Archived
beatzaplentyandClaude Sonnet 4.6
f22ff7db79
Check NixOS configurations / eval-hosts (pull_request) Successful in 10m59s
KEY (hub's SSH public key) is now stored in variables.nix as beszelHubKey and set by enable-agent.nix — no host file ever needs to touch it. TOKEN was already universal; this removes the last per-host beszel config. Importing enable-agent.nix in a build type is now the only step needed to add a new host to beszel monitoring. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
32 lines
1.2 KiB
Nix
32 lines
1.2 KiB
Nix
{ config, vars, ... }:
|
|
|
|
{
|
|
# Universal token shared by all beszel agents. Add to secrets/common.yaml:
|
|
# sops secrets/common.yaml
|
|
# beszel-token: <value from the beszel hub UI>
|
|
sops.secrets."beszel-token" = { };
|
|
|
|
sops.templates."beszel.env".content = ''
|
|
TOKEN=${config.sops.placeholder."beszel-token"}
|
|
'';
|
|
|
|
services.beszel.agent = {
|
|
enable = true;
|
|
environmentFile = config.sops.templates."beszel.env".path;
|
|
environment = {
|
|
#DOCKER_HOST = "tcp://docker-socket-proxy:2375";
|
|
HUB_URL = "http://${vars.dockerHost}.${vars.homeDomain}:${toString vars.ports.beszelHub}";
|
|
KEY = vars.beszelHubKey;
|
|
};
|
|
};
|
|
|
|
# The upstream module runs beszel-agent under DynamicUser with
|
|
# ProtectSystem = "strict" and no StateDirectory, so /var/lib/beszel-agent
|
|
# (where the agent persists its hub-pairing fingerprint, per
|
|
# https://github.com/henrygd/beszel/discussions/1542) isn't writable --
|
|
# every restart silently fails to save it and regenerates a fresh one in
|
|
# memory, permanently desyncing from whatever the hub has on record after
|
|
# the very first successful pairing. Give it real persistent storage.
|
|
systemd.services.beszel-agent.serviceConfig.StateDirectory = "beszel-agent";
|
|
}
|