This repository has been archived on 2026-07-30. You can view files and clone it. You cannot open issues or pull requests or push a commit.

beatzaplentyandClaude Sonnet 4.6 78bb784265 fix(provision): block build until sops changes are committed, guard missing host keys ...

Three ordering-related fixes to the Proxmox provisioning flow:

1. prepare-host-key.sh: make idempotent -- if the key already exists, print
   a note and exit 0 instead of erroring. The caller (create-proxmox-resource.sh)
   already guards standalone calls, but the script itself should be safe to
   run directly on a host that was already keyed.

2. create-proxmox-resource.sh: after sync-host-keys.sh updates .sops.yaml /
   secrets/, detect uncommitted changes and block with a prompt until the
   operator confirms they've committed and pushed. The PVE node's git pull
   only picks up committed+pushed state; without this gate, a new host's sops
   recipient is missing from the secrets files the image build uses, so the
   host can't decrypt secrets on first boot.

3. create-proxmox-resource.sh: add an explicit existence check for the host
   key in both the LXC and VM remote build heredocs, before it's passed as
   --pre-format-files / NIXOS_HOST_KEYS_DIR input. Gives a clear error
   pointing at sync-host-keys.sh instead of a raw `cp: cannot stat` from
   disko deep in the build.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-07-25 17:14:25 +10:00

..

clone-pve1-to-pve-test.sh

Add ad hoc pve1 -> pve-test clone script (vzdump + qmrestore/pct restore)

2026-07-21 20:22:56 +00:00

configure-nix-cache-client.sh

sync nix-cache ssh key

2026-07-25 15:55:04 +10:00

create-proxmox-resource.sh

fix(provision): block build until sops changes are committed, guard missing host keys

2026-07-25 17:14:25 +10:00