1B5bVdDUk56L2ZMVDJNVkpJalZ3eTgKLS0tIGU5NUM0bDVyaVc0WGVrbFF1VzFx\nT0p3a1Z0czd4bTRzUVRURmh1MzhUelUKaaL1TewLGICnl/gdAFQHHBM/ik2qUjAy\n2dNemNJrMuX7Rd9DCZPeFIqNHRVX1sIhJo3/dC1UJc235l1NLcSsSA==\n-----END AGE ENCRYPTED FILE-----\n", + "recipient": "age1njap586hc0q43kr03g6c8eqhdsmk8zcafkl3f83xwlc2gqhlmfgs4tmwad" + } + ], + "lastmodified": "2026-07-25T09:28:42Z", + "mac": "ENC[AES256_GCM,data:h/MkejHqwuJbc63HyJs8ki1aTt7bx7HVhsQCI45hHjN/WeEJxiZVcmHEXsL/dwPg/Q7H8OImC2sl6Gt7FtGwfN9O6JwYwl6BxBBoD+lZscgrPrNqp1I9u3KhgyOF7ziQhiWH2Lk3/OVa9kuFs3xYjcKxVIA+vW6VB54QkLNBcPM=,iv:BjtKnZ/B7RvWq1MBzWzudPGvntXnk9kYpzULTpK62EU=,tag:f71WOUHcjbcHHC7KIjHqrA==,type:str]", + "version": "3.13.2" + } +} -- 2.54.0 From 1a14b1d4d34a5539fbe568899845a0b9c29c6fa6 Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Sat, 25 Jul 2026 19:50:35 +1000 Subject: [PATCH 2/2] fix(lxc): move sops-reinstall service from sysinit to network.target nixos-lxc-sops-reinstall.service called switch-to-configuration test at sysinit.target time (DefaultDependencies=false), before D-Bus was up. D-Bus is required to restart systemd targets after activation scripts run. The service reported failure on every boot (exit 1: "Failed to open dbus connection") even though secrets were correctly installed, because the D-Bus call happens after activation scripts complete. Move the service to network.target so basic.target (which includes dbus-broker.service) runs first. Also drop DefaultDependencies=false so systemd auto-adds After=basic.target. Add SuccessExitStatus=11 to handle the edge case where switch-to-configuration holds the lock during a concurrent rebuild (exit 11 = "Could not acquire lock" -- the rebuild's own activation already installed the secrets, so treating it as success is correct). Co-Authored-By: Claude Sonnet 4.6 Claude-Session: https://claude.ai/code/session_01B2EJ4qTsM5KUqhS5c3GAwx --- modules/platforms/lxc.nix | 28 ++++++++++++++++------------ 1 file changed, 16 insertions(+), 12 deletions(-) diff --git a/modules/platforms/lxc.nix b/modules/platforms/lxc.nix index 0188cef..d9c37a7 100644 --- a/modules/platforms/lxc.nix +++ b/modules/platforms/lxc.nix @@ -217,28 +217,32 @@ in # are permanently absent after the first boot and every service that # reads from /run/secrets fails on start. # - # wantedBy/before sysinit.target + DefaultDependencies=false mirrors how - # the sops-nix module places its own service when it generates one. This - # ensures secrets exist before basic.target (and thus before any user - # service) starts. DefaultDependencies=false is required to avoid a - # circular ordering: without it, systemd would add After=sysinit.target - # to a service that is itself part of sysinit.target. + # wantedBy/before network.target: switch-to-configuration test requires + # D-Bus to restart systemd targets after running activation scripts. D-Bus + # is available once basic.target completes (the default After=basic.target + # that DefaultDependencies would otherwise add). Placing the service before + # network.target ensures secrets are ready before any network-dependent + # service (including beszel-agent and nix-serve) starts, while running late + # enough that D-Bus is already up. # # ConditionPathExists=... skips this service on the genuine first boot # (the marker doesn't exist yet); nixos-lxc-first-boot-activate handles # that case. On every subsequent boot the condition passes and secrets # are reinstalled before user services start. + # + # SuccessExitStatus=11: switch-to-configuration exits 11 when it cannot + # acquire the activation lock (another switch is already in progress). + # During a nixos-rebuild switch the activation already installs secrets, so + # treating the lock-held case as success is correct. systemd.services.nixos-lxc-sops-reinstall = { description = "Reinstall sops secrets on each non-first boot (LXC, /run is tmpfs)"; - wantedBy = [ "sysinit.target" ]; - before = [ "sysinit.target" ]; - unitConfig = { - DefaultDependencies = false; - ConditionPathExists = "/var/lib/nixos-lxc-first-boot-activated"; - }; + wantedBy = [ "network.target" ]; + before = [ "network.target" ]; + unitConfig.ConditionPathExists = "/var/lib/nixos-lxc-first-boot-activated"; serviceConfig = { Type = "oneshot"; RemainAfterExit = true; + SuccessExitStatus = "11"; }; script = '' /run/current-system/bin/switch-to-configuration test -- 2.54.0