fix(dotfiles-updater): add missing PATH dependencies for Linux systemd service - #413
Conversation
- Add kyber's public key to galactica secrets for shared key access - Configure kyber to decrypt and deploy GitHub SSH key to ~/.ssh/id_ed25519_github - Update SSH config to use synced GitHub key for github.com - Enable post-quantum SSH algorithms (sntrup761x25519-sha512@openssh.com) - Modernize host key and public key algorithm preferences 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
- Add rekey-galactica.sh script to automate remote rekeying - Document SSH key sync process in kyber README - Provide clear instructions for both galactica and kyber sides 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
…d service The dotfiles-updater.service was failing with exit code 127 because install.sh requires coreutils (uname, id, dirname), gnumake, curl, and nix commands that weren't available in the systemd service PATH. This aligns the Linux service dependencies with the macOS launchd version which already included coreutils. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
You do not have enough credits to review this pull request. Please purchase more credits to continue. |
|
Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. 📝 WalkthroughWalkthroughThese changes enhance SSH security with post-quantum algorithms, centralize SSH public key management across hosts using let bindings, and enable secure key syncing between Galactica and Kyber machines through rekeying and conditional secret deployment configurations. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes
Possibly related PRs
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello @shunkakinoki, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request addresses a critical issue with the Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
Mesa DescriptionTL;DRFixed the What changed?
Description generated by Mesa. Update settings |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request primarily fixes a failing dotfiles-updater systemd service on Linux by adding missing PATH dependencies, which is a necessary correction. Additionally, the PR introduces significant enhancements for multi-machine secret management using agenix, allowing secrets to be shared between galactica and kyber hosts. This includes refactoring secret definitions, adding a script for remote re-keying, and updating documentation. The PR also hardens SSH client security by enabling modern cryptographic algorithms. While these are valuable improvements, bundling the SSH security hardening and extensive secret management changes with a simple bug fix makes the PR less focused. In the future, consider creating separate PRs for distinct features or fixes to simplify review. My review includes suggestions to improve script robustness and reduce code duplication in your Nix configurations.
| let | ||
| # Galactica's SSH public key | ||
| galactica = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEKze2jlpV7SyTKA2ezqbumpCiDn+5Sj4z5SxrqfzesX shunkakinoki@gmail.com"; | ||
| # Kyber's SSH public key | ||
| kyber = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO0IZtP3KSzY6GVSZ+R+VQYYfu3sEOVaQGDblQxAtwNM ubuntu@kyber"; | ||
| # All machines that can decrypt shared secrets | ||
| allMachines = [ galactica kyber ]; | ||
| in |
There was a problem hiding this comment.
You've done a great job refactoring this file to use a let block. To further improve maintainability and avoid duplicating public key definitions across multiple files (e.g., named-hosts/kyber/secrets.nix), consider centralizing the public key definitions. You could create a common file, for example named-hosts/public-keys.nix, and import it where needed. This would make adding new hosts or updating keys much easier.
Example named-hosts/public-keys.nix:
{
galactica = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEKze2jlpV7SyTKA2ezqbumpCiDn+5Sj4z5SxrqfzesX shunkakinoki@gmail.com";
kyber = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO0IZtP3KSzY6GVSZ+R+VQYYfu3sEOVaQGDblQxAtwNM ubuntu@kyber";
}Then you could use it like this:
let
publicKeys = import ../public-keys.nix;
allMachines = with publicKeys; [ galactica kyber ];
in
{
# ...
}| # Remotely rekey galactica secrets to include kyber's public key | ||
| # This script should be run from kyber to trigger the rekey on galactica | ||
|
|
||
| set -e |
There was a problem hiding this comment.
For better script safety and to be consistent with other scripts in this repository (like update.sh), it's recommended to use set -euo pipefail instead of just set -e.
u: Treats unset variables as an error.o pipefail: Causes a pipeline to return the exit status of the last command in the pipe that failed, not the last command of the pipe.
| set -e | |
| set -euo pipefail |
| # Pull the changes | ||
| echo "" | ||
| echo "📥 Pulling re-encrypted secrets..." | ||
| cd ~/dotfiles |
There was a problem hiding this comment.
