Archived
Check NixOS configurations / eval-hosts (pull_request) Failing after 11m26s
lxc-* hosts need NIXOS_HOST_KEYS_DIR + --impure to bake in a pre-seeded SSH host key, otherwise sops-nix's .sops.yaml recipient never matches and every secret permanently fails to decrypt on first boot. That invocation is easy to forget, so wrap it as `buildImage <flake-target>` alongside the existing Switch-nix/Test-nix helpers. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>