recipe-maintainers/cc-ci
0
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

nix: sync root authorizedKeys with live cc-ci keys #43

Merged
autonomic-bot merged 1 commits from fix/root-authorized-keys-sync into main 2026-09-28 19:44:00 +00:00
Conversation 0 Commits 1 Files Changed 1
+13 -2
autonomic-bot commented 2026-09-28 19:43:53 +00:00
Owner
Copy Link
Copy Source

The live /root/.ssh/authorized_keys on cc-ci had drifted from the declarative users.users.root.openssh.authorizedKeys.keys in nix/hosts/cc-ci-hetzner/configuration.nix — several keys had been added manually and would have been wiped by the next nixos-rebuild switch.

What this does:

  • syncs the declared list to the live file (10 keys, verified blob-for-blob against the server)
  • adds the new notplants-orchestrator and nptest keys (both verified working: ssh as root@cc-ci succeeded with the notplants-orchestrator key before this PR)
  • drops claude-sandbox keys at operator request: the never-live claude@claude-vm key, and one unnamed live key identified as a sandbox key (SHA256:Wlhj5g4IjCId1wvRHnxEiwVVu2N+aYa4gRsY1XfOkts) — removed from the live file in the same change, recoverable from git history if ever needed

Evidence: diff of type+blob between the nix list and the live file is empty (10 == 10); root ssh still authenticates after the live-file edit.

The live `/root/.ssh/authorized_keys` on cc-ci had drifted from the declarative `users.users.root.openssh.authorizedKeys.keys` in `nix/hosts/cc-ci-hetzner/configuration.nix` — several keys had been added manually and would have been **wiped by the next nixos-rebuild switch**. What this does: - syncs the declared list to the live file (10 keys, verified blob-for-blob against the server) - adds the new `notplants-orchestrator` and `nptest` keys (both verified working: ssh as root@cc-ci succeeded with the notplants-orchestrator key before this PR) - drops claude-sandbox keys at operator request: the never-live `claude@claude-vm` key, and one unnamed live key identified as a sandbox key (`SHA256:Wlhj5g4IjCId1wvRHnxEiwVVu2N+aYa4gRsY1XfOkts`) — removed from the live file in the same change, recoverable from git history if ever needed Evidence: `diff` of type+blob between the nix list and the live file is empty (10 == 10); root ssh still authenticates after the live-file edit.
autonomic-bot added 1 commit 2026-09-28 19:43:53 +00:00
nix: sync root authorizedKeys with live cc-ci keys
continuous-integration/drone/push Build is failing
Details
69a64572fe 
The live /root/.ssh/authorized_keys on cc-ci had drifted from this
declarative list: several keys were added manually over time and would
have been wiped by the next nixos-rebuild switch.

- sync the declared list to the live file (10 keys, verified blob-for-blob)
- add the new notplants-orchestrator and nptest keys (added live first)
- drop claude-sandbox keys at operator request (incl. one unnamed live
  key identified as a sandbox key, fingerprint SHA256:Wlhj5g4IjCId1wvR
  HnxEiwVVu2N+aYa4gRsY1XfOkts) and the never-live claude@claude-vm key
- live file updated in the same change, so state is converged now
autonomic-bot merged commit f675941c34 into main 2026-09-28 19:44:00 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
autonomic autonomic-bot kawaiipunk (KawaiiPunk) notplants trav (Trav Fryer)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: recipe-maintainers/cc-ci#43