nix/hosts/cc-ci: real hardware + networking from the box; document the infect fixes
hardware.nix / networking.nix are now the nixos-infect output of 195.201.88.249 (ESP E079-7D41, eth0 MAC-pinned), with the one edit that matters: defaultGateway as an attrset with interface = "eth0". README §2a records what it actually took to get NixOS running on the Debian 13 image: NO_SWAP=true (tmpfs /tmp), a manual lustration from rescue mode because 26.05's systemd initrd did not honour NIXOS_LUSTRATE (Debian's unit files shadowed every NixOS service), and the gateway fix applied via a chroot rebuild with the nix sandbox off. flake: cc-ci input back on main (PR #32 merged as f6dbfa3); loops uid pinned to 1000 so workspace rsyncs by uid line up. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz
This commit is contained in:
Claude Fable 5.1
@@ -1,39 +1,19 @@
|
||||
# PROVISIONAL — copied from the old cc-ci server (same Hetzner cloud layout) so the flake can be
|
||||
# evaluated before the new box yielded its own file. MUST be replaced by /etc/nixos/hardware-configuration.nix
|
||||
# from the new host (README §3): the ESP UUID below belongs to the OLD machine.
|
||||
# Hardware configuration for cc-ci on Hetzner Cloud (cpx32: AMD 4 vCPU / 8 GB / x86_64).
|
||||
# Generated by nixos-infect from a Debian 12 base image, then committed here.
|
||||
#
|
||||
# nixos-infect uses GRUB + EFI on Hetzner (not systemd-boot), with a qemu-guest profile
|
||||
# because Hetzner Cloud uses KVM virtualisation.
|
||||
#
|
||||
# IMPORTANT: networking.nix (below) contains the server's static public IP.
|
||||
# When provisioning a new server via `terraform apply`, copy the fresh networking.nix
|
||||
# from /etc/nixos/networking.nix on the new host and commit it here before rebuilding.
|
||||
# Generated by nixos-infect on this machine (2026-09-07), captured verbatim per README §3.
|
||||
# The ESP UUID is specific to THIS server; a new server gets a new file.
|
||||
{ modulesPath, ... }:
|
||||
{
|
||||
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
|
||||
|
||||
boot = {
|
||||
loader = {
|
||||
efi.efiSysMountPoint = "/boot/efi";
|
||||
grub = {
|
||||
efiSupport = true;
|
||||
efiInstallAsRemovable = true;
|
||||
device = "nodev";
|
||||
};
|
||||
boot.loader = {
|
||||
efi.efiSysMountPoint = "/boot/efi";
|
||||
grub = {
|
||||
efiSupport = true;
|
||||
efiInstallAsRemovable = true;
|
||||
device = "nodev";
|
||||
};
|
||||
initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
|
||||
initrd.kernelModules = [ "nvme" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot/efi" = {
|
||||
device = "/dev/disk/by-uuid/D978-69EE";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
fileSystems."/" = {
|
||||
device = "/dev/sda1";
|
||||
fsType = "ext4";
|
||||
};
|
||||
fileSystems."/boot/efi" = { device = "/dev/disk/by-uuid/E079-7D41"; fsType = "vfat"; };
|
||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
|
||||
boot.initrd.kernelModules = [ "nvme" ];
|
||||
fileSystems."/" = { device = "/dev/sda1"; fsType = "ext4"; };
