Archived
beatzaplentyandClaude Sonnet 5
fd773b65da
Check NixOS configurations / eval-hosts (pull_request) Failing after 11m12s
variables.nix's nixCacheHostKey no longer matched nix-cache's actual SSH host key (confirmed via ssh-keyscan against the live container), so every declaratively-configured client's programs.ssh.knownHosts trusted the wrong key -- distributed builds would fail host-key verification. Also, modules/nix-cache/remote-builder-client.nix hardcoded sshKey to /root/.ssh/nixremote, but the `server` host only has its own default /root/.ssh/id_ed25519 installed (confirmed live via qm guest-agent) -- that file was never even present, so the build machine config pointed at nothing. Standardize on each client's own default identity, matching the per-host-key pattern vars.remoteBuilderAuthorizedKeys already uses instead of a shared/differently-named keypair, and add scripts/secrets/sync-nix-cache-host-key.sh (wired into codex-maintenance.sh's --check) so the host-key drift doesn't silently recur next time nix-cache is rebuilt or recreated. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V7yVH71vGrDVzovh9UaMu8
41 lines
1.4 KiB
Nix
41 lines
1.4 KiB
Nix
{ pkgs, vars, ... }:
|
|
|
|
{
|
|
# Authenticate as nixremote using the client host's own default root SSH
|
|
# identity (/root/.ssh/id_ed25519) rather than a separately-named key --
|
|
# matches vars.remoteBuilderAuthorizedKeys, which already authorizes
|
|
# each host's own default key (one entry per host, not a shared
|
|
# dedicated keypair). If this host doesn't have one yet:
|
|
# sudo -u root ssh-keygen -t ed25519 -N '' -f /root/.ssh/id_ed25519
|
|
# # then add its .pub to vars.remoteBuilderAuthorizedKeys and rebuild nix-cache
|
|
# sudo ssh -i /root/.ssh/id_ed25519 nixremote@nix-cache nix-store --version
|
|
# Trust nix-cache's SSH host key declaratively so the nix-daemon (root)
|
|
# can connect the first time without a manual ssh-keyscan/known_hosts
|
|
# step on every new client.
|
|
programs.ssh.knownHosts.${vars.nixCacheHost} = {
|
|
hostNames = [ vars.nixCacheHost ];
|
|
publicKey = vars.nixCacheHostKey;
|
|
};
|
|
|
|
nix = {
|
|
distributedBuilds = true;
|
|
|
|
buildMachines = [
|
|
{
|
|
hostName = vars.nixCacheHost;
|
|
sshUser = vars.remoteBuilderUser;
|
|
sshKey = "/root/.ssh/id_ed25519";
|
|
inherit (pkgs.stdenv.hostPlatform) system;
|
|
maxJobs = 4;
|
|
speedFactor = 2;
|
|
supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
|
|
}
|
|
];
|
|
|
|
settings = {
|
|
builders-use-substitutes = true;
|
|
max-jobs = "auto";
|
|
};
|
|
};
|
|
}
|