Ryan Yin 560a6cc2d8 fix(preservation): mount /etc/ssh in initrd so key changes apply on boot ...

NixOS copies mode-carrying /etc entries such as authorized_keys.d during
stage-2 activation, which runs before systemd starts. preservation mounted the
persisted /etc/ssh from preservation.target afterwards and hid that copy, so a
key change only took effect on `switch`: revoking a key and rebooting silently
restored the old one.

Prepare the mount in initrd, before activation runs, and cover it with a VM
test that seeds a stale authorized_keys file, reboots, and asserts the declared
key replaced it. The same test fails on that assertion with inInitrd disabled.

Verified on all four hosts: /persistent/etc/ssh/authorized_keys.d/root is now
rewritten at boot instead of keeping the timestamp of the last switch.

Assisted-by: Claude Code (claude-opus-5-5)

2026-10-31 01:09:16 +08:00

..

security-auditd.nix

feat(security): harden homelab SSH, services and audit trail

2026-10-31 01:09:15 +08:00

security-exporters.nix

fix(nfs,libvirt): restrict the golden export and bind VNC to loopback (#400)

2026-10-07 15:10:52 +08:00

security-preservation-etc.nix

fix(preservation): mount /etc/ssh in initrd so key changes apply on boot

2026-10-31 01:09:16 +08:00