Using ~ for the home directory in scripts can sometimes be brittle. It's more robust to use the $HOME environment variable explicitly. This ensures the path is correctly resolved even in less common execution contexts.
| cd ~/dotfiles | |
| cd "$HOME/dotfiles" |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (3)
named-hosts/kyber/rekey-galactica.sh (1)
1-38: Good workflow automation with clear fallback guidance.The script provides a clean user experience with Tailscale SSH automation and helpful manual fallback instructions.
Consider minor robustness improvements:
# Try Tailscale SSH first -if tailscale ssh shunkakinoki@galactica "cd ~/dotfiles && make rekey-galactica" 2>/dev/null; then +if command -v tailscale >/dev/null 2>&1 && tailscale ssh shunkakinoki@galactica "cd ~/dotfiles && make rekey-galactica"; then echo "✅ Rekey completed via Tailscale SSH" else - echo "❌ Tailscale SSH failed. Please run this manually on galactica:" + echo "❌ Tailscale SSH unavailable or failed. Please run this manually on galactica:" echo "" echo " cd ~/dotfiles"# Pull the changes echo "" echo "📥 Pulling re-encrypted secrets..." +if [ ! -d ~/dotfiles ]; then + echo "❌ ~/dotfiles directory not found" + exit 1 +fi cd ~/dotfiles git pullBased on coding guidelines, the script follows shell script best practices.
named-hosts/galactica/secrets.nix (1)
1-19: Good centralization of key management.The introduction of let bindings (galactica, kyber, allMachines) improves maintainability by centralizing SSH public key definitions and making key rotation easier.
Consider extracting the shared let bindings to a common file to avoid duplication between galactica/secrets.nix and kyber/secrets.nix. This would ensure single source of truth for machine public keys.
Example structure:
# common/machine-keys.nix { galactica = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEKze2jlpV7SyTKA2ezqbumpCiDn+5Sj4z5SxrqfzesX shunkakinoki@gmail.com"; kyber = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO0IZtP3KSzY6GVSZ+R+VQYYfu3sEOVaQGDblQxAtwNM ubuntu@kyber"; allMachines = [ galactica kyber ]; }Then import in both files:
let keys = import ../../common/machine-keys.nix; in { "keys/id_ed25519.age" = { file = ./keys/id_ed25519.age; publicKeys = keys.allMachines; }; # ... }Based on learnings, keep configurations modular across directories.
named-hosts/kyber/default.nix (1)
48-61: Correct deployment configuration with proper permissions.The conditional augmentation of age.secrets correctly deploys the GitHub SSH key to ~/.ssh/id_ed25519_github with secure 0600 permissions.
Consider extracting the deployment logic for better readability:
+ # Secret deployment configuration + secretDeploymentConfig = { + "keys/id_ed25519.age" = { + path = "/home/${username}/.ssh/id_ed25519_github"; + mode = "0600"; + }; + }; + age.secrets = builtins.mapAttrs ( name: value: { file = value.file; - # Deploy GitHub SSH key to ~/.ssh/ with correct permissions - } // ( - if name == "keys/id_ed25519.age" then - { - path = "/home/${username}/.ssh/id_ed25519_github"; - mode = "0600"; - } - else - { } - ) + } // (secretDeploymentConfig.${name} or { }) ) (import ./secrets.nix);This reduces nesting and makes it easier to add deployment config for additional secrets.
