Archived
virtualisation/proxmox-lxc.nix registers the Nix store DB via a systemd service, never an activation script -- so neededForUsers sops secrets (password hashes) and the user-creation step that consumes them never ran on a real first boot, leaving /etc/shadow stuck with build-time placeholder entries. boot.postBootCommands looked like the right hook (stage-2-init.sh does invoke it) but switch-to-configuration behaves unreliably that early, before systemd itself is up. Fixed with a genuine oneshot systemd service, gated by ConditionPathExists so it only ever runs once. Confirmed live via a from-scratch destroy+rebuild+redeploy of the lxc-nix-cache test container: real password hashes applied automatically, systemctl is-system-running -> running, zero failed units. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot