nixos

Archived

This repository has been archived on 2026-07-30. You can view files and clone it. You cannot open issues or pull requests or push a commit.

Files

T

History

beatzaplentyandClaude Sonnet 4.6 f46ae18672

Check NixOS configurations / eval-hosts (pull_request) Failing after 9m43s

Details

fix(ipa): work around OpenSSH 10 AuthorizedKeysCommand path check

OpenSSH 10.0 tightened AuthorizedKeysCommand security by checking every
path component of the command binary for group/world-write permission.
/nix/store is 1775 (group-writable by nixbld), so sshd silently skips
the command for any binary in the Nix store — causing IPA pubkey auth to
silently fail with no diagnostic.

Fix: copy sss_ssh_authorizedkeys to /usr/local/bin via systemd tmpfiles
(C+ copies the file rather than symlinking, so the path at runtime is
root-owned/755 throughout), and point AuthorizedKeysCommand at the copy.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-07-28 10:08:57 +10:00

beszel

Fix beszel-agent losing its hub-pairing fingerprint on every restart

2026-07-20 15:59:24 +10:00

boot

Resolve all statix and nixpkgs-fmt warnings repo-wide

2026-07-20 03:47:42 +10:00

build-types

fix(server): prevent zfs-init-tank from wiping pool on udev race

2026-07-27 21:52:39 +10:00

clan

feat(provision): Phase 2 — migrate SSH host keys to clan vars