Based on learnings, document all configuration options in Nix modules.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (7)
home-manager/programs/ssh/default.nix(2 hunks)home-manager/services/dotfiles-updater/default.nix(1 hunks)named-hosts/galactica/secrets.nix(1 hunks)named-hosts/kyber/README.md(1 hunks)named-hosts/kyber/default.nix(1 hunks)named-hosts/kyber/rekey-galactica.sh(1 hunks)named-hosts/kyber/secrets.nix(1 hunks)
🧰 Additional context used
📓 Path-based instructions (11)
**/*.{sh,bash}
📄 CodeRabbit inference engine (CLAUDE.md)
Use shfmt with 2-space indentation for shell scripts
**/*.{sh,bash}: Use 2 spaces for indentation in shell scripts
Add proper shebang lines to shell scripts
Follow shellcheck recommendations in shell scripts
Document complex commands in shell scripts
Use consistent variable naming in shell scripts
Files:
named-hosts/kyber/rekey-galactica.sh
**/*.{js,jsx,ts,tsx,json,jsonc,md}
📄 CodeRabbit inference engine (.cursor/rules/general.mdc)
Use Biome for code formatting as configured in biome.json
Files:
named-hosts/kyber/README.md
**/*.nix
📄 CodeRabbit inference engine (CLAUDE.md)
**/*.nix: Use nixfmt for formatting all Nix files
Document complex configurations with comments in Nix files
**/*.nix: Use 2 spaces for indentation in Nix files
Keep line length under 100 characters in Nix files
Sort attribute sets alphabetically in Nix files
Use consistent spacing around operators in Nix files
Format lists and sets consistently in Nix filesUse treefmt.toml for formatting Nix files
**/*.nix: UsemkOptionfor configurable options in Nix modules
Implement proper typing for all options in Nix modules
Follow the Nix expression language style guide
Files:
home-manager/programs/ssh/default.nixhome-manager/services/dotfiles-updater/default.nixnamed-hosts/kyber/default.nixnamed-hosts/kyber/secrets.nixnamed-hosts/galactica/secrets.nix
**/default.nix
📄 CodeRabbit inference engine (CLAUDE.md)
Use
default.nixfiles for module exports
Files:
home-manager/programs/ssh/default.nixhome-manager/services/dotfiles-updater/default.nixnamed-hosts/kyber/default.nix
home-manager/programs/*/default.nix
📄 CodeRabbit inference engine (.cursor/rules/home-manager.mdc)
Program configurations should be located in
home-manager/programs/<name>/and use home-manager's built-in modules when available
Files:
home-manager/programs/ssh/default.nix
home-manager/programs/**/default.nix
📄 CodeRabbit inference engine (.cursor/rules/home-manager.mdc)
Program configurations must include all necessary dependencies in their configuration
Files:
home-manager/programs/ssh/default.nix
home-manager/**/*.nix
📄 CodeRabbit inference engine (.cursor/rules/home-manager.mdc)
home-manager/**/*.nix: Use typed options whenever possible in Nix configurations
Document all configuration options in Nix modules and programs
Follow home-manager's module structure and keep configurations modular
Use proper indentation and formatting in Nix configuration files
Files:
home-manager/programs/ssh/default.nixhome-manager/services/dotfiles-updater/default.nix
home-manager/programs/**/*.nix
📄 CodeRabbit inference engine (.cursor/rules/home-manager.mdc)
Follow program-specific best practices in program configuration files
Program configurations in
home-manager/programs/should be organized by program name, include all necessary dependencies, usehome.packagesfor package installations, and useprograms.<name>when available in home-manager
Files:
home-manager/programs/ssh/default.nix
home-manager/services/*/default.nix
📄 CodeRabbit inference engine (.cursor/rules/home-manager.mdc)
Service configurations should be located in
home-manager/services/<name>/with proper service definitions and correct dependency handling
Files:
home-manager/services/dotfiles-updater/default.nix
home-manager/services/**/default.nix
📄 CodeRabbit inference engine (.cursor/rules/home-manager.mdc)
Service configurations must include proper service definitions, handle dependencies correctly, and document service parameters
Files:
home-manager/services/dotfiles-updater/default.nix
home-manager/services/**/*.nix
📄 CodeRabbit inference engine (.cursor/rules/nix.mdc)
Service configurations in
home-manager/services/should follow systemd service conventions, include proper service dependencies, and have clear documentation for service parameters
Files:
home-manager/services/dotfiles-updater/default.nix
🧠 Learnings (14)
📚 Learning: 2025-11-25T09:34:40.062Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/general.mdc:0-0
Timestamp: 2025-11-25T09:34:40.062Z
Learning: Document all major changes in Nix configurations
Applied to files:
home-manager/programs/ssh/default.nixhome-manager/services/dotfiles-updater/default.nixnamed-hosts/kyber/default.nixnamed-hosts/galactica/secrets.nix
