recipe-maintainers/cc-ci
0
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

nix: add cc-ci-hetzner host (cpx32, nixos-infect hardware) + root SSH keys

Browse Source 
Created by assistant + patched with root authorized keys so nixos-rebuild
does not lock out SSH access.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
autonomic-bot
2026-05-31 02:59:43 +00:00
co-authored by Claude Sonnet 4.6
parent 4c7150d502
commit b08ebea876
3 changed files with 13 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nix/hosts/cc-ci-hetzner/configuration.nix
+7
View File
@@ -46,6 +46,13 @@
settings.PermitRootLogin = "yes";
};
# Root SSH authorized keys — preserved across nixos-rebuild switches.
users.users.root.openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOk8NaeBdPbS2gfUvbny8h0AkZlVjGYHzx4QPXSJ38gd claude@claude-vm"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJVlfoLBPseQ9fA9534KmRg2KWcksKZGzAJIpHJ2JpsI mfowler.email@protonmail.com"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAcyTGb/wVgdhg5oBCZZvBaR1RuUQRY/3WHnOQpNDCsp claude-cc-ci-sandbox@20260526"
];
# Firewall — Hetzner has a public IP, so open 80+443 for Traefik.
# Tailscale interface is trusted (no port restrictions for orchestrator access).
# Plan §6: v1 keeps the sops wildcard cert; evaluate ACME-on-public-IP as follow-up.