recipe-maintainers/cc-ci
0
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

nix: add cc-ci-hetzner host (cpx32, nixos-infect hardware) + root SSH keys

Browse Source 
Created by assistant + patched with root authorized keys so nixos-rebuild
does not lock out SSH access.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
autonomic-bot
2026-05-31 02:59:43 +00:00
co-authored by Claude Sonnet 4.6
parent 4c7150d502
commit b08ebea876
3 changed files with 13 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nix/hosts/cc-ci-hetzner/configuration.nix
+7
View File
@@ -46,6 +46,13 @@
settings.PermitRootLogin = "yes"; settings.PermitRootLogin = "yes";
}; };
# Root SSH authorized keys — preserved across nixos-rebuild switches.
users.users.root.openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOk8NaeBdPbS2gfUvbny8h0AkZlVjGYHzx4QPXSJ38gd claude@claude-vm"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJVlfoLBPseQ9fA9534KmRg2KWcksKZGzAJIpHJ2JpsI mfowler.email@protonmail.com"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAcyTGb/wVgdhg5oBCZZvBaR1RuUQRY/3WHnOQpNDCsp claude-cc-ci-sandbox@20260526"
];
# Firewall — Hetzner has a public IP, so open 80+443 for Traefik. # Firewall — Hetzner has a public IP, so open 80+443 for Traefik.
# Tailscale interface is trusted (no port restrictions for orchestrator access). # Tailscale interface is trusted (no port restrictions for orchestrator access).
# Plan §6: v1 keeps the sops wildcard cert; evaluate ACME-on-public-IP as follow-up. # Plan §6: v1 keeps the sops wildcard cert; evaluate ACME-on-public-IP as follow-up.
nix/hosts/cc-ci-hetzner/hardware.nix
+1 -1
View File
@@ -21,7 +21,7 @@
}; };
fileSystems."/boot/efi" = { fileSystems."/boot/efi" = {
device = "/dev/disk/by-uuid/90B1-5F80"; device = "/dev/disk/by-uuid/D978-69EE";
fsType = "vfat"; fsType = "vfat";
}; };
nix/hosts/cc-ci-hetzner/networking.nix
+5 -6
View File
@@ -5,10 +5,9 @@
# 1. After `terraform apply` + nixos-infect completes, run: # 1. After `terraform apply` + nixos-infect completes, run:
# ssh root@<new-ip> 'cat /etc/nixos/networking.nix' # ssh root@<new-ip> 'cat /etc/nixos/networking.nix'
# 2. Replace this file's contents with the output and commit. # 2. Replace this file's contents with the output and commit.
# 3. Then: `nixos-rebuild switch --flake .#cc-ci-hetzner` # 3. Then: `nixos-rebuild switch --flake .#cc-ci-hetzner --target-host root@<new-ip>`
# #
# Current instance: 168.119.126.100 (throwaway verification run 2026-05-31; # Current instance: 91.98.47.73 (fsn1, Hetzner server 134485294, provisioned 2026-05-31).
# this value will be updated when the production server is provisioned).
{ lib, ... }: { { lib, ... }: {
networking = { networking = {
nameservers = [ nameservers = [
@@ -25,10 +24,10 @@
interfaces = { interfaces = {
eth0 = { eth0 = {
ipv4.addresses = [ ipv4.addresses = [
{ address = "168.119.126.100"; prefixLength = 32; } { address = "91.98.47.73"; prefixLength = 32; }
]; ];
ipv6.addresses = [ ipv6.addresses = [
{ address = "fe80::9000:8ff:fe03:c400"; prefixLength = 64; } { address = "fe80::9000:8ff:fe04:152e"; prefixLength = 64; }
]; ];
ipv4.routes = [{ address = "172.31.1.1"; prefixLength = 32; }]; ipv4.routes = [{ address = "172.31.1.1"; prefixLength = 32; }];
ipv6.routes = [{ address = ""; prefixLength = 128; }]; ipv6.routes = [{ address = ""; prefixLength = 128; }];
@@ -36,6 +35,6 @@
}; };
}; };
services.udev.extraRules = '' services.udev.extraRules = ''
ATTR{address}=="92:00:08:03:c4:00", NAME="eth0" ATTR{address}=="92:00:08:04:15:2e", NAME="eth0"
''; '';
} }