📚 Learning: 2025-11-25T09:34:55.014Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/home-manager.mdc:0-0
Timestamp: 2025-11-25T09:34:55.014Z
Learning: Applies to home-manager/programs/**/*.nix : Follow program-specific best practices in program configuration files
Applied to files:
home-manager/programs/ssh/default.nixhome-manager/services/dotfiles-updater/default.nixnamed-hosts/kyber/default.nix
📚 Learning: 2025-11-25T09:34:55.014Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/home-manager.mdc:0-0
Timestamp: 2025-11-25T09:34:55.014Z
Learning: Applies to home-manager/**/*.nix : Document all configuration options in Nix modules and programs
Applied to files:
home-manager/programs/ssh/default.nixhome-manager/services/dotfiles-updater/default.nixnamed-hosts/kyber/default.nix
📚 Learning: 2025-11-25T09:34:55.014Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/home-manager.mdc:0-0
Timestamp: 2025-11-25T09:34:55.014Z
Learning: Applies to home-manager/**/*.nix : Use proper indentation and formatting in Nix configuration files
Applied to files:
home-manager/programs/ssh/default.nixnamed-hosts/kyber/default.nix
📚 Learning: 2025-11-25T09:34:55.014Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/home-manager.mdc:0-0
Timestamp: 2025-11-25T09:34:55.014Z
Learning: Applies to home-manager/**/*.nix : Use typed options whenever possible in Nix configurations
Applied to files:
home-manager/programs/ssh/default.nix
📚 Learning: 2025-11-25T09:34:40.062Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/general.mdc:0-0
Timestamp: 2025-11-25T09:34:40.062Z
Learning: Keep configurations modular across home-manager, hosts, and nix-darwin directories
Applied to files:
home-manager/programs/ssh/default.nixhome-manager/services/dotfiles-updater/default.nixnamed-hosts/kyber/default.nix
📚 Learning: 2025-11-25T09:34:55.014Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/home-manager.mdc:0-0
Timestamp: 2025-11-25T09:34:55.014Z
Learning: Applies to home-manager/**/*.nix : Follow home-manager's module structure and keep configurations modular
Applied to files:
home-manager/programs/ssh/default.nixhome-manager/services/dotfiles-updater/default.nixnamed-hosts/kyber/default.nix
📚 Learning: 2025-11-25T09:34:23.224Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-25T09:34:23.224Z
Learning: Applies to nix-darwin/**/*.nix : Use Homebrew only for macOS-specific applications
Applied to files:
home-manager/services/dotfiles-updater/default.nix
📚 Learning: 2025-11-25T09:34:23.224Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-25T09:34:23.224Z
Learning: Applies to **/default.nix : Use `default.nix` files for module exports
Applied to files:
home-manager/services/dotfiles-updater/default.nix
📚 Learning: 2025-11-25T09:35:01.066Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/nix.mdc:0-0
Timestamp: 2025-11-25T09:35:01.066Z
Learning: Applies to home-manager/programs/**/*.nix : Program configurations in `home-manager/programs/` should be organized by program name, include all necessary dependencies, use `home.packages` for package installations, and use `programs.<name>` when available in home-manager
Applied to files:
named-hosts/kyber/default.nix
📚 Learning: 2025-11-25T09:34:55.014Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/home-manager.mdc:0-0
Timestamp: 2025-11-25T09:34:55.014Z
Learning: Applies to home-manager/programs/*/default.nix : Program configurations should be located in `home-manager/programs/<name>/` and use home-manager's built-in modules when available
Applied to files:
named-hosts/kyber/default.nix
📚 Learning: 2025-11-25T09:35:01.066Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/nix.mdc:0-0
Timestamp: 2025-11-25T09:35:01.066Z
Learning: Applies to home-manager/modules/**/*.nix : Document all custom modules and options
Applied to files:
named-hosts/kyber/default.nix
📚 Learning: 2025-11-25T09:35:01.066Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/nix.mdc:0-0
Timestamp: 2025-11-25T09:35:01.066Z
Learning: Test configurations before committing using `nix flake check` and `home-manager build --show-trace`
Applied to files:
named-hosts/kyber/default.nix
📚 Learning: 2025-11-25T09:34:55.014Z
Learnt from: CR
Repo: shunkakinoki/dotfiles PR: 0
File: .cursor/rules/home-manager.mdc:0-0
Timestamp: 2025-11-25T09:34:55.014Z
Learning: Applies to home-manager/programs/**/default.nix : Program configurations must include all necessary dependencies in their configuration
Applied to files:
named-hosts/kyber/default.nix
🪛 LanguageTool
named-hosts/kyber/README.md
[uncategorized] ~78-~78: The official name of this software platform is spelled with a capital “H”.
Context: ...automatically decrypted and deployed to ~/.ssh/id_ed25519_github.
