Drop the transitional mkDefault from the dev VM forge SSH entry #82

New issue

Closed

opened 2026-09-20 04:48:11 +01:00 by vnprc-agent · 0 comments

vnprc-agent commented

2026-09-20 04:48:11 +01:00

Drop the transitional lib.mkDefault from the dev VM's rendered forge SSH entry, so a stray profile copy of that block is a type clash at evaluation rather than a silent winner. Part of allod/strategy#56; the trigger named there is met: a deploy lock now exists in which no profile input defines the block.

Primary goals:

One author, enforced — modules/dev-ssh-forge.nix sets IdentityFile at normal priority; the comment explaining the transition goes with it.
Fail loud — the ssh-settings check's legacy-profile fixture flips from "the profile's identity file wins" to "evaluation fails with a conflicting-type error", and the deleted-profile fixture keeps proving the framework's key is the one rendered.

Current state and specifics

modules/dev-ssh-forge.nix renders programs.ssh.settings.<forgeHost> with IdentityFile = lib.mkDefault "~/.ssh/${sshKeyName}", so that a profile still carrying the block (allod/profiles before fa37849, and deployments' private profiles) won without a clash while the two sides landed in either order. Both sides have landed: allod/profiles fa37849 deleted the public copy, and deployments have deleted theirs and taken both into their deploy locks. checks/ssh-settings.nix pins the transitional behaviour with a fixture that defines the block through legacy matchBlocks beside the module and asserts the profile's key wins; that fixture becomes the sabotage fixture for the clash.

Scope

In: modules/dev-ssh-forge.nix, checks/ssh-settings.nix. Out: the hypervisor's address book translation, and any change to identity.sshHosts.

Drop the transitional `lib.mkDefault` from the dev VM's rendered forge SSH entry, so a stray profile copy of that block is a type clash at evaluation rather than a silent winner. Part of allod/strategy#56; the trigger named there is met: a deploy lock now exists in which no profile input defines the block. Primary goals: - **One author, enforced** — `modules/dev-ssh-forge.nix` sets `IdentityFile` at normal priority; the comment explaining the transition goes with it. - **Fail loud** — the `ssh-settings` check's legacy-profile fixture flips from "the profile's identity file wins" to "evaluation fails with a conflicting-type error", and the deleted-profile fixture keeps proving the framework's key is the one rendered. ### Current state and specifics `modules/dev-ssh-forge.nix` renders `programs.ssh.settings.<forgeHost>` with `IdentityFile = lib.mkDefault "~/.ssh/${sshKeyName}"`, so that a profile still carrying the block (allod/profiles before fa37849, and deployments' private profiles) won without a clash while the two sides landed in either order. Both sides have landed: allod/profiles fa37849 deleted the public copy, and deployments have deleted theirs and taken both into their deploy locks. `checks/ssh-settings.nix` pins the transitional behaviour with a fixture that defines the block through legacy `matchBlocks` beside the module and asserts the profile's key wins; that fixture becomes the sabotage fixture for the clash. ### Scope In: `modules/dev-ssh-forge.nix`, `checks/ssh-settings.nix`. Out: the hypervisor's address book translation, and any change to `identity.sshHosts`.

vnprc-agent referenced this issue from allod/strategy

2026-09-20 04:48:57 +01:00

Each machine derives its SSH client config from its own identity record #56

vnprc-agent referenced this issue

2026-09-20 04:56:39 +01:00

Render a dev VM's own external SSH aliases beside its forge entry #83