Archived
beatzaplentyandClaude Sonnet 5
ff021ca6f7
Check NixOS configurations / eval-hosts (push) Failing after 53m34s
Both check-nixos.yml workflows (GitHub + Gitea) now call scripts/codex-maintenance.sh instead of a hand-rolled eval-only loop, closing a real gap: CI previously enforced none of the secret grep, nixpkgs-fmt, or statix checks that codex-maintenance.sh already runs locally — nothing was stopping that from regressing. One script now backs both, instead of two copies that can drift from each other. codex-maintenance.sh itself is extended to cover buildable surface that wasn't validated anywhere before: packages.x86_64-linux.*, plus config.system.build.tarball (lxc-* hosts) and config.system.build.diskoImagesScript (proxmox-*, excluding the installer's own proxmox-lxc target, which has no disko config). Also: - scripts/prepare-host-key.sh: dropped the redundant [path-to-nixos-repo] parameter — it always defaults to the repo the script itself lives in now, so a second argument never made sense after the nix-auto-installer migration. - Removed prepare.sh (dead pre-disko manual parted/mkfs/mkswap partitioning, fully superseded) and scripts/create-linode-installer-disk.sh (incomplete draft for an abandoned dd-via-rescue-mode approach; Linode hosts already deploy fine through the normal auto-installer flow). - docs/pxe-boot.md: fixed a stale `nixosConfigurations.pxe-boot` eval command (pre-refactor flat name, not a real flake attribute anymore) and added a cross-reference to docs/auto-installer.md. - CLAUDE.md/README.md: full documentation pass reconciling this session's changes — modules/installer/, modules/pxe-boot/, the LXC/Proxmox image-building deployment paths, corrected the password-hash/SSH-key locations in the safety-rules section (both had drifted to reference files/paths that no longer exist), and added session-workflow guidance to prefer targeted host evals over full-repo sweeps for incremental changes (explicitly scoped to interactive sessions, not CI). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot
75 lines
2.9 KiB
Bash
Executable File
75 lines
2.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Generates a new machine's SSH host key ahead of installing it, so
|
|
# sops-nix has something to derive an age key from before the target
|
|
# ever boots.
|
|
#
|
|
# Why this is needed: sops-nix derives each host's decryption key from
|
|
# its own /etc/ssh/ssh_host_ed25519_key at *activation* time, but that
|
|
# activation runs before systemd would otherwise generate this key on
|
|
# first boot (sshd-keygen is a normal systemd service gated behind
|
|
# multi-user.target; activation scripts run earlier than that). Without
|
|
# pre-seeding, secrets — including the root/nixos login password — fail
|
|
# to decrypt on the machine's very first boot.
|
|
#
|
|
# This script only touches your admin workstation and this repo's
|
|
# .sops.yaml (it never contacts the target machine). Run it, follow the
|
|
# printed next steps, then use the resulting key with the auto-install.sh
|
|
# prompt (see modules/installer/common.nix) when you actually install the
|
|
# new machine.
|
|
set -euo pipefail
|
|
|
|
repo_root="$(cd "$(dirname "$0")/.." && pwd)"
|
|
|
|
hostname="${1:?usage: scripts/prepare-host-key.sh <hostname>}"
|
|
sops_yaml="${repo_root}/.sops.yaml"
|
|
|
|
if [[ ! -f "$sops_yaml" ]]; then
|
|
echo "ERROR: $sops_yaml not found — is this script still under nixos/scripts/?" >&2
|
|
exit 1
|
|
fi
|
|
|
|
keydir="${repo_root}/host-keys"
|
|
mkdir -p "$keydir"
|
|
keyfile="${keydir}/${hostname}_ssh_host_ed25519_key"
|
|
|
|
if [[ -f "$keyfile" ]]; then
|
|
echo "ERROR: $keyfile already exists. Remove it first if you want to regenerate." >&2
|
|
exit 1
|
|
fi
|
|
|
|
nix-shell -p openssh --run "ssh-keygen -t ed25519 -N '' -C '${hostname}' -f '${keyfile}'" >/dev/null
|
|
|
|
age_pub="$(nix-shell -p ssh-to-age --run "ssh-to-age -i '${keyfile}.pub'")"
|
|
|
|
cat <<EOF
|
|
|
|
Generated: ${keyfile}(.pub)
|
|
|
|
=== 1. Add this line under keys: in ${sops_yaml} ===
|
|
- &${hostname} ${age_pub}
|
|
|
|
=== 2. Add *${hostname} to whichever creation_rules key_groups this host needs ===
|
|
(e.g. secrets/common.yaml always; add a per-host secrets/${hostname}.yaml
|
|
block too if this host will get its own secrets, same pattern as
|
|
nix-cache/server.)
|
|
|
|
=== 3. Re-encrypt every secrets file you just added it to ===
|
|
nix-shell -p sops --run 'sops updatekeys ${repo_root}/secrets/common.yaml'
|
|
|
|
=== 4. Commit + push this repo so the flake build picks up the new recipient ===
|
|
|
|
=== 5. Get the key onto the installer, one of two ways ===
|
|
a) Rebuild the installer image with all host-keys/ baked in (see
|
|
docs/auto-installer.md):
|
|
NIXOS_HOST_KEYS_DIR="${keydir}" nix build .#iso --impure
|
|
(or .#lxc / .#pxe / .#all — --impure is required since host-keys/
|
|
is gitignored and flakes can't see it otherwise)
|
|
|
|
b) Or, for an image already built without keys, scp it in after boot:
|
|
scp ${keyfile}{,.pub} root@<target-ip>:/root/host-keys/
|
|
|
|
Then continue with /etc/auto-install.sh as normal — it checks
|
|
/etc/host-keys (baked in) before /root/host-keys (scp'd) and installs
|
|
whichever it finds before running nixos-install.
|
|
EOF
|