autonomic-bot
69a64572fe
continuous-integration/drone/push Build is failing
The live /root/.ssh/authorized_keys on cc-ci had drifted from this declarative list: several keys were added manually over time and would have been wiped by the next nixos-rebuild switch. - sync the declared list to the live file (10 keys, verified blob-for-blob) - add the new notplants-orchestrator and nptest keys (added live first) - drop claude-sandbox keys at operator request (incl. one unnamed live key identified as a sandbox key, fingerprint SHA256:Wlhj5g4IjCId1wvR HnxEiwVVu2N+aYa4gRsY1XfOkts) and the never-live claude@claude-vm key - live file updated in the same change, so state is converged now
69 lines
4.4 KiB
Nix
69 lines
4.4 KiB
Nix
# cc-ci on Hetzner Cloud — the canonical STANDALONE CI-server host.
|
|
# Hardware + networking + host identity only; every cc-ci service comes from the shared
|
|
# `nixosModules.cc-ci-server` module (nix/modules/default.nix), which flake.nix adds to this
|
|
# host. The same module builds the combined CI-server + orchestrator host declared in
|
|
# recipe-maintainers/cc-ci-orchestrator (`#cc-ci`), which is where cc-ci is moving (2026-09).
|
|
#
|
|
# To apply after `terraform apply` + nixos-infect:
|
|
# git clone --recursive https://git.autonomic.zone/recipe-maintainers/cc-ci.git /etc/cc-ci
|
|
# install -m600 <age-private-key> /var/lib/sops-nix/key.txt
|
|
# nixos-rebuild switch --flake 'git+file:///etc/cc-ci?submodules=1#cc-ci'
|
|
{ pkgs, ... }:
|
|
{
|
|
imports = [
|
|
./hardware.nix
|
|
./networking.nix
|
|
];
|
|
|
|
# This host's public address: acme-dns listens on it and publishes it as the ns-acme glue.
|
|
cc-ci.publicIPv4 = "91.98.47.73";
|
|
# Built from a --recursive clone, so the sops file is the default (the secrets/ submodule).
|
|
|
|
# Tailscale — keeps the orchestrator→cc-ci access path unchanged (direct peer).
|
|
# On the Hetzner host the auth key is also seeded via /etc/ts-auth-key.
|
|
services.tailscale = {
|
|
enable = true;
|
|
authKeyFile = "/etc/ts-auth-key";
|
|
extraUpFlags = [ "--hostname=cc-ci" ];
|
|
};
|
|
|
|
# SSH — allow root login over tailscale (same as Incus host).
|
|
services.openssh = {
|
|
enable = true;
|
|
settings.PermitRootLogin = "yes";
|
|
};
|
|
|
|
# Root SSH authorized keys — preserved across nixos-rebuild switches.
|
|
# 2026-09-28: synced to the live /root/.ssh/authorized_keys on cc-ci (which had drifted:
|
|
# several keys had been added manually and would have been wiped by the next rebuild).
|
|
# Claude-sandbox keys removed at operator request; new `nptest` and
|
|
# `notplants-orchestrator` keys added.
|
|
users.users.root.openssh.authorizedKeys.keys = [
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGZGp/DQTFuD1GvsyTzCVBUTmoWqcb5T+Z7zZo5nYLXO"
|
|
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDhgo41nt8/L+Cr0PKd8jQK45mw/A+h041j6LQ8JWZisEVaQOzr6s9rxPL8VT5ML4P3/4bMblzdDiXWlJxymcb+yk5S5TnVrMavzHEDhWHwEvTRMe6xNTmsU6cmmhRw7PJqqQ+0GTlQalu3I4jkC0kTF7kuPwduUOgUuSpJqxvDTwYiXoyVnOQHAIygh+BmQvYUz0PBfQgIhgcbYmGZ++T0DnMzdGFzW2UB/iy5mymnpmbaZCgLy0w8AoDE+0YLtUc4gwTXc183nvqO1i7LQr+3jBYkv5ZthCCc52vXFHDSw9xZ5ohsOrBvoi5foRbqinmU5/t0aTK7SSrat7xXm/odIOyS+S7PJyeEcsXN6d5zdxbabAy5vLfodEaKGZd4rqQeDCxOTPAS/BlrBV/EV714n4E+fSOAllAuMBO4IibJM/gLJrh2Dql3co50QW9HEDeSC7iqp2lxRBDxvUs3rIEzy7o4HSN8chqBUK1bbBY6B17fuNHIpBAw4akRVVvPnVM= trav@trav480sweet"
|
|
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC6jrKj7iZUNRLBTZG0vZM1D/BXtARhhB4+GrvpyuqmPb9iw2ifT9YqRUwgyGrOW9U6nIAR9yFnfp9+FkyhEKWByqEBbe/zYKlGLRGjfsIdDdW29QQ3hvmqNyboCkXLxZGat93poYhnoomqicmGD/xST4s0OUhcK9E494lUmenlD9dcMZW1aKpJ+9O4Dq6A7nk2z1e4KFcZdrZDI2Hgg+gfEdsKZQqd/R3Mls/eVKpzhfv3Y8BiNoHssUChVf8IGESqTOBOR7Dk7FsU5Z2ZcnQ1coxY7VlBn4fPjTWmz/Ac0jLqgcpCLpNyQzFPDVMYZKYrPVoqBeKVhN5YnfwR5OVP8YsakT/obLwC43sx/esXfjhVGcsRoGpiLOfazzNw/eC8s6FlS8cesOubEM37a7F25z4UEG3d487oM7EjQ39gBCCj/KRgUimCKMWsm6yIas4OSctBWEAo/NhZp0gwulSRxleW6eJCNNwzOmWjdzYIVWoVP0EIeM95Tq8PVUN7gpc= aadil@t480"
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMyHSi12R0+HCVBz7+d9fyOBnoJi8Nsj5D7vQ9UQO8a5"
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJVlfoLBPseQ9fA9534KmRg2KWcksKZGzAJIpHJ2JpsI mfowler.email@protonmail.com"
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHOcLo0YBa0UYi7i/l8K/Y/7cF2OclmDqSTlAsHM0dOS notplants-orchestrator-ed25519"
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMniNzAzuI527bfk/EipqFILFayUCwYXDoZ3R7+QgYq6"
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKmGDZC6wrOQNJAW5PPDpxgEXXrcsnIU4b3QJLtq05RQ cc-ci-loops-to-root@cc-ci"
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIONhAh8/jjH8v8AOZIlzL8yyNyb5VihefIEkaHschoJy nptest"
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHIa8iunWtA4mqLKV6MuiTo3RkVj2ucsk3gLL4ArMEPO notplants-orchestrator"
|
|
];
|
|
|
|
# Firewall — Hetzner has a public IP, so open 80+443 for Traefik.
|
|
# Tailscale interface is trusted (no port restrictions for orchestrator access).
|
|
# Plan §6: v1 keeps the sops wildcard cert; evaluate ACME-on-public-IP as follow-up.
|
|
networking.firewall = {
|
|
enable = true;
|
|
trustedInterfaces = [ "tailscale0" ];
|
|
allowedTCPPorts = [ 22 80 443 ];
|
|
};
|
|
|
|
# The recipe-test tool set (ccciRuntimeTools) is installed by the cc-ci-server module; the ssh
|
|
# client is a host-only addition (not part of the recipe-test tool set).
|
|
environment.systemPackages = [ pkgs.openssh ];
|
|
|
|
system.stateVersion = "24.11";
|
|
}
|