(GITHUB)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (15)
- GitHub Check: cubic · AI code reviewer
- GitHub Check: Agent
- GitHub Check: e2e-run (MacOS, macos-latest)
- GitHub Check: e2e-run (NixOS, ubuntu-latest)
- GitHub Check: e2e-run (Ubuntu, ubuntu-latest)
- GitHub Check: nix-linux
- GitHub Check: nix-nixos
- GitHub Check: nix-darwin
- GitHub Check: docker-build-push (linux/arm64, arm64, ubuntu-24.04-arm)
- GitHub Check: docker-build-push (linux/amd64, amd64, ubuntu-latest)
- GitHub Check: shellcheck
- GitHub Check: lua-neovim
- GitHub Check: shellspec
- GitHub Check: lua-hammerspoon
- GitHub Check: lua-neovim-test
🔇 Additional comments (3)
named-hosts/kyber/README.md (1)
51-78: LGTM! Clear workflow documentation.The SSH key syncing documentation is well-structured, provides clear step-by-step instructions, and aligns with the centralized key management implementation in the codebase.
named-hosts/kyber/secrets.nix (1)
5-24: Correct secret configuration with appropriate scoping.The secret definitions properly distinguish between machine-specific (tailscale-auth for kyber only) and shared secrets (GitHub SSH key for allMachines), with the shared key correctly referencing the galactica source.
Note: The let bindings duplication mentioned in the galactica/secrets.nix review also applies here. Consider the shared import approach suggested there to maintain DRY principles.
home-manager/programs/ssh/default.nix (1)
41-41: Ensure the GitHub SSH key path matches the deployment configuration.The identityFile reference to
~/.ssh/id_ed25519_githubcorrectly aligns with the agenix key deployment in named-hosts/kyber/default.nix (path:/home/${username}/.ssh/id_ed25519_github, mode:0600). The SSH configuration properly uses home-manager'sprograms.ssh.matchBlocksstructure with appropriate GitHub-specific settings (ControlMaster, ControlPath, ControlPersist).
| # Enable post-quantum key exchange algorithms | ||
| # sntrup761x25519 is a hybrid post-quantum algorithm combining | ||
| # Streamlined NTRU Prime (sntrup761) with X25519 | ||
| KexAlgorithms = "sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256"; | ||
| # Prefer modern host key algorithms | ||
| HostKeyAlgorithms = "ssh-ed25519-cert-v01@openssh.com,ssh-ed25519,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-256"; | ||
| # Prefer modern public key algorithms | ||
| PubkeyAcceptedAlgorithms = "ssh-ed25519-cert-v01@openssh.com,ssh-ed25519,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-256"; |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cd home-manager/programs/ssh && wc -l default.nix && head -40 default.nixRepository: shunkakinoki/dotfiles
Length of output: 1635
🏁 Script executed:
rg "KexAlgorithms|HostKeyAlgorithms|PubkeyAcceptedAlgorithms" home-manager/programs/ssh/default.nix -A 2 -B 2Repository: shunkakinoki/dotfiles
Length of output: 809
🏁 Script executed:
# Check formatting: line length in the file
awk 'NR>=23 && NR<=30 {print NR": "length($0)" chars: "$0}' home-manager/programs/ssh/default.nixRepository: shunkakinoki/dotfiles
Length of output: 960
🌐 Web query:
OpenSSH 8.5 sntrup761x25519-sha512 post-quantum key exchange algorithm introduction date
💡 Result:
The sntrup761x25519-sha512 hybrid post‑quantum KEX was added in OpenSSH 8.5, which was released on March 3, 2021. [1][2]
Sources:
[1] OpenSSH release notes — OpenSSH 8.5/8.5p1 (2021-03-03). [2] Announcement / changelog noting sntrup761x25519-sha512 in OpenSSH 8.5.
Line length violations in SSH configuration.
The security improvements with sntrup761x25519-sha512@openssh.com and modern algorithms are sound, however lines 26, 28, and 30 exceed the 100-character limit (147, 171, and 178 characters respectively), violating the Nix formatting guideline. These algorithm lists should be split across multiple lines or refactored to meet the formatting requirement.