|
||||
|
||||
}
|
||||
|
||||
@@ -1,48 +1,38 @@
|
||||
# PROVISIONAL — derived from the old cc-ci server networking.nix with the new address; replace with the
|
||||
# nixos-infect output of the new host (README §3), keeping defaultGateway.interface.
|
||||
# Hetzner static networking — generated by nixos-infect at provision time.
|
||||
#
|
||||
# This file is server-specific: the IP, gateway, and MAC address are tied to a
|
||||
# particular Hetzner instance. When provisioning a new server:
|
||||
# 1. After `terraform apply` + nixos-infect completes, run:
|
||||
# ssh root@<new-ip> 'cat /etc/nixos/networking.nix'
|
||||
# 2. Replace this file's contents with the output and commit.
|
||||
# 3. Then: `nixos-rebuild switch --flake .#cc-ci-hetzner --target-host root@<new-ip>`
|
||||
#
|
||||
# Current instance: 195.201.88.249 (fsn1, Hetzner server 134485294, provisioned 2026-05-31).
|
||||
# Generated by nixos-infect on this machine (2026-09-07), captured per README §3, with ONE edit:
|
||||
# `defaultGateway` as an attrset WITH `interface = "eth0"`. The generated bare-string form leaves
|
||||
# NixOS ≥25.05 without a default route (the host boots and is unreachable) — see README §2.
|
||||
{ lib, ... }: {
|
||||
# This file was populated at runtime with the networking
|
||||
# details gathered from the active system.
|
||||
networking = {
|
||||
nameservers = [
|
||||
"185.12.64.1"
|
||||
"185.12.64.2"
|
||||
];
|
||||
# The interface MUST be explicit here. Since NixOS 25.05 the scripted-networking
|
||||
# module installs the default route from the gateway interface's
|
||||
# network-addresses-<iface>.service, and it finds that interface either by
|
||||
# `defaultGateway.interface` or by the gateway address being inside one of the
|
||||
# interface's subnets. With Hetzner's off-subnet point-to-point gateway
|
||||
# (195.201.88.249/32 on eth0, gateway 172.31.1.1) neither matched when this was a
|
||||
# bare string, so NO default route was installed and the 26.05 rebuild on
|
||||
# 2026-08-03 took the host off the network (recovered via rescue mode).
|
||||
defaultGateway = {
|
||||
address = "172.31.1.1";
|
||||
nameservers = [ "2a01:4ff:ff00::add:2"
|
||||
"2a01:4ff:ff00::add:1"
|
||||
"185.12.64.2"
|
||||
];
|
||||
defaultGateway = { address = "172.31.1.1"; interface = "eth0"; };
|
||||
defaultGateway6 = {
|
||||
address = "fe80::1";
|
||||
interface = "eth0";
|
||||
};
|
||||
# No IPv6 on this Hetzner instance (link-local only) — nixos-infect emitted an empty
|
||||
# defaultGateway6/ipv6.route which made network-addresses-eth0.service fail
|
||||
# ("ip route add /128" with no prefix). v4-only box, so no IPv6 gateway/route declared.
|
||||
dhcpcd.enable = false;
|
||||
usePredictableInterfaceNames = lib.mkForce false;
|
||||
interfaces = {
|
||||
eth0 = {
|
||||
ipv4.addresses = [
|
||||
{ address = "195.201.88.249"; prefixLength = 32; }
|
||||
{ address="195.201.88.249"; prefixLength=32; }
|
||||
];
|
||||
ipv4.routes = [{ address = "172.31.1.1"; prefixLength = 32; }];
|
||||
ipv6.addresses = [
|
||||
{ address="2a01:4f8:1c1c:a9b::1"; prefixLength=64; }
|
||||
{ address="fe80::2ff8:e3ea:bbb8:aa39"; prefixLength=64; }
|
||||
];
|
||||
ipv4.routes = [ { address = "172.31.1.1"; prefixLength = 32; } ];
|
||||
ipv6.routes = [ { address = "fe80::1"; prefixLength = 128; } ];
|
||||
};
|
||||
|
||||
};
|
||||
};
|
||||
services.udev.extraRules = ''
|
||||
ATTR{address}=="00:00:00:00:00:00", NAME="eth0"
|
||||
ATTR{address}=="92:00:09:d5:ec:0d", NAME="eth0"
|
||||
|
||||
'';
|
||||
}
|
||||
|
||||
@@ -51,6 +51,7 @@ in
|
||||
# claude sessions run as non-root (--dangerously-skip-permissions is refused for root).
|
||||
users.users.loops = {
|
||||
isNormalUser = true;
|
||||
uid = 1000; # fixed: workspace files are rsynced between hosts by uid
|
||||
home = "/home/loops";
|
||||
shell = pkgs.bash;
|
||||
extraGroups = [ "wheel" "docker" ];
|
||||
|
||||
Reference in New Issue
Block a user