Archived
beatzaplentyandClaude Sonnet 4.6
24c6469f10
Check NixOS configurations / eval-hosts (pull_request) Successful in 10m40s
Replace per-host host-token.nix imports with a single beszel-token secret in secrets/common.yaml, wired once in enable-agent.nix. Host files now only need services.beszel.agent.environment.KEY — no imports block required. Delete modules/beszel/host-token.nix (no longer referenced anywhere). Action needed: run `sops secrets/common.yaml` and add `beszel-token: <value>` from the beszel hub UI before deploying. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
31 lines
1.2 KiB
Nix
31 lines
1.2 KiB
Nix
{ config, vars, ... }:
|
|
|
|
{
|
|
# Universal token shared by all beszel agents. Add to secrets/common.yaml:
|
|
# sops secrets/common.yaml
|
|
# beszel-token: <value from the beszel hub UI>
|
|
sops.secrets."beszel-token" = { };
|
|
|
|
sops.templates."beszel.env".content = ''
|
|
TOKEN=${config.sops.placeholder."beszel-token"}
|
|
'';
|
|
|
|
services.beszel.agent = {
|
|
enable = true;
|
|
environmentFile = config.sops.templates."beszel.env".path;
|
|
environment = {
|
|
#DOCKER_HOST = "tcp://docker-socket-proxy:2375";
|
|
HUB_URL = "http://${vars.dockerHost}.${vars.homeDomain}:${toString vars.ports.beszelHub}";
|
|
};
|
|
};
|
|
|
|
# The upstream module runs beszel-agent under DynamicUser with
|
|
# ProtectSystem = "strict" and no StateDirectory, so /var/lib/beszel-agent
|
|
# (where the agent persists its hub-pairing fingerprint, per
|
|
# https://github.com/henrygd/beszel/discussions/1542) isn't writable --
|
|
# every restart silently fails to save it and regenerates a fresh one in
|
|
# memory, permanently desyncing from whatever the hub has on record after
|
|
# the very first successful pairing. Give it real persistent storage.
|
|
systemd.services.beszel-agent.serviceConfig.StateDirectory = "beszel-agent";
|
|
}
|