🤖 Prompt for AI Agents
In home-manager/programs/ssh/default.nix around lines 23 to 30, the long
KexAlgorithms, HostKeyAlgorithms and PubkeyAcceptedAlgorithms string values
exceed the 100-character line limit; split each long comma-separated algorithm
list across multiple source lines so no line exceeds 100 characters — for
example break the algorithm lists into multiple string literals concatenated
across lines or represent them as a list and join with commas (using
builtins.concatStringsSep) so formatting stays within the limit while preserving
the exact comma-separated values.
| pkgs.coreutils | ||
| pkgs.gnumake | ||
| pkgs.curl | ||
| pkgs.nix |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, examine the complete default.nix file
cat -n home-manager/services/dotfiles-updater/default.nixRepository: shunkakinoki/dotfiles
Length of output: 1930
🏁 Script executed:
# List files in the dotfiles-updater directory
ls -la home-manager/services/dotfiles-updater/
# Check for update.sh and install.sh
find home-manager/services/dotfiles-updater -name "*.sh" -type fRepository: shunkakinoki/dotfiles
Length of output: 344
🏁 Script executed:
# Read the update.sh script
cat -n home-manager/services/dotfiles-updater/update.sh
# Also search for install.sh in case it exists elsewhere
find . -name "install.sh" -type f 2>/dev/null | head -20Repository: shunkakinoki/dotfiles
Length of output: 549
🏁 Script executed:
# Read the install.sh script
cat -n ./install.sh | head -100Repository: shunkakinoki/dotfiles
Length of output: 4493
🏁 Script executed:
# Search for 'make' usage in install.sh
grep -n "make" ./install.sh
# Get the full length of install.sh to understand its scope
wc -l ./install.shRepository: shunkakinoki/dotfiles
Length of output: 649
🏁 Script executed:
# Let's also check if there are any other dependencies in install.sh
grep -nE "(command -v|which|apt-get|brew install)" ./install.sh | head -30Repository: shunkakinoki/dotfiles
Length of output: 580
Darwin launchd service requires equivalent dependencies for consistency and reliability.
The update.sh script runs install.sh on both Darwin and Linux, and install.sh depends on curl (for Nix installation), gnumake, and nix. While the Darwin PATH includes fallback directories (/opt/homebrew/bin and /usr/local/bin), explicitly adding pkgs.gnumake, pkgs.curl, and pkgs.nix to the Darwin service PATH (lines 16-18) would ensure these tools are available without relying on prior installations or fallback paths, matching the Linux service configuration and preventing potential exit code 127 failures.
🤖 Prompt for AI Agents
In home-manager/services/dotfiles-updater/default.nix around lines 43-46 (and
update the Darwin service PATH block at lines 16-18), add pkgs.gnumake,
pkgs.curl, and pkgs.nix to the Darwin service PATH entries so the Darwin launchd
service explicitly includes those package binaries (matching the Linux service
configuration) rather than relying on fallback directories; update the PATH list
to include pkgs.gnumake, pkgs.curl, pkgs.nix alongside pkgs.coreutils.
There was a problem hiding this comment.
Pull request overview
This PR addresses a failing systemd service on Linux (exit code 127) by adding missing PATH dependencies, but also includes substantial additional changes related to SSH key management and secrets synchronization between hosts. The core fix adds coreutils, gnumake, curl, and nix to the Linux systemd service PATH, aligning it with the macOS launchd version. However, the majority of the changes implement a new SSH key synchronization infrastructure between galactica and kyber using agenix.
Key changes:
- Fixed Linux systemd service PATH to include required dependencies
- Implemented SSH key sharing between galactica and kyber hosts using agenix
- Added post-quantum cryptographic algorithms to SSH configuration
- Created rekey automation script and documentation
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| home-manager/services/dotfiles-updater/default.nix | Added coreutils, gnumake, curl, and nix to Linux systemd service PATH |
| home-manager/programs/ssh/default.nix | Added post-quantum crypto algorithms and GitHub-specific identity file |
| named-hosts/kyber/secrets.nix | Configured secrets for Tailscale and shared GitHub SSH key |
| named-hosts/galactica/secrets.nix | Restructured to support multi-host secret sharing |
| named-hosts/kyber/default.nix | Added conditional agenix secret deployment for GitHub SSH key |
| named-hosts/kyber/rekey-galactica.sh | New script to automate remote rekeying of galactica secrets |
| named-hosts/kyber/README.md | Added documentation for SSH key synchronization process |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # Shared SSH key for GitHub authentication (synced from galactica) | ||
| "keys/id_ed25519.age" = { | ||
| file = ../galactica/keys/id_ed25519.age; |
There was a problem hiding this comment.
