Archived
beatzaplentyandClaude Sonnet 5
f55e33b807
Check NixOS configurations / eval-hosts (push) Failing after 11m18s
Finishes the nix-auto-installer migration: scripts/prepare-host-key.sh
and the local host-keys/ directory (gitignored, private key material,
never committed — moved as plain files, not through git history)
weren't carried over in the initial migration.
Also implements automatic key staging, replacing the manual
scp-after-boot step:
- modules/installer/host-keys.nix reads host-keys/ via
builtins.getEnv, which Nix silently returns as "" under normal
(non---impure) evaluation — the module is a no-op by default, safe
for CI, until explicitly opted into:
NIXOS_HOST_KEYS_DIR=$(pwd)/host-keys nix build .#iso --impure
When built this way every key present gets baked into the image at
/etc/host-keys/, and auto-install.sh installs whichever one matches
the flake target selected at install time — no manual per-host scp.
- This deliberately includes the PXE netboot variant, even though
pxe-boot serves it unauthenticated over LAN HTTP: accepted
explicitly as a reasonable trade-off for a network that sits behind
LAN-only infrastructure, not the open internet. auto-install.sh
still falls back to /root/host-keys (manual scp) if a key isn't
baked in, so images built without --impure keep working exactly as
before.
- docs/auto-installer.md replaces nix-auto-installer's README,
updated for in-repo paths and the new build flow.
Verified: normal `nix eval` (no --impure) evaluates identically across
all 19 nixosConfigurations + 4 packages with zero host-keys/* entries
(CI-unaffected); with --impure + the env var set, all three installer
variants (installer/ISO, proxmox-lxc, pxe) correctly embed every key
in host-keys/.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot
38 lines
1.2 KiB
Nix
38 lines
1.2 KiB
Nix
{ lib, ... }:
|
|
|
|
let
|
|
# host-keys/ is gitignored (private key material must never be committed),
|
|
# which means flakes' git-filtered source tree can never see it via a
|
|
# normal relative path — referencing it at all requires stepping outside
|
|
# pure evaluation. builtins.getEnv is neutered to "" under normal
|
|
# `nix build`/`nix eval` (no error, just empty), so this whole module is a
|
|
# silent no-op unless the operator explicitly opts in with --impure and
|
|
# the env var set — safe by default, including in CI.
|
|
#
|
|
# NIXOS_HOST_KEYS_DIR=$(pwd)/host-keys nix build .#iso --impure
|
|
#
|
|
# See docs/auto-installer.md.
|
|
hostKeysDirStr = builtins.getEnv "NIXOS_HOST_KEYS_DIR";
|
|
hasHostKeysDir = hostKeysDirStr != "" && builtins.pathExists hostKeysDirStr;
|
|
hostKeysDir = /. + hostKeysDirStr;
|
|
|
|
keyFileNames =
|
|
if hasHostKeysDir
|
|
then
|
|
lib.filter
|
|
(name: lib.hasSuffix "_ssh_host_ed25519_key" name || lib.hasSuffix "_ssh_host_ed25519_key.pub" name)
|
|
(lib.attrNames (builtins.readDir hostKeysDir))
|
|
else [ ];
|
|
in
|
|
{
|
|
environment.etc = lib.listToAttrs (map
|
|
(name: {
|
|
name = "host-keys/${name}";
|
|
value = {
|
|
source = hostKeysDir + "/${name}";
|
|
mode = "0400";
|
|
};
|
|
})
|
|
keyFileNames);
|
|
}
|