[codex] normalize module entrypoints#53
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 54b9333790
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIB1twcfSmy7xyUA5iWl51kfBHS1Dxpmmog0x55Z6HRNlAAAABHNzaDo= swiss" | ||
| "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIKX8MmA9KdHCny6rKCGZlyd/J5qCXh+YDM0/3ZGDmfyaAAAABHNzaDo= yubi" |
There was a problem hiding this comment.
When this applies to rap on nixberry, these become the only accepted SSH keys, but the new wait-for-zfs-pool.service logs in with BatchMode=yes from a systemd service to run rap@nixberry ulock-agent get. Because both keys are OpenSSH security-key (sk-ssh-ed25519) credentials, that unattended machine-to-machine login has no normal key it can use and will keep retrying, which blocks the required ZFS unlock and therefore k3s.service.
Useful? React with 👍 / 👎.
| sleep 5 | ||
| done | ||
|
|
||
| printf '%s\n' "$key" | ${pkgs.sudo}/bin/sudo -n ${pkgs.zfs}/bin/zfs load-key "$pool" |
There was a problem hiding this comment.
If this unit is started while kubex-main is already imported and unlocked, such as after nixos-rebuild switch or a service restart, zfs load-key returns an error for an already-loaded key. With set -e, that makes wait-for-zfs-pool.service fail, and k3s.service requires this unit, so k3s will be stopped even though the pool is usable; check keystatus before calling load-key.
Useful? React with 👍 / 👎.
| primary="$(get_output $primary_desc)" | ||
| secondary="$(get_output $secondary_desc)" |
There was a problem hiding this comment.
The profile criteria passed by mkExec include spaces and *, but expanding $primary_desc and $secondary_desc unquoted splits descriptions like Dell Inc. AW2725Q G2QC174 into separate arguments and can expand * against files in the service working directory. In those profiles get_output then matches only the first word or the wrong glob result, so the generated Hyprland workspace and wallpaper commands can target the wrong monitor or no monitor at all.
Useful? React with 👍 / 👎.
1 participant
Normalize the repository module entrypoints.
import-treescan with explicit top-level module indexesdefault.nixentrypoints for home and NixOS module bucketsValidation:
nix eval .#nixosConfigurations.zion.config.system.build.toplevel.drvPathnix eval .#homeConfigurations."rap@zion".activationPackage.drvPath