Archived
beatzaplentyandClaude Sonnet 4.6
e62e9c9a6a
Check NixOS configurations / eval-hosts (pull_request) Successful in 10m40s
Documentation fixes:
- README/AGENTS: rename tailscale-exit-node → tailscale-router, add ha-server
build type and proxmox-ha-server-{1,2} host table rows, add baremetal to
platform list, remove references to non-existent flake-target-refactor-spec.md
and remove-sensetive-info-refactor.md
- docs/auto-installer.md: fix lxc-tailscale-exit-node → lxc-tailscale-router,
add pxe-minimal to the flake outputs list
- variables.nix: fix domainControllerIp comment — IPA is the authoritative DNS
at .253 (Pi-hole is gone), not a forwarding intermediary
Code deduplication:
- Extract duplicate SSH host-key preservation activation scripts from
modules/platforms/lxc.nix and modules/platforms/proxmox.nix into a shared
modules/common/preserve-ssh-host-key.nix; both platforms now import it
- Replace 8-line hand-enumerated NFS export lists in server.nix and ha-server.nix
with a mkNfsExports helper that generates exports from vars.nfsShares — adding
a share to variables.nix now propagates to both exporters automatically
Dead code removal:
- modules/common/configuration.nix: remove leftover NixOS skeleton comments
(hardware-configuration import, grub lines) that were never used
- modules/docker/enable-service.nix: remove commented-out listenOptions and
daemon.settings blocks
- hosts/server/host.nix, hosts/nix-cache/host.nix: remove #DOCKER_HOST comments
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
51 lines
1.9 KiB
Nix
51 lines
1.9 KiB
Nix
{ lib, flakeTarget, ... }:
|
|
|
|
let
|
|
# Bakes this exact flake target's pre-generated SSH host key straight
|
|
# into /etc/ssh/ -- mirrors lxc.nix's builtins.getEnv pattern (impure
|
|
# and empty under normal `nix build`/`nix eval`, so this is a no-op
|
|
# unless explicitly opted into with NIXOS_HOST_KEYS_DIR=... --impure).
|
|
#
|
|
# Unlike --pre-format-files (which places files on the QEMU builder VM's
|
|
# rootfs, not the target disk), embedding via environment.etc here means
|
|
# nixos-install's own activation step installs the key onto the target
|
|
# disk. sshd-keygen then finds it already present and skips generation,
|
|
# so the disk image boots with the clan-registered key and sops can
|
|
# decrypt on first boot.
|
|
#
|
|
# Without this, nixos-install's sshd-keygen activation generates a fresh
|
|
# key (unregistered in .sops.yaml), sops decryption fails permanently,
|
|
# and password hashes are never applied -- confirmed live: passwords
|
|
# stayed '!' even with mutableUsers = false because hashedPasswordFile
|
|
# pointed to a path that sops never wrote.
|
|
hostKeysDirStr = builtins.getEnv "NIXOS_HOST_KEYS_DIR";
|
|
hasHostKeysDir = hostKeysDirStr != "" && builtins.pathExists hostKeysDirStr;
|
|
hostKeysDir = /. + hostKeysDirStr;
|
|
|
|
privKeyFile = hostKeysDir + "/${flakeTarget}_ssh_host_ed25519_key";
|
|
pubKeyFile = hostKeysDir + "/${flakeTarget}_ssh_host_ed25519_key.pub";
|
|
hasKeyForThisTarget =
|
|
hasHostKeysDir
|
|
&& builtins.pathExists privKeyFile
|
|
&& builtins.pathExists pubKeyFile;
|
|
in
|
|
{
|
|
imports = [
|
|
../hardware-configuration/vm/proxmox.nix
|
|
../boot/efi.nix
|
|
../disko/proxmox.nix
|
|
../common/preserve-ssh-host-key.nix
|
|
];
|
|
|
|
environment.etc = lib.mkIf hasKeyForThisTarget {
|
|
"ssh/ssh_host_ed25519_key" = {
|
|
source = privKeyFile;
|
|
mode = "0600";
|
|
};
|
|
"ssh/ssh_host_ed25519_key.pub" = {
|
|
source = pubKeyFile;
|
|
mode = "0644";
|
|
};
|
|
};
|
|
}
|