The secret definition references a file from galactica's directory (../galactica/keys/id_ed25519.age). This creates a tight coupling between the two host configurations and means kyber cannot be deployed independently without galactica's secrets being present. While this may be intentional for shared secrets, consider documenting this dependency or using a shared secrets directory to make the relationship more explicit.
| # Shared SSH key for GitHub authentication (synced from galactica) | |
| "keys/id_ed25519.age" = { | |
| file = ../galactica/keys/id_ed25519.age; | |
| # Shared SSH key for GitHub authentication (shared between galactica and kyber; both hosts must have access to this file) | |
| "keys/id_ed25519.age" = { | |
| file = ../shared/keys/id_ed25519.age; |
| pkgs.coreutils | ||
| pkgs.gnumake | ||
| pkgs.curl | ||
| pkgs.nix |
There was a problem hiding this comment.
The PR title focuses on fixing the dotfiles-updater service, but the majority of changes are unrelated to that fix. The changes include:
- SSH key synchronization between galactica and kyber
- SSH configuration updates (post-quantum crypto, GitHub identity file)
- Agenix secrets management restructuring
- New rekey script and documentation
Consider splitting this into separate PRs:
- One for the dotfiles-updater PATH fix (lines 43-46)
- Another for the SSH key management infrastructure changes
This would make the changes easier to review and track in version control.
| pkgs.curl | ||
| pkgs.nix | ||
| ] | ||
| }"; |
There was a problem hiding this comment.
The macOS launchd configuration includes additional PATH directories (:/opt/homebrew/bin:/usr/local/bin) that are not present in the Linux systemd configuration. While this may be intentional due to platform differences, consider whether Linux systems might need similar additional PATH directories for user-installed tools or if there's an equivalent location that should be included.
| }"; | |
| }:/usr/local/bin:/usr/bin"; |
|
|
||
| # Pull the changes | ||
| echo "" | ||
| echo "📥 Pulling re-encrypted secrets..." |
There was a problem hiding this comment.
The script assumes it's run from a specific location but doesn't validate this. If the script fails at line 34 (cd ~/dotfiles), it will exit due to 'set -e', but the error message won't be clear about what went wrong. Consider adding a check to ensure the dotfiles directory exists before attempting to cd into it, or use a more specific error handling approach.
| echo "📥 Pulling re-encrypted secrets..." | |
| echo "📥 Pulling re-encrypted secrets..." | |
| if [ ! -d ~/dotfiles ]; then | |
| echo "❌ Error: ~/dotfiles directory does not exist. Please ensure it exists before running this script." | |
| exit 1 | |
| fi |
| }; | ||
| "github.com" = { | ||
| serverAliveInterval = 0; | ||
| identityFile = "~/.ssh/id_ed25519_github"; |
There was a problem hiding this comment.
The GitHub SSH configuration now specifies an identity file (/.ssh/id_ed25519_github) that overrides the global default (/.ssh/id_ed25519). However, there's no fallback mechanism if the GitHub-specific key doesn't exist. Consider whether the global default should remain as a fallback option, especially during the transition period when this key might not be deployed yet on all systems.
| identityFile = "~/.ssh/id_ed25519_github"; | |
| identityFile = [ "~/.ssh/id_ed25519_github" "~/.ssh/id_ed25519" ]; |
Fixes treefmt check failures by applying consistent formatting to: - Multi-line array formatting for allMachines - Proper line breaks for merge operators (//) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Summary
Fixes the
dotfiles-updater.servicesystemd service that was failing with exit code 127 (command not found).Changes
coreutils- provides uname, id, dirname commandsgnumake- required by install.shcurl- needed for downloadingnix- used by install.shThis aligns the Linux systemd service dependencies with the macOS launchd version which already included these packages.
Problem
The service was failing because
install.sh(called byupdate.sh) requires commands that weren't available:uname- to detect OSid- to determine current userdirname- for path manipulationmake- to run installationcurl- for downloadsnix- for nix operationsTesting
systemctl --user start dotfiles-updater.service🤖 Generated with Claude Code
Summary by cubic
Fixed the dotfiles-updater Linux systemd service by adding missing PATH tools (coreutils, gnumake, curl, nix). The service now exits 0 and no longer degrades the user session.
Written for commit e04a30c. Summary will update automatically on new commits.