aner/roam
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

backup: 2026-07-26 01:19

Browse Source
This commit is contained in:
Aner Zakobar
2026-07-26 01:19:25 +03:00
parent 3e65bf2dab
commit 07112f1a4c
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
homey.org
+8 -2
View File
@@ -92,10 +92,14 @@ Attic: writing ephemeral TOML config via =ExecStartPre= shell script to =/run/at
First deployment of a new container pulls the image during =nixos-rebuild switch=, which can block the activation for several minutes (e.g. stirling-pdf ~2 GB image took ~6 min on Pi). This is expected — not a hang. First deployment of a new container pulls the image during =nixos-rebuild switch=, which can block the activation for several minutes (e.g. stirling-pdf ~2 GB image took ~6 min on Pi). This is expected — not a hang.
SSH lockout recovery: =/etc/ssh/authorized_keys.d/admin= is OVERWRITTEN on every boot by NixOS activation (from the current system generation's Nix store). Manual edits to that file do not survive a reboot. To recover without a valid key: pull SD card, mount root partition (label =NIXOS_SD=), write the new public key to =/home/admin/.ssh/authorized_keys= (permissions: =.ssh/= 700, =authorized_keys= 600, owner UID 1000). This file is NOT managed by activation and survives reboots. Remove it after deploying the updated NixOS config.
Admin SSH key is GPG-backed via YubiKey. Current key: =~/.ssh/gpg-as-ssh.pub= (=openpgp:0x13E0C25D=, =cardno:29_109_265=). SSH client config uses =IdentityAgent ${XDG_RUNTIME_DIR}/gnupg/S.gpg-agent.ssh=. Old broken YubiKey was =cardno:24_758_470= — its private =[A]= subkey material was never exported (flash drive backup contains stubs only).
** Key Files ** Key Files
- =flake.nix= — module list, =mkHost= builder, =homeyConfig= specialArgs, =rpi4Headless= hardware snippet - =flake.nix= — module list, =mkHost= builder, =homeyConfig= specialArgs, =rpi4Headless= hardware snippet
- =hosts/pi-main/default.nix= — enabled services, static IP, WiFi, reliability hardening, Attic substituter config - =hosts/pi-main/default.nix= — enabled services, static IP, WiFi, reliability hardening, Attic substituter config, admin SSH key
- =shells/defaultShell.nix= — dev shell with =homey-deploy-rpi-main= and other helper commands - =shells/defaultShell.nix= — dev shell with =homey-deploy-rpi-main= and other helper commands
- =modules/caddy.nix= — =virtualHosts= option, dual vhost generation, Authelia forward_auth snippet - =modules/caddy.nix= — =virtualHosts= option, dual vhost generation, Authelia forward_auth snippet
- =modules/services/authelia.nix= — access control rule rendering, =accessControlRules= option (unconditional) - =modules/services/authelia.nix= — access control rule rendering, =accessControlRules= option (unconditional)
@@ -106,6 +110,8 @@ First deployment of a new container pulls the image during =nixos-rebuild switch
- =modules/common.nix= — Nix settings, podman network creation, sops global config - =modules/common.nix= — Nix settings, podman network creation, sops global config
- =modules/storage.nix= — external HD mount, =extraDirs= option - =modules/storage.nix= — external HD mount, =extraDirs= option
- =modules/backup.nix= — Restic, pre/post hooks, =extraPaths= option - =modules/backup.nix= — Restic, pre/post hooks, =extraPaths= option
- =scripts/ssh-with-gpg-key.sh= — emergency SSH via GPG key file; sets up ephemeral GNUPGHOME and uses =[A]= subkey
** TODOs ** TODOs
*** TODO Enable chunked uploads to ATTIC *** TODO Enable chunked uploads to ATTIC
@@ -117,7 +123,7 @@ Should be able to do this
#+begin_src toml #+begin_src toml
[store] [store]
# Enable the chunk‑aware upload handler # Enable the chunk-aware upload handler
enableChunkedUpload = true enableChunkedUpload = true
# Optional: limit the size of each chunk (default 10 MiB) # Optional: limit the size of each chunk (default 10 MiB)
maxChunkSize = 5_000_000 # 5 MiB per chunk maxChunkSize = 5_000_000 # 5 MiB per chunk