Archived
beatzaplentyandClaude Sonnet 5
2858891c20
Check NixOS configurations / eval-hosts (push) Failing after 10m48s
sync-host-keys.sh: generates/registers SSH host keys and their .sops.yaml/secrets/*.yaml recipients for flake targets, idempotently. --all, <target>, --remove, --regenerate-all-keys, all with --dry-run (verified zero-side-effect via a sandboxed git-status check across every mode). Only ever touches anchors with a corresponding host-keys/ file -- &admin and any hand-registered real-host anchor are never listed, removed, or regenerated. Supersedes running prepare-host-key.sh one host at a time for any target that already has a flake entry. create-proxmox-resource.sh: builds a lxc-*/proxmox-* target's tarball/disk image and creates it on a real Proxmox node, or reconfigures an existing resource's cores/memory/disk (--modify, always requires typing the VMID back to confirm). Refuses to create a new resource for a VMID that already exists, and refuses to duplicate a host identity that already has a real deployment elsewhere (variables.nix's new deployedTargets, checked by hostName so it also catches cross-platform duplicates) unless --allow-duplicate-host is passed. --dry-run throughout. scripts/env.sh centralizes the Proxmox connection config both scripts (and future ones) share. Also fixes an unrelated gap found along the way: proxmox-* Disko image builds write their .raw file straight into the repo root, and .gitignore never covered it. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot
26 lines
815 B
Plaintext
26 lines
815 B
Plaintext
# ---> Nix
|
|
# Ignore build outputs from performing a nix-build or `nix build` command
|
|
result
|
|
result-*
|
|
|
|
# Disko's proxmox-* image-builder writes the finished .raw disk image
|
|
# directly into the current directory, not into a result-* symlink (see
|
|
# docs/proxmox-images.md, scripts/create-proxmox-resource.sh) — several GB
|
|
# each, never meant to be committed.
|
|
*.raw
|
|
|
|
# Ignore automatically generated direnv output
|
|
.direnv
|
|
|
|
# Python bytecode cache (scripts/lib/*.py)
|
|
__pycache__/
|
|
*.pyc
|
|
|
|
# Locally-generated SSH host keys staged for transfer to a new machine
|
|
# during install (see scripts/prepare-host-key.sh) — never commit these.
|
|
host-keys/
|
|
|
|
# Temporary Milestone 1 audit checklist (remove-sensetive-info-refactor.md)
|
|
# - working notes only, never committed, deleted once every row is rotated.
|
|
secrets-inventory.md
|